I have one very old legacy project, its web API, and really I need to call it (it hosts on Windows Server 2012). This API require .p12 premade client certificates include in request to it, and i have one.
It works with HTTPS only and has a strange certificate.
If I debug my .net 6 project (calls with RestSharp) on Windows 10 - it's OK, but on Ubuntu 22.04 LTS I got issues.
Adding TLSv1.0 or TLSv1.1 or TLSv1.2 support in /etc/ssl/openssl.cnf - don't works.
Using curl -k or --insecure - don't works.
root@nginx:/home/xxx# curl -vvv https://192.168.201.111:44301/api/* Trying 192.168.201.111:44301...* Connected to 192.168.201.111 (192.168.201.111) port 44301 (#0)* ALPN, offering h2* ALPN, offering http/1.1* CAfile: /etc/ssl/certs/ca-certificates.crt* CApath: /etc/ssl/certs* TLSv1.0 (OUT), TLS header, Certificate Status (22):* TLSv1.3 (OUT), TLS handshake, Client hello (1):* TLSv1.0 (IN), TLS header, Certificate Status (22):* TLSv1.3 (IN), TLS handshake, Server hello (2):* TLSv1.2 (OUT), TLS header, Unknown (21):* TLSv1.3 (OUT), TLS alert, protocol version (582):* error:0A000102:SSL routines::unsupported protocol* Closing connection 0curl: (35) error:0A000102:SSL routines::unsupported protocolAnd else:
root@nginx:/home/xxx# openssl s_client -connect 192.168.201.111:44301CONNECTED(00000003)40A77EF2787F0000:error:0A000102:SSL routines:ssl_choose_client_version:unsupported protocol:../ssl/statem/statem_lib.c:1952:---no peer certificate available---No client certificate CA names sent---SSL handshake has read 58 bytes and written 300 bytesVerification: OK---New, (NONE), Cipher is (NONE)Secure Renegotiation IS NOT supportedCompression: NONEExpansion: NONENo ALPN negotiatedEarly data was not sentVerify return code: 0 (ok)Please help me disable this cert validation.
UPDATE #1
In C# I do something like this to configure RestClient (on Windows it works fine, but on Ubuntu it fails):
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls; ServicePointManager.ServerCertificateValidationCallback = (s, ce, ca, p) => true;FileInfo certFile = new (certFileName);if (certFile.Exists is false) throw new FileNotFoundException("Certificate file not found");X509Certificate2Collection certificates = new X509Certificate2Collection();certificates.Import(certFile.FullName, certPassword, X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.PersistKeySet);ServicePointManager.ServerCertificateValidationCallback = (_, _, _, _) => true;var options = new RestClientOptions(baseUrl){ FollowRedirects = true, ClientCertificates = certificates, RemoteCertificateValidationCallback = (sender, certificate, chain, sslPolicyErrors) => true};Client = new RestClient(options);UPD2
root@nginx:/home/xxx# openssl s_client -tls1 -cipher 'DEFAULT:@SECLEVEL=1' -connect 192.168.201.111:44301CONNECTED(00000003)Can't use SSL_get_servernamedepth=1 CN = ORGANIZATIONverify error:num=19:self-signed certificate in certificate chainverify return:1depth=1 CN = ORGANIZATIONverify return:1depth=0 CN = OFFICE1verify return:1405744F5247F0000:error:0A0C0103:SSL routines:tls_process_key_exchange:internal error:../ssl/statem/statem_clnt.c:2248:---Certificate chain 0 s:CN = OFFICE1 i:CN = ORGANIZATION a:PKEY: rsaEncryption, 1024 (bit); sigalg: RSA-SHA512 v:NotBefore: Sep 26 12:10:32 2018 GMT; NotAfter: Sep 23 12:10:32 2028 GMT 1 s:CN = ORGANIZATION i:CN = ORGANIZATION a:PKEY: rsaEncryption, 1024 (bit); sigalg: RSA-SHA1 v:NotBefore: Sep 26 12:10:29 2018 GMT; NotAfter: Sep 23 12:10:29 2028 GMT---Server certificate-----BEGIN CERTIFICATE-----(i replace cert with *)********************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************-----END CERTIFICATE-----subject=CN = OFFICE1issuer=CN = ORGANIZATION---No client certificate CA names sentServer Temp Key: DH, 1024 bits---SSL handshake has read 1657 bytes and written 111 bytesVerification error: self-signed certificate in certificate chain---New, (NONE), Cipher is (NONE)Server public key is 1024 bitSecure Renegotiation IS supportedCompression: NONEExpansion: NONENo ALPN negotiatedSSL-Session: Protocol : TLSv1 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: PSK identity: None PSK identity hint: None SRP username: None Start Time: 1654443076 Timeout : 7200 (sec) Verify return code: 19 (self-signed certificate in certificate chain) Extended master secret: no---