Table des matières
- 2026:
- 2025:
4 billet(s) pour septembre 2026
| Notes HTTP Strict Transport Security - HSTS | 2026/09/18 11:04 | Jean-Baptiste |
| Notes GNU Linux GPU carte graphiques | 2026/09/08 15:49 | Jean-Baptiste |
| Notes GNU Linux graphique | 2026/09/08 15:42 | Jean-Baptiste |
| Notes urlencoding - passer des mots de passe en HTTPS | 2026/09/03 17:58 | Jean-Baptiste |
Pb HTTPS OCSP certificat SSL/TLS révoqué
23 000 certificats HTTPS Digicert supprimés après la fuite de clés privées
Avec Firefox \ SEC_ERROR_REVOKED_CERTIFICATE
Avec Chromium \ NET::ERR_CERT_REVOKED
Contexte : \ Le certificat de l'entreprise a été révoqué par le fournisseur SSL/TLS suite à une fuite de clés privées (recommandation du CAB Forum ?).
Solution de contournement pour Firefox
Solution de contournement pour ne pas vérifier la révocation
about:config
security.OCSP.enabled;0 security.ssl.enable_ocsp_stapling;false
Pour info : security.OCSP.enabled;0 revient à décocher Query OCSP responder servers to confirm the current validity of certificates
Pb https Handshake failed
Voir http://shaarli.guiguishow.info/?zHR4uQ
Sur Firefox \ SSL_ERROR_NO_CYPHER_OVERLAP
Sur Chromium \ ERR_SSL_VERSION_OR_CIPHER_MISMATCH
$ curl --verbose --show-error https://www.2shared.com/file/P6RHTpy6/LG_Root.html * Trying 156.154.175.30:443... ^C $ curl https://www.2shared.com/file/P6RHTpy6/LG_Root.html curl: (35) error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure
$ openssl s_client -debug -connect www.2shared.com:443 ^C $ openssl s_client -debug -connect www.2shared.com:443 ... 140021219538240:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:../ssl/record/rec_layer_s3.c:1543:SSL alert number 40 --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 7 bytes and written 307 bytes Verification: OK --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated Early data was not sent Verify return code: 0 (ok) --- read from 0x556020bbf0a0 [0x556020bb52d0] (8192 bytes => 0 (0x0))
$ gnutls-cli www.2shared.com:443 Processed 129 CA certificate(s). Resolving 'www.2shared.com:443'... Connecting to '156.154.175.30:443'... ^C $ gnutls-cli www.2shared.com:443 Processed 129 CA certificate(s). Resolving 'www.2shared.com:443'... Connecting to '156.154.175.30:443'... *** Fatal error: A TLS fatal alert has been received. *** Received alert [40]: Handshake failed
Diag
Connaître les algos de chiffrements pris en charge
openssl ciphers
gnutls-cli -l
Pb HTTPS - Peer's certificate issuer is not recognized - NSS error -8179
Peer's certificate issuer is not recognized
curl --show-error --verbose https://www.acme.fr * About to connect() to www.acme.fr port 443 (#0) * Trying 46.18.134.141... connected * Connected to www.acme.fr (192.168.12.12) port 443 (#0) * Initializing NSS with certpath: sql:/etc/pki/nssdb * CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none * Peer's certificate issuer is not recognized: 'CN=GlobalSign Extended Validation CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE' * NSS error -8179 * Closing connection #0 * Peer certificate cannot be authenticated with known CA certificates curl: (60) Peer certificate cannot be authenticated with known CA certificates More details here: http://curl.haxx.se/docs/sslcerts.html curl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate file using the --cacert option. If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL). If you'd like to turn off curl's verification of the certificate, use the -k (or --insecure) option
Solution
yum install ca-certificates
Pb hostname FQDN return simple name
La commande hostname -f retourne le nom simple
# hostname -f srv1
Mais hostnamectl retourne bien le FQDN
# hostnamectl | grep hostname
Static hostname: srv1.acme.local
Solution
Le FQDN doit être en première position juste après l'IP dans le /etc/hosts
/etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 #192.168.10.10 srv1 srv1.acme.local 192.168.10.10 srv1.acme.local srv1
Pb Grub Redhat - err grub2-editenv environment block too small - grubenv
Réparer un fichier grubenv modifié à la main
# grubby --args="transparent_hugepage=never" --update-kernel=ALL grub2-editenv: error: environment block too small.
Cela arrive si le fichier /boot/grub2/grubenv a été corrompu. Il doit faire exactement 1024 octets.
Solution 1
Voir :
On copie les fichiers avant de les modifier
cp -p /boot/grub2/grubenv /boot/grub2/grubenv.bak cp -p /boot/grub2/grub.cfg /boot/grub2/grub.cfg.bak
grub2-editenv create
Et si EFI
grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg # Et si besoin #ln -s /boot/efi/EFI/redhat/grubenv /boot/grub2/grubenv
Ou si BIOS
grub2-mkconfig -o /boot/grub2/grub.cfg
Pour SELinux
touch /.autorelabel
Solution 2
On copie le fichier avant de le modifier
cp -p /boot/grub2/grubenv /boot/grub2/grubenv.bak
echo "# GRUB Environment Block" > grubenv.new grep -v "#" /boot/grub2/grub.cfg.bak >> grubenv.new
$ stat -c "%s" grubenv.new 344 $ echo $((1024 - 344)) 680
dd if=<(tr '\000' '#' < /dev/zero) count=1 bs=680 >> grubenv.new
mv grubenv.new /boot/grub2/grubenv
Pour SELinux
touch /.autorelabel
Autres
Recreate file with grub2-editenv create and then set the appropriate saved_entry with grub2-editenv - set saved_entry=