Contents

Introduction

Solução

Introduction

Ao adicionar o conteúdo do arquivo de certificado, o Threatgrid appliance não aceita o certificado e exibe um erro de que este é "Não é um certificado CA cliente/servidor" e o erro é visto como abaixo:

Solução

É possível que o certificado em questão não tenha os ramais necessários para ser aceito pelo dispositivo Threatgrid. Para que o certificado CA seja aceito pela rede ameaçada, ele deve ter as extensões de CA corretas. Para verificar isso:

Passo 1: Para verificar o certificado, você pode executar este comando openssl.

openssl x509 -in poke.fireamp.pem -text

Passo 2: O conteúdo visto aqui é:

Certificate:

Data:

Version: 1 (0x0)

Serial Number: 0 (0x0)

Signature Algorithm: sha256WithRSAEncryption

Issuer: C = IN, ST = KA, O = MYLAB, OU = MYLAB, CN = root.mylab.com

Validity

Not Before: Jun  3 08:55:34 2020 GMT

Not After : May 29 08:55:34 2040 GMT

Subject: C = IN, ST = KA, O = MYLAB, OU = MYLAB, CN = dispupd-master3.mylab.com

Subject Public Key Info:

Public Key Algorithm: rsaEncryption

RSA Public-Key: (2048 bit)

Modulus:

00:9f:4c:cc:c1:0c:bb:88:b0:fb:c0:68:19:a2:36:

e4:29:4d:ef:68:23:e2:69:0f:d6:b7:96:7e:f8:80:

7a:1f:76:97:42:a4:a0:a5:26:2f:b6:06:67:14:26:

df:ab:50:c0:fc:ec:e4:02:7b:ca:86:cf:99:8e:43:

1d:d3:51:4b:0a:7e:ca:46:5a:9f:f2:68:ae:3d:c5:

a1:ab:3b:bb:c3:83:c3:a1:61:83:1e:1e:d6:ab:13:

a3:b1:51:b0:15:f4:a1:11:89:e6:79:0f:ae:89:6b:

5b:ec:74:4d:75:00:60:59:06:49:f1:f5:7c:b8:70:

67:29:fc:fb:81:88:cd:cf:a9:6e:8f:b6:02:b1:58:

02:8c:41:73:9f:7c:fc:9b:37:b4:1f:bd:28:7b:ca:

90:5e:97:7f:4f:40:0e:be:e3:55:cc:dc:32:fb:5a:

ef:c0:40:83:ab:20:c5:28:c1:ca:c5:54:b5:c3:87:

ec:79:be:6e:46:e5:44:56:fc:ab:9b:5f:f5:a3:8b:

06:e3:b3:29:09:bd:76:96:ba:22:09:85:c5:e2:50:

e2:d9:10:f2:58:42:be:99:be:5f:6c:eb:82:dc:3e:

d0:d3:a5:b4:c6:d5:7a:e6:1a:e8:cc:dc:19:b9:c8:

0c:8c:8c:87:a5:d5:0d:d1:d4:1b:a6:14:4f:29:68:

82:cf

Exponent: 65537 (0x10001)

Signature Algorithm: sha256WithRSAEncryption

4a:1f:00:60:fe:0b:0b:e0:02:f8:85:6e:ff:e6:73:92:7a:3f:

4c:46:89:36:84:51:f1:f8:73:9a:b6:6e:83:54:92:48:f4:df:

df:10:d8:c4:f2:36:38:fd:0e:1b:9c:ef:f7:91:c3:90:db:cc:

ec:84:a0:45:9b:35:85:d9:39:10:e6:01:e9:6c:ab:29:c7:0b:

57:12:b4:cb:bd:cf:ae:1c:3a:ff:a1:7d:b7:d4:b2:98:53:7b:

d9:25:11:40:72:1b:ce:90:dd:3e:c8:3c:9f:bf:5b:f5:78:d0:

be:66:b9:d2:ed:d3:c8:71:1d:75:b7:29:37:17:5f:e3:63:68:

51:1d:30:7b:1d:45:67:b2:71:61:59:39:26:19:aa:87:d7:f1:

07:b1:3b:68:b0:1a:5a:9f:61:e3:55:ae:31:80:dc:46:e5:4a:

46:f7:12:6b:1b:8f:b5:68:bf:00:56:66:6a:c6:b2:d9:7a:ea:

61:de:15:72:eb:3b:49:d1:55:bc:9d:6c:8b:05:36:82:f7:b8:

12:ac:c9:f0:e9:1c:8b:60:2d:cf:61:8b:4f:7c:3f:89:e0:05:

e4:58:a8:22:13:74:76:7a:86:20:b2:8c:ae:cc:68:28:56:63:

df:ac:85:29:5b:e4:2b:8e:98:36:75:71:6f:48:3a:af:4c:8f:

4e:57:c5:ce

Etapa 3:Isso indica que as extensões da CA não estão presentes. Estes são os ramais esperados a serem vistos no certificado CA.

X509v3 Basic Constraints: critical

CA:TRUE

Passo 4: Certifique-se de que o certificado tem estes ramais disponíveis e, caso contrário, terá de pedir ao seu fornecedor de certificados para partilhar o certificado CA com estes ramais. Se você criou seu certificado com o OpenSSL, esses comandos o ajudarão a gerar o certificado CA com os ramais corretos.

openssl genrsa -out rootCA.key 2048

openssl req \

-addext basicConstraints=critical,CA:TRUE\

-outform pem -out rootCA.pem \

-key rootCA.key -new -x509 \

-days "1000"

Passo 5: Aqui está um exemplo de como um certificado aceitável se parece:

Certificate:

Data:

Version: 3 (0x2)

Serial Number:

56:e4:2f:5a:f3:21:e2:17:43:13:cb:21:b3:30:16:cb:37:12:54:c6

Signature Algorithm: sha256WithRSAEncryption

Issuer: C = AU, ST = Some-State, O = Internet Widgits Pty Ltd

Validity

Not Before: Nov 17 08:50:01 2020 GMT

Not After : Aug 14 08:50:01 2023 GMT

Subject: C = AU, ST = Some-State, O = Internet Widgits Pty Ltd

Subject Public Key Info:

Public Key Algorithm: rsaEncryption

RSA Public-Key: (2048 bit)

Modulus:

00:cb:1a:3d:db:4f:5d:15:4f:e7:75:37:ae:ac:a4:

dc:de:9d:67:34:6d:ca:d4:9a:e4:26:73:d0:08:90:

0f:0d:bc:16:0f:9c:bb:7d:7e:e0:39:36:78:0f:19:

b0:c1:6a:20:33:96:f9:70:f0:7d:33:74:79:8a:a1:

f8:aa:a4:81:50:dc:e7:5a:b7:4d:6a:4a:d6:aa:5a:

59:d7:58:05:1c:14:d3:03:01:c5:cd:ce:a5:bd:68:

be:c2:31:e1:3a:75:58:f3:5f:fe:c2:38:4e:5f:df:

be:9b:ad:e5:a0:81:41:41:ff:45:90:3c:20:1c:5b:

35:0b:9e:8c:79:49:f6:da:c0:85:df:6f:b7:e3:2c:

e4:fc:2e:08:ff:97:f3:e0:10:ff:3f:79:92:c9:19:

ee:96:46:2c:07:bc:b4:16:88:f3:0e:98:dd:4e:07:

e6:7c:34:9d:a9:71:5a:61:a3:ba:d5:d1:a1:0f:e9:

e2:7d:45:71:36:6e:2d:57:ee:0b:1a:80:c3:e8:76:

29:ed:e2:25:94:0b:4f:9d:01:35:fa:b9:91:e4:1f:

00:17:54:46:d1:2d:62:a1:7c:a2:bd:e0:67:fc:43:

c0:55:e7:82:86:88:34:11:66:0b:85:1a:c5:c0:87:

ce:eb:b8:47:6d:4b:24:cd:4a:ab:e1:90:5f:1f:89:

10:a1

Exponent: 65537 (0x10001)

X509v3 extensions:

X509v3 Subject Key Identifier:

5C:2D:62:32:41:0A:5C:EB:4C:CF:41:A9:FB:81:F9:C1:D9:05:03:3D

X509v3 Authority Key Identifier:

keyid:5C:2D:62:32:41:0A:5C:EB:4C:CF:41:A9:FB:81:F9:C1:D9:05:03:3D

X509v3 Basic Constraints: critical

CA:TRUE

Signature Algorithm: sha256WithRSAEncryption

1c:a4:5d:2e:71:2d:3d:74:98:f4:0e:d1:39:7e:ae:bc:cf:fb:

6c:7a:19:e6:f5:1e:57:0a:93:91:03:4f:9d:02:fb:f9:b7:f4:

64:92:a2:aa:33:34:2d:5a:52:bc:7c:b6:b1:a0:59:d3:98:72:

dd:c6:d2:e5:8c:e0:8b:87:60:44:c8:2c:ad:20:3d:9f:83:b1:

53:e7:22:bc:85:64:fe:b3:11:90:fb:68:1f:ba:04:bd:1a:8f:

dd:02:5d:aa:42:9b:9c:7f:5e:95:63:5f:07:65:b9:0d:83:0c:

a4:f6:48:d4:74:fc:bc:93:9f:79:68:9b:30:d8:c0:e4:d2:d7:

42:aa:fb:43:ef:40:4a:17:9d:3a:6f:50:24:c1:52:74:15:07:

50:82:64:60:20:e1:ec:85:72:11:14:4e:bd:44:a2:74:92:db:

30:d2:32:98:a7:f3:c2:47:b4:f5:6c:60:6d:0e:50:87:75:c7:

a3:a4:5d:25:96:58:43:bb:2b:c4:6c:ea:f1:88:f4:b1:29:22:

0b:cd:03:64:b8:fb:65:cf:29:62:59:ec:b8:b8:33:09:58:cf:

f5:67:2e:f4:b4:7d:de:84:e3:05:84:b8:91:2c:a1:32:af:44:

fa:2d:3e:c3:01:72:c9:56:c9:f0:ce:5e:28:61:f1:79:56:68:

36:f3:bb:21