NSS: client certificate not found (nickname not specified)报错排查及解决

curl: (35) NSS: client certificate not found (nickname not specified)

排查好久，这里记录下这个坑。

初始

这是第三方的一个接口，测试联调时，curl https://xxx.com.cn发现提示证书未信任，

curl: (60) Peer's certificate issuer has been marked as not trusted by the user.
More details here: http://curl.haxx.se/docs/sslcerts.htmlcurl performs SSL certificate verification by default, using a "bundle"of Certificate Authority (CA) public keys (CA certs). If the defaultbundle file isn't adequate, you can specify an alternate fileusing the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented inthe bundle, the certificate verification probably failed due to aproblem with the certificate (it might be expired, or the name mightnot match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, usethe -k (or --insecure) option.

看到熟悉的报错，我知道将对方自签名证书的CA加入信任即可。一通操作之后却还是不行，但是报错变成了新的.

curl: (35) NSS: client certificate not found (nickname not specified)

-vvv也还是没发现什么新的有用信息。
curl -vvv https://xxxxx 时总是报错

* About to connect() to xxx.com.cn port 8912 (#0)
*   Trying 111.122.224.223...
* Connected to gwtest.ccic-net.com.cn (111.122.224.223) port 8912 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crtCApath: none
* NSS: client certificate not found (nickname not specified)
* NSS error -12227 (SSL_ERROR_HANDSHAKE_FAILURE_ALERT)
* SSL peer was unable to negotiate an acceptable set of security parameters.
* Closing connection 0
curl: (35) NSS: client certificate not found (nickname not specified)

原因

其实报错提示很明显，client certificate not found，开始没想到是双向认证，一直以为是CA根证书信任没弄好，结果一直无法解决。

解决

找第三方拿到客户端证书jks证书(p12)。

openssl pkcs12 -in xxx.p12 -out client.pem -nokeys　　　　　　　#客户端个人证书的公钥
openssl pkcs12 -in xxx.p12 -out key.pem -nocerts -nodes　　　　 #客户端个人证书的私钥

也可以转换为公钥与私钥合二为一的文件；
openssl pkcs12 -in xxx.p12 -out all.pem -nodes                                   #客户端公钥与私钥，一起存在all.pem中

使用client.pem+key.pem

curl --cert client.pem --key key.pem https://www.xxxx.com

或使用all.pem

curl --cert all.pem  https://www.xxxx.com

问题解决~

NSS: client certificate not found (nickname not specified)相关推荐

unable to load client certificate private key file
解决方法可以跳过看最后!!!o(￣︶￣)o 终端执行 openssl s_client -connect gateway.sandbox.push.apple.com:2195 -cert MyPus ...
OpenShift 4 - 获取能访问API服务的用户认证Token
<OpenShift 4.x HOL教程汇总> 说明:本文已经在OpenShift 4.7环境中验证文章目录方法1 方法2 方法3 参考方法1 $ oc login -u admin ...
kubernetes1.5.2版本 yum install 方式安装部署认证授权机制安全模式完整版
https://www.sohu.com/a/316191121_701739 https://zhuanlan.zhihu.com/p/31046822 https://kubernetes.io/ ...
The Elastic Stack （ELK）7.14：简单配置到SSL配置教程（带Beats部署）
文章目录一.简介二.环境 1.安装Docker.Docker Compose 三.部署Elastic Stack(ELK) 1.部署ElasticSearch(Distributed, RESTf ...
java keystore ca_PKCS12 Java Keystore from CA and User certificate in java
问题 I've recently been put in charge of mocking up an Apple product (iPhone Configuration Utility) in ...
Mikrotik: Setup SSTP Server for Windows 10 Client
原文: http://www.dr0u.com/mikrotik-setup-sstp-server-for-windows-10-client/ Basic how-to on SSTP for a ...
使用NGINX作为HTTPS正向代理服务器
NGINX主要设计作为反向代理服务器,但随着NGINX的发展,它同样能作为正向代理的选项之一.正向代理本身并不复杂,而如何代理加密的HTTPS流量是正向代理需要解决的主要问题.本文将介绍利用NGINX ...
python搭建https代理服务器_使用NGINX作为HTTPS正向代理服务器
NGINX主要设计作为反向代理服务器,但随着NGINX的发展,它同样能作为正向代理的选项之一.正向代理本身并不复杂,而如何代理加密的HTTPS流量是正向代理需要解决的主要问题.本文将介绍利用NGINX ...
curl 输出接口请求响应时间
文章目录前言一.curl介绍二.具体使用 1.当前目录新建文件 2.执行命令 3.结果总结前言系统需求中需要请求第三方数据接口获取数据,那线上请求第三方接口耗时多少?今天给大家分享一个干货 ...

NSS: client certificate not found (nickname not specified)

NSS: client certificate not found (nickname not specified)报错排查及解决

初始

原因

解决

NSS: client certificate not found (nickname not specified)相关推荐

最新文章

热门文章