[已解决] 为用户导入 SSL 自签名证书

[mengzyou (犹梦哲)]

通过 openssl 工具创建了rootCA证书，并用其为一个 Web 服务签署了一个自签名证书，在内部网络通过该证书部署了一个 Web 服务。

在本机系统，将 rootCA.pem 文件拷贝到 /etc/pki/trust/anchors/ 后执行

sudo update-ca-certificates

用户访问报证书问题：

❯ curl https://cr.mengz.lan/v2/_catalog
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the Web page mentioned above.

可是 root 权限访问确正常：

sudo curl https://cr.mengz.lan/v2/_catalog
{"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":[{"Type":"registry","Class":"","Name":"catalog","Action":"*"}]}]}

系统是 openSUSE Leap 15.4，还需要身特殊的导入方式，才能是非 root 用户也能加载到导入的 CA 证书吗？

[BearChild (NianQing Yao)]

curl 在实际使用中，读取的应该是 /var/lib/ca-certificates/ca-bundle.pem ，而 update-ca-certificates 会调用 /usr/lib/ca-certificates/update.d/99certbundle.run 来更新 ca-bundle.pem，理论上你的操作没问题。

不过你可以试试 strace curl 看看 curl 具体读取了什么文件来排查问题。

[mengzyou (犹梦哲)]

@BearChild 感谢帮助，找到原因了，我系统了里安装了 linuxbrew，因此用户所使用的 curl 是 brew 里的 curl，导致了索引系统的证书，使用系统安装的 curl 就没有问题了

❯ /usr/bin/curl https://cr.mengz.lan/v2/_catalog
{"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":[{"Type":"registry","Class":"","Name":"catalog","Action":"*"}]}]}