NSS: client certificate not found (nickname not specified)

最新推荐文章于 2024-05-08 13:39:14 发布

原创最新推荐文章于 2024-05-08 13:39:14 发布 · 4.1k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#服务器 #https #ssl

故障记录专栏收录该内容

7 篇文章

订阅专栏

博客记录了在使用curl进行接口联调时遇到的NSS错误：clientcertificatenotfound(nicknamenotspecified)。最初问题表现为证书未被信任，解决方法是将自签名证书的CA加入信任。但之后问题转变为找不到客户端证书，最终解决方案是获取并使用客户端证书(p12)，通过openssl转换为.pem格式，并在curl命令中指定--cert和--key参数，或者合并为all.pem后使用。问题成功解决。

NSS: client certificate not found (nickname not specified)报错排查及解决

curl: (35) NSS: client certificate not found (nickname not specified)

排查好久，这里记录下这个坑。

初始

这是第三方的一个接口，测试联调时，curl https://xxx.com.cn发现提示证书未信任，

curl: (60) Peer's certificate issuer has been marked as not trusted by the user.
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

看到熟悉的报错，我知道将对方自签名证书的CA加入信任即可。一通操作之后却还是不行，但是报错变成了新的.

curl: (35) NSS: client certificate not found (nickname not specified)

-vvv也还是没发现什么新的有用信息。
curl -vvv https://xxxxx 时总是报错

* About to connect() to xxx.com.cn port 8912 (#0)
*   Trying 111.122.224.223...
* Connected to gwtest.ccic-net.com.cn (111.122.224.223) port 8912 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* NSS: client certificate not found (nickname not specified)
* NSS error -12227 (SSL_ERROR_HANDSHAKE_FAILURE_ALERT)
* SSL peer was unable to negotiate an acceptable set of security parameters.
* Closing connection 0
curl: (35) NSS: client certificate not found (nickname not specified)

原因

其实报错提示很明显，client certificate not found，开始没想到是双向认证，一直以为是CA根证书信任没弄好，结果一直无法解决。

解决

找第三方拿到客户端证书jks证书(p12)。

openssl pkcs12 -in xxx.p12 -out client.pem -nokeys　　　　　　　#客户端个人证书的公钥
openssl pkcs12 -in xxx.p12 -out key.pem -nocerts -nodes　　　　 #客户端个人证书的私钥

也可以转换为公钥与私钥合二为一的文件；
openssl pkcs12 -in xxx.p12 -out all.pem -nodes                                   #客户端公钥与私钥，一起存在all.pem中

使用client.pem+key.pem

curl --cert client.pem --key key.pem https://www.xxxx.com

或使用all.pem

curl --cert all.pem  https://www.xxxx.com

问题解决~