Nats запускаю с no-tls.

Ключ с индексом 0 я добавил, но центр сертификации не хочет выпускать TLS-сертификат. Пишет, мол, ключ не добавлен.

root@kv-gpca-sub01:/home/rpokalyukhin# ps -aux | grep /opt/cpca/
root 1419 0.2 0.1 1318892 23840 pts/1 Sl+ 17:06 0:00 /opt/cpca/nats-streaming/nats-streaming-server -sc /opt/cpca/nats-streaming/nats.no-tls.conf
root 1885 9.6 0.7 5143432 128080 pts/3 Tl 17:11 0:02 /opt/cpca/CryptoPro.Ca.Service/CryptoPro.Ca.Service
root 1986 0.0 0.0 6340 2132 pts/3 S+ 17:11 0:00 grep /opt/cpca/
root@kv-gpca-sub01:/home/rpokalyukhin# /opt/cpca/CryptoPro.Ca.Service/CryptoPro.Ca.Service
[17:11:47 INF] КриптоПро УЦ 2.0. Сервер ЦС. Сборка 1.63.0.32. <s:CryptoPro.Util.Infrastructure.Versioning.VersionWorker>
[17:11:47 WRN] The query uses a row limiting operator ('Skip'/'Take') without an 'OrderBy' operator. This may lead to unpredictable results. <s:Microsoft.EntityFrameworkCore.Query>
[17:11:48 INF] Application started. Press Ctrl+C to shut down. <s:Microsoft.Hosting.Lifetime>
[17:11:48 INF] Hosting environment: Production <s:Microsoft.Hosting.Lifetime>
[17:11:48 INF] Content root path: /home/rpokalyukhin <s:Microsoft.Hosting.Lifetime>
[17:11:49 ERR] Не удалось обработать сообщение Stan для: pkica.ca.command.submitCertRequest <s:CryptoPro.Ca.Service.Workers.CaWorker>
CryptoPro.Ca.KeyNotAcquiredException: Не загружен ключ с индексом 0 для подписи сертификатов.
at CryptoPro.Ca.Infrastructure.SigningKeyProvider.SignAndEncode(Byte[] toBeSigned, SigningKey signingKey, Boolean signCert, Boolean autoLoadKey)
at CryptoPro.Ca.Infrastructure.SigningKeyProvider.SignAndEncodeCertificate(Byte[] toBeSigned, SigningKey signingKey, Boolean autoLoadKey)
at CryptoPro.Ca.Commands.SubmitCertRequestCommandHandler.IssueCertificateAsync(Guid processedRequestId, Byte[] request, DateTimeOffset currentTime, String authorityName)
at CryptoPro.Ca.Commands.SubmitCertRequestCommandHandler.HandleAsync(SubmitCertRequestCommand command)
at CryptoPro.Util.Nats.CommandHandlerWrapper`1.HandleAsync(IServiceProvider serviceProvider, TCommand message)
at CryptoPro.Util.Nats.CommandHandlerWrapper`1.HandleAsync(IServiceProvider serviceProvider, IEncoder encoder, Byte[] messageIn)
at CryptoPro.Util.Nats.MessageDispatcher2.HandleAsync(StanMsg msg)
at CryptoPro.Util.Nats.StanSubscriber.<>c__DisplayClass9_1.<<AddSubscription>b__1>d.MoveNext()

Вот такой вывод:

root@kv-gpca-sub01:/opt/cpca# ./pkica/pkica ca signing-key show -i 0 --status
[ERR] Ошибка асинхронной обработки pkica.ca.query.getKeysLoadStatus
Index: 0
Usage: SignCertAndCrl
LoadedFor: Unknown
SerialNumber: 66D3CD88237C67AA49001AD71F9AD07F
Subject: CN=ROOT CA AO OKB 2025, O=AO OKB, C=RU
Thumbprint: 3E7371F50B1DA977DC5871BCDA68C01D97A974C9
Issuer: CN=ROOT CA AO OKB 2025, O=AO OKB, C=RU
NotBefore: 1/31/2025 10:48:37AM
NotAfter: 1/31/2041 10:48:37AM
PrivateKeyLink:
ProviderType: 80
ProviderName: Crypto-Pro GOST R 34.10-2012 KC1 CSP
ContainerName: HDIMAGE\\contrca.000\716A
KeyType: Signature
MachineKeyStore: false
Silent: false
HashAlgorithm: 32801
HashAlgorithmInfo: ГОСТ Р 34.11-2012 256 бит (1.2.643.7.1.1.2.2)

Да, так тоже ключ подгружается.Но проблема та же.

root@kv-gpca-sub01:/home/rpokalyukhin# /opt/cpca/pkica/pkica ca signing-key load --name "ROOT CA AO OKB 2025" --index 0 --pin 123456
Ключ успешно загружен.
root@kv-gpca-sub01:/home/rpokalyukhin# /opt/cpca/pkica/pkica ca signing-key load -i 0 -u SignCertAndCrl
Введите ПИН-код на контейнер: ******
Ключ успешно загружен.
root@kv-gpca-sub01:/home/rpokalyukhin# /opt/cpca/CryptoPro.Ca.Service/CryptoPro.Ca.Service
[22:16:20 INF] КриптоПро УЦ 2.0. Сервер ЦС. Сборка 1.63.0.32. <s:CryptoPro.Util.Infrastructure.Versioning.VersionWorker>
[22:16:20 WRN] The query uses a row limiting operator ('Skip'/'Take') without an 'OrderBy' operator. This may lead to unpredictable results. <s:Microsoft.EntityFrameworkCore.Query>
[22:16:20 INF] Application started. Press Ctrl+C to shut down. <s:Microsoft.Hosting.Lifetime>
[22:16:20 INF] Hosting environment: Production <s:Microsoft.Hosting.Lifetime>
[22:16:20 INF] Content root path: /home/rpokalyukhin <s:Microsoft.Hosting.Lifetime>
[22:16:21 ERR] Неудачная попытка выпуска CRL для ЦС ROOT CA AO OKB 2025. Не загружен ключ 0. <s:CryptoPro.Ca.CrlBuilder.CrlIssuer>
CryptoPro.Ca.KeyNotAcquiredException: Не загружен ключ с индексом 0 для подписи CRL.
at CryptoPro.Ca.Infrastructure.SigningKeyProvider.SignAndEncode(Byte[] toBeSigned, SigningKey signingKey, Boolean signCert, Boolean autoLoadKey)
at CryptoPro.Ca.Infrastructure.SigningKeyProvider.SignAndEncodeCrl(Byte[] toBeSigned, SigningKey signingKey, Boolean autoLoadKey)
at CryptoPro.Ca.CrlBuilder.CrlIssuer.IssueCrlAsync(Int32 crlNumber, DateTimeOffset currentTime, Guid authorityId, SigningKey sk, AuthoritySettings settings, CrlSchedule schedule, CrlType crlType, Nullable`1 nextupdate)
at CryptoPro.Ca.CrlBuilder.CrlIssuer.IssueAndTryToSaveCrlAsync(Int32 crlNumber, DateTimeOffset currentTime, SigningKey sk, Authority authority, CrlType crlType, Nullable`1 nextUpdate, ITransaction transaction)
at CryptoPro.Ca.CrlBuilder.CrlIssuer.IssueAndSaveCrlAsync(Authority authority, CrlType crlType, Boolean isShadow, Nullable`1 nextUpdate, Nullable`1 keyIndex, Boolean isFinal)
[22:16:22 ERR] Не удалось обработать сообщение Stan для: pkica.ca.command.submitCertRequest <s:CryptoPro.Ca.Service.Workers.CaWorker>
CryptoPro.Ca.KeyNotAcquiredException: Не загружен ключ с индексом 0 для подписи сертификатов.
at CryptoPro.Ca.Infrastructure.SigningKeyProvider.SignAndEncode(Byte[] toBeSigned, SigningKey signingKey, Boolean signCert, Boolean autoLoadKey)
at CryptoPro.Ca.Infrastructure.SigningKeyProvider.SignAndEncodeCertificate(Byte[] toBeSigned, SigningKey signingKey, Boolean autoLoadKey)
at CryptoPro.Ca.Commands.SubmitCertRequestCommandHandler.IssueCertificateAsync(Guid processedRequestId, Byte[] request, DateTimeOffset currentTime, String authorityName)
at CryptoPro.Ca.Commands.SubmitCertRequestCommandHandler.HandleAsync(SubmitCertRequestCommand command)
at CryptoPro.Util.Nats.CommandHandlerWrapper`1.HandleAsync(IServiceProvider serviceProvider, TCommand message)
at CryptoPro.Util.Nats.CommandHandlerWrapper`1.HandleAsync(IServiceProvider serviceProvider, IEncoder encoder, Byte[] messageIn)
at CryptoPro.Util.Nats.MessageDispatcher2.HandleAsync(StanMsg msg)
at CryptoPro.Util.Nats.StanSubscriber.<>c__DisplayClass9_1.<<AddSubscription>b__1>d.MoveNext()
^C[22:16:25 INF] Application is shutting down... <s:Microsoft.Hosting.Lifetime>
[22:16:26 WRN] Потеряно подключение к NATS nats://localhost:4222. <s:CryptoPro.Util.Nats.AddNatsServiceCollectionExtensions.NatsConnectionFactory>

Добрый день!

Спасибо вроде удалось настроить ЦС без TLS.

Вопрос по настройке nats с TLS. Чей отпечаток (// отпечаток клиентского сертификата) сертификата требуется указать в конфигах appsettings.json? TLS или Stan? Ни с тем ни другим сервис не поднимается.

root@kv-gpca-sub01:/opt/cpca# /opt/cpca/nats-streaming/nats-streaming-server -sc /opt/cpca/nats-streaming/nats.conf
[52647] 2025/02/04 10:29:43.323759 [INF] STREAM: Starting nats-streaming-server[pkica-cluster] version 0.24.6
[52647] 2025/02/04 10:29:43.323850 [INF] STREAM: ServerID: 07Ft7gbwxW6OxcEvGE15iW
[52647] 2025/02/04 10:29:43.323854 [INF] STREAM: Go version: go1.18.5
[52647] 2025/02/04 10:29:43.323862 [INF] STREAM: Git commit: [not set]
[52647] 2025/02/04 10:29:43.325957 [INF] Starting nats-server
[52647] 2025/02/04 10:29:43.325974 [INF] Version: 2.8.2
[52647] 2025/02/04 10:29:43.325978 [INF] Git: [not set]
[52647] 2025/02/04 10:29:43.325981 [INF] Name: NCG6ST4RTGCLOMVNOSKAOGS5GLE6QWV2Z3PKOXD5KH3AUI4CFPTNJJ7Z
[52647] 2025/02/04 10:29:43.325988 [INF] ID: NCG6ST4RTGCLOMVNOSKAOGS5GLE6QWV2Z3PKOXD5KH3AUI4CFPTNJJ7Z
[52647] 2025/02/04 10:29:43.326005 [INF] Using configuration file: /opt/cpca/nats-streaming/nats.conf
[52647] 2025/02/04 10:29:43.326020 [WRN] Maximum payloads over 8.00 MB are generally discouraged and could lead to poor performance
[52647] 2025/02/04 10:29:43.327368 [INF] Listening for client connections on localhost:4222
[52647] 2025/02/04 10:29:43.327380 [INF] TLS required for client connections
[52647] 2025/02/04 10:29:43.327394 [INF] Server is ready
Crypto-Pro GOST R 34.10-2012 KC1 CSP requests container password
Type password:
[52647] 2025/02/04 10:29:47.127434 [ERR] 127.0.0.1:44320 - cid:4 - TLS handshake error: read tcp 127.0.0.1:4222->127.0.0.1:44320: i/o timeout
[52647] 2025/02/04 10:29:47.127478 [FTL] STREAM: Failed to start: write tcp 127.0.0.1:44320->127.0.0.1:4222: i/o timeout

Я так и сделал, ошибка следующая:

root@kv-gpca-sub01:/var/opt/cprocsp/keys/stan# /opt/cpca/nats-streaming/nats-streaming-server -sc /opt/cpca/nats-streaming/nats.conf
[61152] 2025/02/04 12:26:00.093480 [INF] STREAM: Starting nats-streaming-server[pkica-cluster] version 0.24.6
[61152] 2025/02/04 12:26:00.093581 [INF] STREAM: ServerID: 6axA8QEelzKe6qYvDqD4lU
[61152] 2025/02/04 12:26:00.093586 [INF] STREAM: Go version: go1.18.5
[61152] 2025/02/04 12:26:00.093588 [INF] STREAM: Git commit: [not set]
[61152] 2025/02/04 12:26:00.095713 [INF] Starting nats-server
[61152] 2025/02/04 12:26:00.095727 [INF] Version: 2.8.2
[61152] 2025/02/04 12:26:00.095732 [INF] Git: [not set]
[61152] 2025/02/04 12:26:00.095736 [INF] Name: NDEHEYY2VQPP6BSP6ZIVU7UZHVFDT45H7ZCT5FPL2EKQNZNOGGGGQ54F
[61152] 2025/02/04 12:26:00.095741 [INF] ID: NDEHEYY2VQPP6BSP6ZIVU7UZHVFDT45H7ZCT5FPL2EKQNZNOGGGGQ54F
[61152] 2025/02/04 12:26:00.095753 [INF] Using configuration file: /opt/cpca/nats-streaming/nats.conf
[61152] 2025/02/04 12:26:00.095759 [WRN] Maximum payloads over 8.00 MB are generally discouraged and could lead to poor performance
[61152] 2025/02/04 12:26:00.096690 [INF] Listening for client connections on localhost:4222
[61152] 2025/02/04 12:26:00.096830 [INF] TLS required for client connections
[61152] 2025/02/04 12:26:00.096925 [INF] Server is ready
[61152] 2025/02/04 12:26:00.154051 [FTL] STREAM: Failed to start: use of closed network connection

Конфиг:

# NATS
listen: kv-gpca-sub01.ipa.ucb.local:4222
max_payload: 10Mb

# NATS Streaming
cluster_id: "pkica-cluster"
store: "file"
dir: "/opt/cpca/pkica-store"

store_limits: {
max_channels: 50
max_bytes: 50GB
}

tls: {
# серверный сертификат NATS
cert_file: "/opt/cpca/nats-streaming/ssl/nats-server.cer"
key_file: "/opt/cpca/nats-streaming/ssl/nats-server.cer"
verify_and_map: true

ip a и hostname:

root@kv-gpca-sub01:~# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 00:50:56:93:40:4a brd ff:ff:ff:ff:ff:ff
altname enp11s0
altname ens192
inet 10.8.95.17/24 brd 10.8.95.255 scope global eth0
valid_lft forever preferred_lft forever
root@kv-gpca-sub01:~# hostname
kv-gpca-sub01.ipa.ucb.local