Добрый день! Получил сертификаты для аутентификации на веб-сервере (root.cer, client.cer), установил их, команда certmgr -list выдает следующее:
1-------
Issuer : CN=FCCLANDCS
Subject : CN=FCCLANDCS
Serial : 0x595A895CE151374CAF4ACF37FFFDDB47
PrivateKey Link: No
...
3-------
Issuer : CN=FCCLANDCS
Subject : 1.2.643.100.1="#120D31303237373339333436353032", 1.2.643.3.131. 1.1="#120A37373031303138393232", E=4844@rosinv.rosreestr.ru, C=RU, L=лНЯЙБЮ, O=т цсо ╚пНЯРЕУХМБЕМРЮПХГЮЖХЪ √ тЕДЕПЮКЭМНЕ арх╩, CN=бЕПЕЫЮЦХМ дЛХРПХИ аНПХЯНБХВ, T= гЮЛЕЯРХРЕКЭ ПСЙНБНДХРЕКЪ СОПЮБКЕМХЪ ХМТНПЛЮЖХНММШУ РЕУМНКНЦХИ
Serial : 0xE91200000300C7BE631B
PrivateKey Link: Yes. Container: HDIMAGE\\a7529703.000\F504
Но аутентификация на веб-сервере не проходит. Попробовал подключиться через openssl:
CONNECTED(00000003)
>>> TLS 1.0 Handshake [length 00d0], ClientHello
01 00 00 cc 03 01 51 19 e6 de 2c 97 0c 81 67 c8
18 70 74 4c 88 a9 21 0e a0 69 92 84 50 7b 08 80
90 f3 75 11 70 5e 00 00 5e c0 14 c0 0a 00 39 00
38 00 88 00 87 00 81 00 80 c0 0f c0 05 00 35 00
84 c0 12 c0 08 00 16 00 13 c0 0d c0 03 00 0a c0
13 c0 09 00 33 00 32 00 9a 00 99 00 45 00 44 c0
0e c0 04 00 2f 00 96 00 41 c0 11 c0 07 c0 0c c0
02 00 05 00 04 00 15 00 12 00 09 00 14 00 11 00
08 00 06 00 03 00 ff 02 01 00 00 44 00 0b 00 04
03 00 01 02 00 0a 00 34 00 32 00 01 00 02 00 03
00 04 00 05 00 06 00 07 00 08 00 09 00 0a 00 0b
00 0c 00 0d 00 0e 00 0f 00 10 00 11 00 12 00 13
00 14 00 15 00 16 00 17 00 18 00 19 00 23 00 00
<<< TLS 1.0 Handshake [length 0050], ServerHello
02 00 00 4c 03 01 51 19 e7 80 ad 4f 48 f2 06 eb
89 06 2e 61 b7 ab 09 df cc 88 25 bd 7a 65 ed eb
8c f3 5c 3c 66 0e 00 00 81 00 00 24 fd e8 00 20
30 1e 30 08 06 06 2a 85 03 02 02 09 30 08 06 06
2a 85 03 02 02 16 30 08 06 06 2a 85 03 02 02 17
<<< TLS 1.0 Handshake [length 02e5], Certificate
0b 00 02 e1 00 02 de 00 02 db 30 82 02 d7 30 82
02 84 a0 03 02 01 02 02 0a 57 b3 e3 f5 00 03 00
00 11 cf 30 0a 06 06 2a 85 03 02 02 03 05 00 30
14 31 12 30 10 06 03 55 04 03 13 09 46 43 43 4c
41 4e 44 43 53 30 1e 17 0d 31 32 30 39 30 36 30
38 33 30 30 30 5a 17 0d 31 33 30 39 30 36 30 38
33 39 30 30 5a 30 55 31 28 30 26 06 09 2a 86 48
86 f7 0d 01 09 01 16 19 31 39 34 37 40 66 63 63
6c 61 6e 64 2e 72 6f 73 72 65 65 73 74 72 2e 72
75 31 0b 30 09 06 03 55 04 06 13 02 52 55 31 1c
30 1a 06 03 55 04 03 13 13 70 6f 72 74 61 6c 2e
72 6f 73 72 65 65 73 74 72 2e 72 75 30 63 30 1c
06 06 2a 85 03 02 02 13 30 12 06 07 2a 85 03 02
02 24 00 06 07 2a 85 03 02 02 1e 01 03 43 00 04
40 c6 67 93 4f 04 cd 0a 0a d3 ed 1d 71 1a 1e 5d
0a 13 2e 92 63 66 1e ba 45 2c 9f 7d f4 74 82 c5
d6 a6 81 e6 25 47 96 0b b4 f6 7b cd 65 f5 34 cc
65 8b ef 0b fa bc e6 07 60 72 de 51 41 91 0e 11
25 a3 82 01 71 30 82 01 6d 30 0e 06 03 55 1d 0f
01 01 ff 04 04 03 02 04 f0 30 3b 06 03 55 1d 25
04 34 30 32 06 08 2b 06 01 05 05 07 03 04 06 09
2a 85 03 05 01 18 02 02 05 06 07 2a 85 03 02 02
22 06 06 08 2b 06 01 05 05 07 03 02 06 08 2b 06
01 05 05 07 03 01 30 1d 06 03 55 1d 0e 04 16 04
14 62 19 c4 f3 dc cc ba 13 03 b4 47 dc 12 09 66
b2 b6 3e 53 bf 30 1f 06 03 55 1d 23 04 18 30 16
80 14 51 93 2a 3d e5 65 7e 09 ad 4b 73 e1 77 77
80 6d 6d 84 e8 e8 30 59 06 03 55 1d 1f 04 52 30
50 30 4e a0 4c a0 4a 86 48 68 74 74 70 3a 2f 2f
75 63 2e 66 63 63 6c 61 6e 64 2e 72 75 2f 52 41
2f 43 44 50 2f 35 31 39 33 32 61 33 64 65 35 36
35 37 65 30 39 61 64 34 62 37 33 65 31 37 37 37
37 38 30 36 64 36 64 38 34 65 38 65 38 2e 63 72
6c 30 56 06 08 2b 06 01 05 05 07 01 01 04 4a 30
48 30 46 06 08 2b 06 01 05 05 07 30 02 86 3a 68
74 74 70 3a 2f 2f 75 63 2e 66 63 63 6c 61 6e 64
2e 72 75 2f 43 65 72 74 45 6e 72 6f 6c 6c 2f 46
43 43 4c 41 4e 44 43 41 5f 46 43 43 4c 41 4e 44
43 53 28 33 29 2e 63 72 74 30 2b 06 03 55 1d 10
04 24 30 22 80 0f 32 30 31 32 30 39 30 36 30 38
33 30 30 30 5a 81 0f 32 30 31 33 30 39 30 36 30
38 33 30 30 30 5a 30 0a 06 06 2a 85 03 02 02 03
05 00 03 41 00 83 33 24 ba 4a 05 d1 bd c1 dd 8c
ed bb db 51 a2 98 23 b2 b1 44 2c bf 96 cc af 90
9c 85 ad ce 48 b3 26 37 1d 12 8e df 9f cf b6 6a
58 6b aa 03 7b 11 2f de 78 1d db 06 de 8c 4b ae
bb 84 33 e8 f9
depth=0 emailAddress =
1947@fccland.rosreestr.ru, C = RU, CN = portal.rosreestr.ru
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 emailAddress =
1947@fccland.rosreestr.ru, C = RU, CN = portal.rosreestr.ru
verify error:num=27:certificate not trusted
verify return:1
depth=0 emailAddress =
1947@fccland.rosreestr.ru, C = RU, CN = portal.rosreestr.ru
verify error:num=21:unable to verify the first certificate
verify return:1
<<< TLS 1.0 Handshake [length 0008], CertificateRequest
0d 00 00 04 01 16 00 00
<<< TLS 1.0 Handshake [length 0004], ServerHelloDone
0e 00 00 00
>>> TLS 1.0 Handshake [length 0007], Certificate
0b 00 00 03 00 00 00
>>> TLS 1.0 Handshake [length 00ae], ClientKeyExchange
10 00 00 aa 30 81 a7 30 81 a4 30 28 04 20 04 06
45 ce 7b c1 54 4b 46 a0 60 95 f1 aa 5e 89 d9 19
6d c1 43 30 0d 9c 02 ec 56 2f b9 2d b5 3b 04 04
10 41 b1 e9 a0 78 06 07 2a 85 03 02 02 1f 01 a0
63 30 1c 06 06 2a 85 03 02 02 13 30 12 06 07 2a
85 03 02 02 24 00 06 07 2a 85 03 02 02 1e 01 03
43 00 04 40 4c cf e6 e6 46 56 48 4f 9c 53 ae 4e
fc e9 a9 17 25 f8 c2 55 58 63 ca 5a 0c a6 0b df
e9 41 16 01 6a ce c2 7c ad b9 92 97 96 48 b8 76
a5 e4 43 d4 ba ce 0e 98 80 25 4c ed f7 af a8 4f
ce 44 b5 19 04 08 b5 40 94 aa 0c bd 1c 7c
>>> TLS 1.0 ChangeCipherSpec [length 0001]
01
>>> TLS 1.0 Handshake [length 0010], Finished
14 00 00 0c 46 ee 66 4b 68 c5 7f b8 74 49 a5 c3
<<< TLS 1.0 Alert [length 0002], fatal handshake_failure
02 28
139760020203176:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1195:SSL alert number 40
139760020203176:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177:
---
Certificate chain
0 s:/emailAddress=1947@fccland.rosreestr.ru/C=RU/CN=portal.rosreestr.ru
i:/CN=FCCLANDCS
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIC1zCCAoSgAwIBAgIKV7Pj9QADAAARzzAKBgYqhQMCAgMFADAUMRIwEAYDVQQD
EwlGQ0NMQU5EQ1MwHhcNMTIwOTA2MDgzMDAwWhcNMTMwOTA2MDgzOTAwWjBVMSgw
JgYJKoZIhvcNAQkBFhkxOTQ3QGZjY2xhbmQucm9zcmVlc3RyLnJ1MQswCQYDVQQG
EwJSVTEcMBoGA1UEAxMTcG9ydGFsLnJvc3JlZXN0ci5ydTBjMBwGBiqFAwICEzAS
BgcqhQMCAiQABgcqhQMCAh4BA0MABEDGZ5NPBM0KCtPtHXEaHl0KEy6SY2YeukUs
n330dILF1qaB5iVHlgu09nvNZfU0zGWL7wv6vOYHYHLeUUGRDhElo4IBcTCCAW0w
DgYDVR0PAQH/BAQDAgTwMDsGA1UdJQQ0MDIGCCsGAQUFBwMEBgkqhQMFARgCAgUG
ByqFAwICIgYGCCsGAQUFBwMCBggrBgEFBQcDATAdBgNVHQ4EFgQUYhnE89zMuhMD
tEfcEglmsrY+U78wHwYDVR0jBBgwFoAUUZMqPeVlfgmtS3Phd3eAbW2E6OgwWQYD
VR0fBFIwUDBOoEygSoZIaHR0cDovL3VjLmZjY2xhbmQucnUvUkEvQ0RQLzUxOTMy
YTNkZTU2NTdlMDlhZDRiNzNlMTc3Nzc4MDZkNmQ4NGU4ZTguY3JsMFYGCCsGAQUF
BwEBBEowSDBGBggrBgEFBQcwAoY6aHR0cDovL3VjLmZjY2xhbmQucnUvQ2VydEVu
cm9sbC9GQ0NMQU5EQ0FfRkNDTEFORENTKDMpLmNydDArBgNVHRAEJDAigA8yMDEy
MDkwNjA4MzAwMFqBDzIwMTMwOTA2MDgzMDAwWjAKBgYqhQMCAgMFAANBAIMzJLpK
BdG9wd2M7bvbUaKYI7KxRCy/lsyvkJyFrc5IsyY3HRKO35/PtmpYa6oDexEv3ngd
2wbejEuuu4Qz6Pk=
-----END CERTIFICATE-----
subject=/emailAddress=1947@fccland.rosreestr.ru/C=RU/CN=portal.rosreestr.ru
issuer=/CN=FCCLANDCS
---
No client certificate CA names sent
---
SSL handshake has read 855 bytes and written 222 bytes
---
New, TLSv1/SSLv3, Cipher is GOST2001-GOST89-GOST89
Server public key is 256 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1
Cipher : GOST2001-GOST89-GOST89
Session-ID:
Session-ID-ctx:
Master-Key: 09D57C6B610502BAFFC13D7D316E7D54156752E569989E1D9F5C90A23F50D46F163FBF166B3695F947C79478F63B3DA9
Key-Arg : None
PSK identity: None
PSK identity hint: None
Start Time: 1360651998
Timeout : 300 (sec)
Verify return code: 21 (unable to verify the first certificate)
---
error in s_client
Подскажите, пожалуйста, что не так делаю?
