Где находятся сертификаты в iPhone? – Ваша онлайн-энциклопедия

4 метода обхода верификации ssl-сертификатов в android

 <?xml version="1.0"  encoding="utf-8"?>
  <network-security-config>
  <base-config>
  <trust-anchors>
  <certificates src="@raw/my_ca"/>
  </trust-anchors>
  </base-config> 
</network-security-config>

 C:  >objection patchapk -s test_app.apk
  No  architecture specified. Determining it using `adb`...
  Detected  target device architecture as: armeabi-v7a
  Github  FridaGadget is v10.6.28, local is v10.6.13. Updating...
  Downloading  armeabi-v7a library to  C:.objectionandroidarmeabi-v7alibfrida-gadget.so.xz...
  Unpacking  C:.objectionandroidarmeabi-v7alibfrida-gadget.so.xz...
  Cleaning up  downloaded archives...
  Using Gadget  version: 10.6.28
  Unpacking  test_app.apk
  App already  has android.permission.INTERNET
  Reading  smali from:  C:Temptmp8dxqks1u.apktempsmalicom/test/app/TestMainActivity.smali
  Injecting  loadLibrary call at line: 10
  Writing  patched smali back to: C:Temptmp8dxqks1u.apktempsmalicom/test/app/TestMainActivity.smali
  Creating  library path: C:Temptmp8dxqks1u.apktemplibarmeabi-v7a
  Copying  Frida gadget to libs path...
  Rebuilding  the APK with the frida-gadget loaded...
  Built new  APK with injected loadLibrary and frida-gadget
  Signing new  APK.
  jar signed.
  Signed the  new APK
  Performing  zipalign
  Zipaling  completed
  Copying  final apk from  C:UserscwassAppDataLocalTemptmp8dxqks1u.apktemp.aligned.objection.apk to  current directory...
Cleaning up  temp files...

Проверка легальности цепочки сертификатов

Каким образом корневое хранилище сертификатов используется для процесса проверки сертификата при подтверждении связи SSL / TLS с корневым хранилищем сертификатов?

Срок действия сертификата определяется стандартной библиотекой Java.javax.net.ssl.SSLSocket ВstartHandshake() Метод завершен. Для системы AndroidSSLSocket Эта реализация, основанная на реализации библиотеки OpenSSL, реализованаexternal/conscrypt Модуль предоставлен,SSLSocket Реализуется какOpenSSLSocketImpl Класс (находится вexternal/conscrypt/src/main/java/org/conscrypt/OpenSSLSocketImpl.java）。

OpenSSLSocketImpl.startHandshake() Подтверждение SSL / TLS – чрезвычайно деликатный процесс. Мы пропускаем подробный процесс установления связи и сосредотачиваемся на части проверки сертификата.

OpenSSLSocketImpl.startHandshake() ПроходятNativeCrypto Класс (находится вexternal/conscrypt/src/main/java/org/conscrypt/NativeCrypto.java) Статический метод локального слояSSL_do_handshake() Метод выполняет операцию рукопожатия:

/**
     * Returns the sslSessionNativePointer of the negotiated session. If this is
     * a server negotiation, supplying the {@code alpnProtocols} will enable
     * ALPN negotiation.
     */publicstaticnativelongSSL_do_handshake(long sslNativePointer,
                                               FileDescriptor fd,
                                               SSLHandshakeCallbacks shc,
                                               int timeoutMillis,
                                               boolean client_mode,
                                               byte[] npnProtocols,
                                               byte[] alpnProtocols)
        throws SSLException, SocketTimeoutException, CertificateException;

NativeCrypto Класс определяет набор обратных вызовов, которые будут вызываться кодом OpenSSL C / C , связанным с рукопожатием SSL на локальном уровне.SSLHandshakeCallbacks,над SSL_do_handshake() В методе этот набор обратных вызовов передается на локальный уровень в качестве параметров.

SSLHandshakeCallbacks Это определяется следующим образом:

/**
     * A collection of callbacks from the native OpenSSL code that are
     * related to the SSL handshake initiated by SSL_do_handshake.
     */publicinterfaceSSLHandshakeCallbacks {/**
         * Verify that we trust the certificate chain is trusted.
         *
         * @param sslSessionNativePtr pointer to a reference of the SSL_SESSION
         * @param certificateChainRefs chain of X.509 certificate references
         * @param authMethod auth algorithm name
         *
         * @throws CertificateException if the certificate is untrusted
         */publicvoidverifyCertificateChain(long sslSessionNativePtr, long[] certificateChainRefs,
                String authMethod) throws CertificateException;

        /**
         * Called on an SSL client when the server requests (or
         * requires a certificate). The client can respond by using
         * SSL_use_certificate and SSL_use_PrivateKey to set a
         * certificate if has an appropriate one available, similar to
         * how the server provides its certificate.
         *
         * @param keyTypes key types supported by the server,
         * convertible to strings with #keyType
         * @param asn1DerEncodedX500Principals CAs known to the server
         */publicvoidclientCertificateRequested(byte[] keyTypes,
                                               byte[][] asn1DerEncodedX500Principals)
            throws CertificateEncodingException, SSLException;

        /**
         * Gets the key to be used in client mode for this connection in Pre-Shared Key (PSK) key
         * exchange.
         *
         * @param identityHint PSK identity hint provided by the server or {@code null} if no hint
         *        provided.
         * @param identity buffer to be populated with PSK identity (NULL-terminated modified UTF-8)
         *        by this method. This identity will be provided to the server.
         * @param key buffer to be populated with key material by this method.
         *
         * @return number of bytes this method stored in the {@code key} buffer or {@code 0} if an
         *         error occurred in which case the handshake will be aborted.
         */publicintclientPSKKeyRequested(String identityHint, byte[] identity, byte[] key);

        /**
         * Gets the key to be used in server mode for this connection in Pre-Shared Key (PSK) key
         * exchange.
         *
         * @param identityHint PSK identity hint provided by this server to the client or
         *        {@code null} if no hint was provided.
         * @param identity PSK identity provided by the client.
         * @param key buffer to be populated with key material by this method.
         *
         * @return number of bytes this method stored in the {@code key} buffer or {@code 0} if an
         *         error occurred in which case the handshake will be aborted.
         */publicintserverPSKKeyRequested(String identityHint, String identity, byte[] key);

        /**
         * Called when SSL state changes. This could be handshake completion.
         */publicvoidonSSLStateChange(long sslSessionNativePtr, int type, int val);
    }

среди нихverifyCertificateChain()Обратный вызов используется для проверки сертификата сервера. Система Android использует этот обратный вызов для подключения модуля управления библиотекой корневых сертификатов с подтверждением связи SSL / TLS и проверкой подлинности базового OpenSSL.

SSLHandshakeCallbacks Обратный звонок отOpenSSLSocketImpl достичь,verifyCertificateChain() Реализация следующая:

@SuppressWarnings("unused") @OverridepublicvoidverifyCertificateChain(long sslSessionNativePtr, long[] certRefs, String authMethod)
            throws CertificateException {
        try {
            X509TrustManager x509tm = sslParameters.getX509TrustManager();
            if (x509tm == null) {
                thrownew CertificateException("No X.509 TrustManager");
            }
            if (certRefs == null || certRefs.length == 0) {
                thrownew SSLException("Peer sent no certificate");
            }
            OpenSSLX509Certificate[] peerCertChain = new OpenSSLX509Certificate[certRefs.length];
            for (int i = 0; i < certRefs.length; i  ) {
                peerCertChain[i] = new OpenSSLX509Certificate(certRefs[i]);
            }

            
            handshakeSession = new OpenSSLSessionImpl(sslSessionNativePtr, null, peerCertChain,
                    getHostnameOrIP(), getPort(), null);

            boolean client = sslParameters.getUseClientMode();
            if (client) {
                Platform.checkServerTrusted(x509tm, peerCertChain, authMethod, this);
                if (sslParameters.isCTVerificationEnabled(getHostname())) {
                    byte[] tlsData = NativeCrypto.SSL_get_signed_cert_timestamp_list(
                                        sslNativePointer);
                    byte[] ocspData = NativeCrypto.SSL_get_ocsp_response(sslNativePointer);

                    CTVerifier ctVerifier = sslParameters.getCTVerifier();
                    CTVerificationResult result =
                        ctVerifier.verifySignedCertificateTimestamps(peerCertChain, tlsData, ocspData);

                    if (result.getValidSCTs().size() == 0) {
                        thrownew CertificateException("No valid SCT found");
                    }
                }
            } else {
                String authType = peerCertChain[0].getPublicKey().getAlgorithm();
                Platform.checkClientTrusted(x509tm, peerCertChain, authType, this);
            }
        } catch (CertificateException e) {
            throw e;
        } catch (Exception e) {
            thrownew CertificateException(e);
        } finally {
            
            handshakeSession = null;
        }
    }

OpenSSLSocketImpl изverifyCertificateChain() Из sslParameters ПолучитьX509TrustManagerА потом вPlatform.checkServerTrusted() （com.android.org.conscrypt.Platform,роды external/conscrypt/src/compat/java/org/conscrypt/Platform.java) При выполнении проверки действительности сертификата на стороне сервера:

publicstaticvoidcheckServerTrusted(X509TrustManager tm, X509Certificate[] chain,
            String authType, OpenSSLSocketImpl socket) throws CertificateException {
        if (!checkTrusted("checkServerTrusted", tm, chain, authType, Socket.class, socket)
                && !checkTrusted("checkServerTrusted", tm, chain, authType, String.class,
                                 socket.getHandshakeSession().getPeerHost())) {
            tm.checkServerTrusted(chain, authType);
        }
    }

Platform.checkServerTrusted() ВыполняяX509TrustManager изcheckServerTrusted() Метод выполняет проверку действительности сертификата.

X509TrustManager Из OpenSSLSocketImpl изsslParameters, ЧтоsslParameters Откуда это?OpenSSLSocketImpl изsslParameters Передано создателем объекта:

publicclassOpenSSLSocketImplextendsjavax.net.ssl.SSLSocketimplementsNativeCrypto.SSLHandshakeCallbacks, SSLParametersImpl.AliasChooser,
        SSLParametersImpl.PSKCallbacks {
. . . . . .
    privatefinal SSLParametersImpl sslParameters;
. . . . . .
    protectedOpenSSLSocketImpl(SSLParametersImpl sslParameters) throws IOException {
        this.socket = this;
        this.peerHostname = null;
        this.peerPort = -1;
        this.autoClose = false;
        this.sslParameters = sslParameters;
    }

    protectedOpenSSLSocketImpl(String hostname, int port, SSLParametersImpl sslParameters)
            throws IOException {
        super(hostname, port);
        this.socket = this;
        this.peerHostname = hostname;
        this.peerPort = port;
        this.autoClose = false;
        this.sslParameters = sslParameters;
    }

    protectedOpenSSLSocketImpl(InetAddress address, int port, SSLParametersImpl sslParameters)
            throws IOException {
        super(address, port);
        this.socket = this;
        this.peerHostname = null;
        this.peerPort = -1;
        this.autoClose = false;
        this.sslParameters = sslParameters;
    }


    protectedOpenSSLSocketImpl(String hostname, int port,
                                InetAddress clientAddress, int clientPort,
                                SSLParametersImpl sslParameters) throws IOException {
        super(hostname, port, clientAddress, clientPort);
        this.socket = this;
        this.peerHostname = hostname;
        this.peerPort = port;
        this.autoClose = false;
        this.sslParameters = sslParameters;
    }

    protectedOpenSSLSocketImpl(InetAddress address, int port,
                                InetAddress clientAddress, int clientPort,
                                SSLParametersImpl sslParameters) throws IOException {
        super(address, port, clientAddress, clientPort);
        this.socket = this;
        this.peerHostname = null;
        this.peerPort = -1;
        this.autoClose = false;
        this.sslParameters = sslParameters;
    }

    /**
     * Create an SSL socket that wraps another socket. Invoked by
     * OpenSSLSocketImplWrapper constructor.
     */protectedOpenSSLSocketImpl(Socket socket, String hostname, int port,
            boolean autoClose, SSLParametersImpl sslParameters) throws IOException {
        this.socket = socket;
        this.peerHostname = hostname;
        this.peerPort = port;
        this.autoClose = autoClose;
        this.sslParameters = sslParameters;

        
    }

Другими словами,OpenSSLSocketImpl изsslParameters Из javax.net.ssl.SSLSocketFactory,который OpenSSLSocketFactoryImpl。OpenSSLSocketFactoryImpl Определение (находится вexternal/conscrypt/src/main/java/org/conscrypt/OpenSSLSocketFactoryImpl.java)следующим образом:

package org.conscrypt;

import java.io.IOException;
import java.net.InetAddress;
import java.net.Socket;
import java.net.UnknownHostException;
import java.security.KeyManagementException;

publicclassOpenSSLSocketFactoryImplextendsjavax.net.ssl.SSLSocketFactory {privatefinal SSLParametersImpl sslParameters;
    privatefinal IOException instantiationException;

    publicOpenSSLSocketFactoryImpl() {
        SSLParametersImpl sslParametersLocal = null;
        IOException instantiationExceptionLocal = null;
        try {
            sslParametersLocal = SSLParametersImpl.getDefault();
        } catch (KeyManagementException e) {
            instantiationExceptionLocal = new IOException("Delayed instantiation exception:");
            instantiationExceptionLocal.initCause(e);
        }
        this.sslParameters = sslParametersLocal;
        this.instantiationException = instantiationExceptionLocal;
    }

    publicOpenSSLSocketFactoryImpl(SSLParametersImpl sslParameters) {
        this.sslParameters = sslParameters;
        this.instantiationException = null;
    }

    @Overridepublic String[] getDefaultCipherSuites() {
        return sslParameters.getEnabledCipherSuites();
    }

    @Overridepublic String[] getSupportedCipherSuites() {
        return NativeCrypto.getSupportedCipherSuites();
    }

    @Overridepublic Socket createSocket() throws IOException {
        if (instantiationException != null) {
            throw instantiationException;
        }
        returnnew OpenSSLSocketImpl((SSLParametersImpl) sslParameters.clone());
    }

    @Overridepublic Socket createSocket(String hostname, int port) throws IOException, UnknownHostException {
        returnnew OpenSSLSocketImpl(hostname, port, (SSLParametersImpl) sslParameters.clone());
    }

    @Overridepublic Socket createSocket(String hostname, int port, InetAddress localHost, int localPort)
            throws IOException, UnknownHostException {
        returnnew OpenSSLSocketImpl(hostname,
                                     port,
                                     localHost,
                                     localPort,
                                     (SSLParametersImpl) sslParameters.clone());
    }

    @Overridepublic Socket createSocket(InetAddress address, int port) throws IOException {
        returnnew OpenSSLSocketImpl(address, port, (SSLParametersImpl) sslParameters.clone());
    }

    @Overridepublic Socket createSocket(InetAddress address,
                               int port,
                               InetAddress localAddress,
                               int localPort)
            throws IOException {
        returnnew OpenSSLSocketImpl(address,
                                     port,
                                     localAddress,
                                     localPort,
                                     (SSLParametersImpl) sslParameters.clone());
    }

    @Overridepublic Socket createSocket(Socket s, String hostname, int port, boolean autoClose)
            throws IOException {
        returnnew OpenSSLSocketImplWrapper(s,
                                            hostname,
                                            port,
                                            autoClose,
                                            (SSLParametersImpl) sslParameters.clone());
    }
}

OpenSSLSocketImpl Основная ответственность – установить параметры SSL / TLS.SSLParametersImpl Придерживайтесь SSLSocket. В основном смотрите по умолчаниюSSLParametersImpl изX509TrustManager Что находится (находится вexternal/conscrypt/src/main/java/org/conscrypt/SSLParametersImpl.java ）：

/**
     * Initializes the parameters. Naturally this constructor is used
     * in SSLContextImpl.engineInit method which directly passes its
     * parameters. In other words this constructor holds all
     * the functionality provided by SSLContext.init method.
     * See {@link javax.net.ssl.SSLContext#init(KeyManager[],TrustManager[],
     * SecureRandom)} for more information
     */protectedSSLParametersImpl(KeyManager[] kms, TrustManager[] tms,
            SecureRandom sr, ClientSessionContext clientSessionContext,
            ServerSessionContext serverSessionContext, String[] protocols)
            throws KeyManagementException {
        this.serverSessionContext = serverSessionContext;
        this.clientSessionContext = clientSessionContext;

        if (kms == null) {
            x509KeyManager = getDefaultX509KeyManager();
            
            pskKeyManager = null;
        } else {
            x509KeyManager = findFirstX509KeyManager(kms);
            pskKeyManager = findFirstPSKKeyManager(kms);
        }

        if (tms == null) {
            x509TrustManager = getDefaultX509TrustManager();
        } else {
            x509TrustManager = findFirstX509TrustManager(tms);
        }

        
        secureRandom = sr;

        
        enabledProtocols = NativeCrypto.checkEnabledProtocols(
                protocols == null ? NativeCrypto.DEFAULT_PROTOCOLS : protocols).clone();
        boolean x509CipherSuitesNeeded = (x509KeyManager != null) || (x509TrustManager != null);
        boolean pskCipherSuitesNeeded = pskKeyManager != null;
        enabledCipherSuites = getDefaultCipherSuites(
                x509CipherSuitesNeeded, pskCipherSuitesNeeded);
    }

    protectedstatic SSLParametersImpl getDefault() throws KeyManagementException {
        SSLParametersImpl result = defaultParameters;
        if (result == null) {
            
            defaultParameters = result = new SSLParametersImpl(null,
                                                               null,
                                                               null,
                                                               new ClientSessionContext(),
                                                               new ServerSessionContext(),
                                                               null);
        }
        return (SSLParametersImpl) result.clone();
    }
 . . . . . . 
    /**
     * @return X.509 trust manager or {@code null} for none.
     */protected X509TrustManager getX509TrustManager() {
        return x509TrustManager;
    }
 . . . . . . 
    /**
     * Gets the default X.509 trust manager.
     * <p>
     * TODO: Move this to a published API under dalvik.system.
     */publicstatic X509TrustManager getDefaultX509TrustManager()
            throws KeyManagementException {
        X509TrustManager result = defaultX509TrustManager;
        if (result == null) {
            
            defaultX509TrustManager = result = createDefaultX509TrustManager();
        }
        return result;
    }

    privatestatic X509TrustManager createDefaultX509TrustManager()
            throws KeyManagementException {
        try {
            String algorithm = TrustManagerFactory.getDefaultAlgorithm();
            TrustManagerFactory tmf = TrustManagerFactory.getInstance(algorithm);
            tmf.init((KeyStore) null);
            TrustManager[] tms = tmf.getTrustManagers();
            X509TrustManager trustManager = findFirstX509TrustManager(tms);
            if (trustManager == null) {
                thrownew KeyManagementException(
                        "No X509TrustManager in among default TrustManagers: "
                                  Arrays.toString(tms));
            }
            return trustManager;
        } catch (NoSuchAlgorithmException e) {
            thrownew KeyManagementException(e);
        } catch (KeyStoreException e) {
            thrownew KeyManagementException(e);
        }
    }

БудетcreateDefaultX509TrustManager() Скопируйте код в наше приложение, как показано ниже:

private X509TrustManager systemDefaultTrustManager() {
            try {
                TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(
                        TrustManagerFactory.getDefaultAlgorithm());
                trustManagerFactory.init((KeyStore) null);
                TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
                if (trustManagers.length != 1 || !(trustManagers[0] instanceof X509TrustManager)) {
                    thrownew IllegalStateException("Unexpected default trust managers:"
                              Arrays.toString(trustManagers));
                }
                return (X509TrustManager) trustManagers[0];
            } catch (GeneralSecurityException e) {
                thrownew AssertionError(); 
            }
        }

Прервите точку во время выполнения приложения и подтвердите системное значение по умолчанию с помощью Android StudioX509TrustManager Что это такое, подтвердить несложно, этоandroid.security.net.config.RootTrustManager。android.security.net.config.

Список всех установленных сертификатов на android oh! android

# ls -al /etc/security/cacerts/ff783690.0 ls -al /etc/security/cacerts/ff783690.0 -rw-r--r-- root root 5106 2021-12-13 23:49 ff783690.0 # cat /etc/security/cacerts/ff783690.0 cat /etc/security/cacerts/ff783690.0 -----BEGIN CERTIFICATE----- MIIEdDCCA1ygAwIBAgIQRL4Mi1AAJLQR0zYq/mUK/TANBgkqhkiG9w0BAQUFADCB lzELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2Ug Q2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExho dHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xHzAdBgNVBAMTFlVUTi1VU0VSRmlyc3Qt SGFyZHdhcmUwHhcNOTkwNzA5MTgxMDQyWhcNMTkwNzA5MTgxOTIyWjCBlzELMAkG A1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2UgQ2l0eTEe MBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExhodHRwOi8v d3d3LnVzZXJ0cnVzdC5jb20xHzAdBgNVBAMTFlVUTi1VU0VSRmlyc3QtSGFyZHdh cmUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCx98M4P7Sof885glFn 0G2f0v9Y8 efK wNiVSZuTiZFvfgIXlIwrthdBKWHTxqctU8EGc6Oe0rE81m65UJ M6Rsl7HoxuzBdXmcRl6Nq9Bq/bkqVRcQVLMZ8Jr28bFdtqdt  BxF2uiiPsA3/4a MXcMmgF6sTLjKwEHOG7DpV4jvEWbe1DByTCP2 UretNb zNAHqDVmBe8i4fDidNd oI6yqqr2jmmIBsX6iSHzCJ1pLgkzmykNRg MzEk0sGlRvfkGzWitZky8PqxhvQqI DsjfPe58BEydCl5rkdbux 0ojatNh4lz0G6k0B4WixThdkQDf2Os5M1JnMWS9Ksy oUhbAgMBAAGjgbkwgbYwCwYDVR0PBAQDAgHGMA8GA1UdEwEB/wQFMAMBAf8wHQYD VR0OBBYEFKFyXyYbKJhDlV0HN9WFlp1L0sNFMEQGA1UdHwQ9MDswOaA3oDWGM2h0 dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VVE4tVVNFUkZpcnN0LUhhcmR3YXJlLmNy bDAxBgNVHSUEKjAoBggrBgEFBQcDAQYIKwYBBQUHAwUGCCsGAQUFBwMGBggrBgEF BQcDBzANBgkqhkiG9w0BAQUFAAOCAQEARxkP3nTGmZev/K0oXnWO6y1n7k57K9cM //bey1WiCuFMVGWTYGufEpytXoMs61quwOQt9ABjHbjAbPLPSbtNk28Gpgoiskli CE7/yMgUsogWXecB5BKV5UU0s4tpvc 0hY91UZ59Ojg6FEgSxvunOxqNDYJAB gE CJChicsZUN/KHAG8HQQZexB2lzvukJDKxA4fFm517zP4029bHpbj4HR3dHuKom4t 3XbWOTCC8KucUvIqx69JXn7HaOWCgchqJ/kniCrVWFCVH/A7HFe7fRQ5YiuayZSS KqMiDP JJn1fIytH1xUdqWqeUQ0qUZ6B dQ7XnASfxAynB67nfhmqA== -----END CERTIFICATE----- Certificate: Data: Version: 3 (0x2) Serial Number: 44:be:0c:8b:50:00:24:b4:11:d3:36:2a:fe:65:0a:fd Signature Algorithm: sha1WithRSAEncryption Issuer: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Hardware Validity Not Before: Jul 9 18:10:42 1999 GMT Not After : Jul 9 18:19:22 2021 GMT Subject: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Hardware Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (2048 bit) Modulus (2048 bit): 00:b1:f7:c3:38:3f:b4:a8:7f:cf:39:82:51:67:d0: 6d:9f:d2:ff:58:f3:e7:9f:2b:ec:0d:89:54:99:b9: 38:99:16:f7:e0:21:79:48:c2:bb:61:74:12:96:1d: 3c:6a:72:d5:3c:10:67:3a:39:ed:2b:13:cd:66:eb: 95:09:33:a4:6c:97:b1:e8:c6:ec:c1:75:79:9c:46: 5e:8d:ab:d0:6a:fd:b9:2a:55:17:10:54:b3:19:f0: 9a:f6:f1:b1:5d:b6:a7:6d:fb:e0:71:17:6b:a2:88: fb:00:df:fe:1a:31:77:0c:9a:01:7a:b1:32:e3:2b: 01:07:38:6e:c3:a5:5e:23:bc:45:9b:7b:50:c1:c9: 30:8f:db:e5:2b:7a:d3:5b:fb:33:40:1e:a0:d5:98: 17:bc:8b:87:c3:89:d3:5d:a0:8e:b2:aa:aa:f6:8e: 69:88:06:c5:fa:89:21:f3:08:9d:69:2e:09:33:9b: 29:0d:46:0f:8c:cc:49:34:b0:69:51:bd:f9:06:cd: 68:ad:66:4c:bc:3e:ac:61:bd:0a:88:0e:c8:df:3d: ee:7c:04:4c:9d:0a:5e:6b:91:d6:ee:c7:ed:28:8d: ab:4d:87:89:73:d0:6e:a4:d0:1e:16:8b:14:e1:76: 44:03:7f:63:ac:e4:cd:49:9c:c5:92:f4:ab:32:a1: 48:5b Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Key Usage: Digital Signature, Non Repudiation, Certificate Sign, CRL Sign X509v3 Basic Constraints: critical CA:TRUE X509v3 Subject Key Identifier: A1:72:5F:26:1B:28:98:43:95:5D:07:37:D5:85:96:9D:4B:D2:C3:45 X509v3 CRL Distribution Points: URI:http://crl.usertrust.com/UTN-USERFirst-Hardware.crl X509v3 Extended Key Usage: TLS Web Server Authentication, IPSec End System, IPSec Tunnel, I PSec User Signature Algorithm: sha1WithRSAEncryption 47:19:0f:de:74:c6:99:97:af:fc:ad:28:5e:75:8e:eb:2d:67: ee:4e:7b:2b:d7:0c:ff:f6:de:cb:55:a2:0a:e1:4c:54:65:93: 60:6b:9f:12:9c:ad:5e:83:2c:eb:5a:ae:c0:e4:2d:f4:00:63: 1d:b8:c0:6c:f2:cf:49:bb:4d:93:6f:06:a6:0a:22:b2:49:62: 08:4e:ff:c8:c8:14:b2:88:16:5d:e7:01:e4:12:95:e5:45:34: b3:8b:69:bd:cf:b4:85:8f:75:51:9e:7d:3a:38:3a:14:48:12: c6:fb:a7:3b:1a:8d:0d:82:40:07:e8:04:08:90:a1:89:cb:19: 50:df:ca:1c:01:bc:1d:04:19:7b:10:76:97:3b:ee:90:90:ca: c4:0e:1f:16:6e:75:ef:33:f8:d3:6f:5b:1e:96:e3:e0:74:77: 74:7b:8a:a2:6e:2d:dd:76:d6:39:30:82:f0:ab:9c:52:f2:2a: c7:af:49:5e:7e:c7:68:e5:82:81:c8:6a:27:f9:27:88:2a:d5: 58:50:95:1f:f0:3b:1c:57:bb:7d:14:39:62:2b:9a:c9:94:92: 2a:a3:22:0c:ff:89:26:7d:5f:23:2b:47:d7:15:1d:a9:6a:9e: 51:0d:2a:51:9e:81:f9:d4:3b:5e:70:12:7f:10:32:9c:1e:bb: 9d:f8:66:a8 SHA1 Fingerprint=04:83:ED:33:99:AC:36:08:05:87:22:ED:BC:5E:46:00:E3:BE:F9:D7а# ls -al /etc/security/cacerts/ff783690.0 ls -al /etc/security/cacerts/ff783690.0 -rw-r--r-- root root 5106 2021-12-13 23:49 ff783690.0 # cat /etc/security/cacerts/ff783690.0 cat /etc/security/cacerts/ff783690.0 -----BEGIN CERTIFICATE----- MIIEdDCCA1ygAwIBAgIQRL4Mi1AAJLQR0zYq/mUK/TANBgkqhkiG9w0BAQUFADCB lzELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2Ug Q2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExho dHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xHzAdBgNVBAMTFlVUTi1VU0VSRmlyc3Qt SGFyZHdhcmUwHhcNOTkwNzA5MTgxMDQyWhcNMTkwNzA5MTgxOTIyWjCBlzELMAkG A1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2UgQ2l0eTEe MBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExhodHRwOi8v d3d3LnVzZXJ0cnVzdC5jb20xHzAdBgNVBAMTFlVUTi1VU0VSRmlyc3QtSGFyZHdh cmUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCx98M4P7Sof885glFn 0G2f0v9Y8 efK wNiVSZuTiZFvfgIXlIwrthdBKWHTxqctU8EGc6Oe0rE81m65UJ M6Rsl7HoxuzBdXmcRl6Nq9Bq/bkqVRcQVLMZ8Jr28bFdtqdt  BxF2uiiPsA3/4a MXcMmgF6sTLjKwEHOG7DpV4jvEWbe1DByTCP2 UretNb zNAHqDVmBe8i4fDidNd oI6yqqr2jmmIBsX6iSHzCJ1pLgkzmykNRg MzEk0sGlRvfkGzWitZky8PqxhvQqI DsjfPe58BEydCl5rkdbux 0ojatNh4lz0G6k0B4WixThdkQDf2Os5M1JnMWS9Ksy oUhbAgMBAAGjgbkwgbYwCwYDVR0PBAQDAgHGMA8GA1UdEwEB/wQFMAMBAf8wHQYD VR0OBBYEFKFyXyYbKJhDlV0HN9WFlp1L0sNFMEQGA1UdHwQ9MDswOaA3oDWGM2h0 dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VVE4tVVNFUkZpcnN0LUhhcmR3YXJlLmNy bDAxBgNVHSUEKjAoBggrBgEFBQcDAQYIKwYBBQUHAwUGCCsGAQUFBwMGBggrBgEF BQcDBzANBgkqhkiG9w0BAQUFAAOCAQEARxkP3nTGmZev/K0oXnWO6y1n7k57K9cM //bey1WiCuFMVGWTYGufEpytXoMs61quwOQt9ABjHbjAbPLPSbtNk28Gpgoiskli CE7/yMgUsogWXecB5BKV5UU0s4tpvc 0hY91UZ59Ojg6FEgSxvunOxqNDYJAB gE CJChicsZUN/KHAG8HQQZexB2lzvukJDKxA4fFm517zP4029bHpbj4HR3dHuKom4t 3XbWOTCC8KucUvIqx69JXn7HaOWCgchqJ/kniCrVWFCVH/A7HFe7fRQ5YiuayZSS KqMiDP JJn1fIytH1xUdqWqeUQ0qUZ6B dQ7XnASfxAynB67nfhmqA== -----END CERTIFICATE----- Certificate: Data: Version: 3 (0x2) Serial Number: 44:be:0c:8b:50:00:24:b4:11:d3:36:2a:fe:65:0a:fd Signature Algorithm: sha1WithRSAEncryption Issuer: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Hardware Validity Not Before: Jul 9 18:10:42 1999 GMT Not After : Jul 9 18:19:22 2021 GMT Subject: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Hardware Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (2048 bit) Modulus (2048 bit): 00:b1:f7:c3:38:3f:b4:a8:7f:cf:39:82:51:67:d0: 6d:9f:d2:ff:58:f3:e7:9f:2b:ec:0d:89:54:99:b9: 38:99:16:f7:e0:21:79:48:c2:bb:61:74:12:96:1d: 3c:6a:72:d5:3c:10:67:3a:39:ed:2b:13:cd:66:eb: 95:09:33:a4:6c:97:b1:e8:c6:ec:c1:75:79:9c:46: 5e:8d:ab:d0:6a:fd:b9:2a:55:17:10:54:b3:19:f0: 9a:f6:f1:b1:5d:b6:a7:6d:fb:e0:71:17:6b:a2:88: fb:00:df:fe:1a:31:77:0c:9a:01:7a:b1:32:e3:2b: 01:07:38:6e:c3:a5:5e:23:bc:45:9b:7b:50:c1:c9: 30:8f:db:e5:2b:7a:d3:5b:fb:33:40:1e:a0:d5:98: 17:bc:8b:87:c3:89:d3:5d:a0:8e:b2:aa:aa:f6:8e: 69:88:06:c5:fa:89:21:f3:08:9d:69:2e:09:33:9b: 29:0d:46:0f:8c:cc:49:34:b0:69:51:bd:f9:06:cd: 68:ad:66:4c:bc:3e:ac:61:bd:0a:88:0e:c8:df:3d: ee:7c:04:4c:9d:0a:5e:6b:91:d6:ee:c7:ed:28:8d: ab:4d:87:89:73:d0:6e:a4:d0:1e:16:8b:14:e1:76: 44:03:7f:63:ac:e4:cd:49:9c:c5:92:f4:ab:32:a1: 48:5b Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Key Usage: Digital Signature, Non Repudiation, Certificate Sign, CRL Sign X509v3 Basic Constraints: critical CA:TRUE X509v3 Subject Key Identifier: A1:72:5F:26:1B:28:98:43:95:5D:07:37:D5:85:96:9D:4B:D2:C3:45 X509v3 CRL Distribution Points: URI:http://crl.usertrust.com/UTN-USERFirst-Hardware.crl X509v3 Extended Key Usage: TLS Web Server Authentication, IPSec End System, IPSec Tunnel, I PSec User Signature Algorithm: sha1WithRSAEncryption 47:19:0f:de:74:c6:99:97:af:fc:ad:28:5e:75:8e:eb:2d:67: ee:4e:7b:2b:d7:0c:ff:f6:de:cb:55:a2:0a:e1:4c:54:65:93: 60:6b:9f:12:9c:ad:5e:83:2c:eb:5a:ae:c0:e4:2d:f4:00:63: 1d:b8:c0:6c:f2:cf:49:bb:4d:93:6f:06:a6:0a:22:b2:49:62: 08:4e:ff:c8:c8:14:b2:88:16:5d:e7:01:e4:12:95:e5:45:34: b3:8b:69:bd:cf:b4:85:8f:75:51:9e:7d:3a:38:3a:14:48:12: c6:fb:a7:3b:1a:8d:0d:82:40:07:e8:04:08:90:a1:89:cb:19: 50:df:ca:1c:01:bc:1d:04:19:7b:10:76:97:3b:ee:90:90:ca: c4:0e:1f:16:6e:75:ef:33:f8:d3:6f:5b:1e:96:e3:e0:74:77: 74:7b:8a:a2:6e:2d:dd:76:d6:39:30:82:f0:ab:9c:52:f2:2a: c7:af:49:5e:7e:c7:68:e5:82:81:c8:6a:27:f9:27:88:2a:d5: 58:50:95:1f:f0:3b:1c:57:bb:7d:14:39:62:2b:9a:c9:94:92: 2a:a3:22:0c:ff:89:26:7d:5f:23:2b:47:d7:15:1d:a9:6a:9e: 51:0d:2a:51:9e:81:f9:d4:3b:5e:70:12:7f:10:32:9c:1e:bb: 9d:f8:66:a8 SHA1 Fingerprint=04:83:ED:33:99:AC:36:08:05:87:22:ED:BC:5E:46:00:E3:BE:F9:D7,# ls -al /etc/security/cacerts/ff783690.0 ls -al /etc/security/cacerts/ff783690.0 -rw-r--r-- root root 5106 2021-12-13 23:49 ff783690.0 # cat /etc/security/cacerts/ff783690.0 cat /etc/security/cacerts/ff783690.0 -----BEGIN CERTIFICATE----- MIIEdDCCA1ygAwIBAgIQRL4Mi1AAJLQR0zYq/mUK/TANBgkqhkiG9w0BAQUFADCB lzELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2Ug Q2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExho dHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xHzAdBgNVBAMTFlVUTi1VU0VSRmlyc3Qt SGFyZHdhcmUwHhcNOTkwNzA5MTgxMDQyWhcNMTkwNzA5MTgxOTIyWjCBlzELMAkG A1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2UgQ2l0eTEe MBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExhodHRwOi8v d3d3LnVzZXJ0cnVzdC5jb20xHzAdBgNVBAMTFlVUTi1VU0VSRmlyc3QtSGFyZHdh cmUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCx98M4P7Sof885glFn 0G2f0v9Y8 efK wNiVSZuTiZFvfgIXlIwrthdBKWHTxqctU8EGc6Oe0rE81m65UJ M6Rsl7HoxuzBdXmcRl6Nq9Bq/bkqVRcQVLMZ8Jr28bFdtqdt  BxF2uiiPsA3/4a MXcMmgF6sTLjKwEHOG7DpV4jvEWbe1DByTCP2 UretNb zNAHqDVmBe8i4fDidNd oI6yqqr2jmmIBsX6iSHzCJ1pLgkzmykNRg MzEk0sGlRvfkGzWitZky8PqxhvQqI DsjfPe58BEydCl5rkdbux 0ojatNh4lz0G6k0B4WixThdkQDf2Os5M1JnMWS9Ksy oUhbAgMBAAGjgbkwgbYwCwYDVR0PBAQDAgHGMA8GA1UdEwEB/wQFMAMBAf8wHQYD VR0OBBYEFKFyXyYbKJhDlV0HN9WFlp1L0sNFMEQGA1UdHwQ9MDswOaA3oDWGM2h0 dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VVE4tVVNFUkZpcnN0LUhhcmR3YXJlLmNy bDAxBgNVHSUEKjAoBggrBgEFBQcDAQYIKwYBBQUHAwUGCCsGAQUFBwMGBggrBgEF BQcDBzANBgkqhkiG9w0BAQUFAAOCAQEARxkP3nTGmZev/K0oXnWO6y1n7k57K9cM //bey1WiCuFMVGWTYGufEpytXoMs61quwOQt9ABjHbjAbPLPSbtNk28Gpgoiskli CE7/yMgUsogWXecB5BKV5UU0s4tpvc 0hY91UZ59Ojg6FEgSxvunOxqNDYJAB gE CJChicsZUN/KHAG8HQQZexB2lzvukJDKxA4fFm517zP4029bHpbj4HR3dHuKom4t 3XbWOTCC8KucUvIqx69JXn7HaOWCgchqJ/kniCrVWFCVH/A7HFe7fRQ5YiuayZSS KqMiDP JJn1fIytH1xUdqWqeUQ0qUZ6B dQ7XnASfxAynB67nfhmqA== -----END CERTIFICATE----- Certificate: Data: Version: 3 (0x2) Serial Number: 44:be:0c:8b:50:00:24:b4:11:d3:36:2a:fe:65:0a:fd Signature Algorithm: sha1WithRSAEncryption Issuer: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Hardware Validity Not Before: Jul 9 18:10:42 1999 GMT Not After : Jul 9 18:19:22 2021 GMT Subject: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Hardware Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (2048 bit) Modulus (2048 bit): 00:b1:f7:c3:38:3f:b4:a8:7f:cf:39:82:51:67:d0: 6d:9f:d2:ff:58:f3:e7:9f:2b:ec:0d:89:54:99:b9: 38:99:16:f7:e0:21:79:48:c2:bb:61:74:12:96:1d: 3c:6a:72:d5:3c:10:67:3a:39:ed:2b:13:cd:66:eb: 95:09:33:a4:6c:97:b1:e8:c6:ec:c1:75:79:9c:46: 5e:8d:ab:d0:6a:fd:b9:2a:55:17:10:54:b3:19:f0: 9a:f6:f1:b1:5d:b6:a7:6d:fb:e0:71:17:6b:a2:88: fb:00:df:fe:1a:31:77:0c:9a:01:7a:b1:32:e3:2b: 01:07:38:6e:c3:a5:5e:23:bc:45:9b:7b:50:c1:c9: 30:8f:db:e5:2b:7a:d3:5b:fb:33:40:1e:a0:d5:98: 17:bc:8b:87:c3:89:d3:5d:a0:8e:b2:aa:aa:f6:8e: 69:88:06:c5:fa:89:21:f3:08:9d:69:2e:09:33:9b: 29:0d:46:0f:8c:cc:49:34:b0:69:51:bd:f9:06:cd: 68:ad:66:4c:bc:3e:ac:61:bd:0a:88:0e:c8:df:3d: ee:7c:04:4c:9d:0a:5e:6b:91:d6:ee:c7:ed:28:8d: ab:4d:87:89:73:d0:6e:a4:d0:1e:16:8b:14:e1:76: 44:03:7f:63:ac:e4:cd:49:9c:c5:92:f4:ab:32:a1: 48:5b Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Key Usage: Digital Signature, Non Repudiation, Certificate Sign, CRL Sign X509v3 Basic Constraints: critical CA:TRUE X509v3 Subject Key Identifier: A1:72:5F:26:1B:28:98:43:95:5D:07:37:D5:85:96:9D:4B:D2:C3:45 X509v3 CRL Distribution Points: URI:http://crl.usertrust.com/UTN-USERFirst-Hardware.crl X509v3 Extended Key Usage: TLS Web Server Authentication, IPSec End System, IPSec Tunnel, I PSec User Signature Algorithm: sha1WithRSAEncryption 47:19:0f:de:74:c6:99:97:af:fc:ad:28:5e:75:8e:eb:2d:67: ee:4e:7b:2b:d7:0c:ff:f6:de:cb:55:a2:0a:e1:4c:54:65:93: 60:6b:9f:12:9c:ad:5e:83:2c:eb:5a:ae:c0:e4:2d:f4:00:63: 1d:b8:c0:6c:f2:cf:49:bb:4d:93:6f:06:a6:0a:22:b2:49:62: 08:4e:ff:c8:c8:14:b2:88:16:5d:e7:01:e4:12:95:e5:45:34: b3:8b:69:bd:cf:b4:85:8f:75:51:9e:7d:3a:38:3a:14:48:12: c6:fb:a7:3b:1a:8d:0d:82:40:07:e8:04:08:90:a1:89:cb:19: 50:df:ca:1c:01:bc:1d:04:19:7b:10:76:97:3b:ee:90:90:ca: c4:0e:1f:16:6e:75:ef:33:f8:d3:6f:5b:1e:96:e3:e0:74:77: 74:7b:8a:a2:6e:2d:dd:76:d6:39:30:82:f0:ab:9c:52:f2:2a: c7:af:49:5e:7e:c7:68:e5:82:81:c8:6a:27:f9:27:88:2a:d5: 58:50:95:1f:f0:3b:1c:57:bb:7d:14:39:62:2b:9a:c9:94:92: 2a:a3:22:0c:ff:89:26:7d:5f:23:2b:47:d7:15:1d:a9:6a:9e: 51:0d:2a:51:9e:81:f9:d4:3b:5e:70:12:7f:10:32:9c:1e:bb: 9d:f8:66:a8 SHA1 Fingerprint=04:83:ED:33:99:AC:36:08:05:87:22:ED:BC:5E:46:00:E3:BE:F9:D7