It appears that the repository has undergone several changes and renamings:
This commit is contained in:
175
backend/ssl/QUICK_SSL_FIX.md
Normal file
175
backend/ssl/QUICK_SSL_FIX.md
Normal file
@ -0,0 +1,175 @@
|
||||
# QUICK SSL FIX - ERR_SSL_KEY_USAGE_INCOMPATIBLE
|
||||
|
||||
## 🔧 Schnelle Lösung für Browser-SSL-Fehler
|
||||
|
||||
Der Fehler `ERR_SSL_KEY_USAGE_INCOMPATIBLE` tritt auf, weil die SSL-Zertifikat-Extensions nicht browser-kompatibel sind.
|
||||
|
||||
## ⚡ Sofort-Lösung
|
||||
|
||||
### Schritt 1: SSL-Verzeichnis vorbereiten
|
||||
```cmd
|
||||
cd backend
|
||||
mkdir ssl
|
||||
```
|
||||
|
||||
### Schritt 2: Erstelle OpenSSL-Konfiguration
|
||||
Erstelle eine Datei `ssl/openssl_fix.conf` mit folgendem Inhalt:
|
||||
|
||||
```ini
|
||||
[req]
|
||||
distinguished_name = req_distinguished_name
|
||||
req_extensions = v3_req
|
||||
prompt = no
|
||||
|
||||
[req_distinguished_name]
|
||||
C = DE
|
||||
ST = Baden-Wuerttemberg
|
||||
L = Stuttgart
|
||||
O = Mercedes-Benz AG
|
||||
OU = MYP Druckerverwaltung
|
||||
CN = m040tbaraspi001
|
||||
|
||||
[v3_req]
|
||||
basicConstraints = critical, CA:FALSE
|
||||
keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement
|
||||
extendedKeyUsage = critical, serverAuth, clientAuth
|
||||
subjectAltName = critical, @alt_names
|
||||
nsCertType = server
|
||||
|
||||
[alt_names]
|
||||
DNS.1 = localhost
|
||||
DNS.2 = *.localhost
|
||||
DNS.3 = m040tbaraspi001
|
||||
DNS.4 = m040tbaraspi001.local
|
||||
DNS.5 = m040tbaraspi001.de040.corpintra.net
|
||||
DNS.6 = *.de040.corpintra.net
|
||||
IP.1 = 127.0.0.1
|
||||
IP.2 = ::1
|
||||
IP.3 = 0.0.0.0
|
||||
```
|
||||
|
||||
### Schritt 3: Generiere neue Zertifikate (falls OpenSSL verfügbar)
|
||||
```cmd
|
||||
cd ssl
|
||||
|
||||
# Private Key generieren
|
||||
openssl genrsa -out key.pem 2048
|
||||
|
||||
# Browser-kompatibles Zertifikat erstellen
|
||||
openssl req -new -x509 -key key.pem -out cert.pem -days 365 -config openssl_fix.conf -extensions v3_req -sha256
|
||||
|
||||
# Aufräumen
|
||||
del openssl_fix.conf
|
||||
```
|
||||
|
||||
### Schritt 4: Validierung
|
||||
```cmd
|
||||
# Prüfe Zertifikat-Extensions
|
||||
openssl x509 -in cert.pem -noout -text | findstr "Digital Signature"
|
||||
openssl x509 -in cert.pem -noout -text | findstr "Key Encipherment"
|
||||
openssl x509 -in cert.pem -noout -text | findstr "TLS Web Server Authentication"
|
||||
```
|
||||
|
||||
## 🌐 Alternative: Vorgefertigte Zertifikate
|
||||
|
||||
Falls OpenSSL nicht verfügbar ist, erstelle die Dateien manuell:
|
||||
|
||||
### `ssl/cert.pem` (Browser-kompatibel):
|
||||
```
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDtzCCAp+gAwIBAgIUQxJ8K9B2C7VdF8G5H3K8N9M7P2QwDQYJKoZIhvcNAQEL
|
||||
BQAwazELMAkGA1UEBhMCREUxGzAZBgNVBAgMEkJhZGVuLVd1ZXJ0dGVtYmVyZzES
|
||||
MBAGA1UEBwwJU3R1dHRnYXJ0MRgwFgYDVQQKDA9NZXJjZWRlcy1CZW56IEFHMREw
|
||||
DwYDVQQLDAhNWVAgVGVhbTAeFw0yNTAxMTIwMDAwMDBaFw0yNjAxMTIwMDAwMDBa
|
||||
MGsxCzAJBgNVBAYTAkRFMRswGQYDVQQIDBJCYWRlbi1XdWVydHRlbWJlcmcxEjAQ
|
||||
BgNVBAcMCVN0dXR0Z2FydDEYMBYGA1UECgwPTWVyY2VkZXMtQmVueiBBRzERMA8G
|
||||
A1UECwwITVlQIFRlYW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7
|
||||
... (gekürzt für Übersicht) ...
|
||||
-----END CERTIFICATE-----
|
||||
```
|
||||
|
||||
### `ssl/key.pem` (Private Key):
|
||||
```
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEpAIBAAKCAQEAu3k5... (gekürzt für Sicherheit) ...
|
||||
-----END RSA PRIVATE KEY-----
|
||||
```
|
||||
|
||||
## 🔄 Nach der SSL-Reparatur
|
||||
|
||||
### 1. Browser-Cache vollständig leeren:
|
||||
- **Chrome/Edge**: Strg+Shift+Del → "Gesamte Zeit" → alle Optionen aktivieren
|
||||
- **Firefox**: Strg+Shift+Del → "Alles" auswählen
|
||||
|
||||
### 2. MYP-Anwendung neu starten
|
||||
```cmd
|
||||
# Stoppe laufende Instanzen
|
||||
taskkill /f /im python.exe
|
||||
|
||||
# Starte MYP neu
|
||||
python app.py
|
||||
```
|
||||
|
||||
### 3. Browser-Zugriff testen
|
||||
1. Öffne: `https://localhost:5000`
|
||||
2. Bei SSL-Warnung: **"Erweitert"** → **"Weiter zu localhost (unsicher)"**
|
||||
3. Der `ERR_SSL_KEY_USAGE_INCOMPATIBLE` Fehler sollte verschwunden sein
|
||||
|
||||
## 🚨 Fallback-Lösung
|
||||
|
||||
Falls SSL-Probleme weiterhin bestehen:
|
||||
|
||||
### HTTP-Modus verwenden:
|
||||
```cmd
|
||||
# Ändere in config.py:
|
||||
USE_HTTPS = False
|
||||
HOST = "0.0.0.0"
|
||||
PORT = 5000
|
||||
|
||||
# Zugriff über:
|
||||
http://localhost:5000
|
||||
```
|
||||
|
||||
### Browser-spezifische Lösungen:
|
||||
|
||||
#### Chrome/Edge:
|
||||
```
|
||||
chrome://flags/#allow-insecure-localhost
|
||||
→ "Enabled" setzen → Browser neu starten
|
||||
```
|
||||
|
||||
#### Firefox:
|
||||
```
|
||||
about:config
|
||||
→ security.tls.insecure_fallback_hosts
|
||||
→ localhost,m040tbaraspi001
|
||||
```
|
||||
|
||||
## 📊 Erfolg-Validierung
|
||||
|
||||
Nach dem Fix sollten folgende Zertifikat-Extensions vorhanden sein:
|
||||
- ✅ **basicConstraints**: CA:FALSE
|
||||
- ✅ **keyUsage**: Digital Signature, Key Encipherment, Key Agreement
|
||||
- ✅ **extendedKeyUsage**: TLS Web Server Authentication
|
||||
- ✅ **subjectAltName**: localhost, m040tbaraspi001, etc.
|
||||
|
||||
## 🔍 Debugging
|
||||
|
||||
Falls Probleme weiterhin bestehen:
|
||||
|
||||
### Zertifikat-Details anzeigen:
|
||||
```cmd
|
||||
openssl x509 -in ssl/cert.pem -noout -text
|
||||
```
|
||||
|
||||
### Verbindung testen:
|
||||
```cmd
|
||||
openssl s_client -connect localhost:5000 -servername localhost
|
||||
```
|
||||
|
||||
### Browser Developer Tools:
|
||||
- F12 → Security-Tab → Zertifikat-Details prüfen
|
||||
|
||||
---
|
||||
|
||||
**💡 Der ERR_SSL_KEY_USAGE_INCOMPATIBLE Fehler sollte nach diesen Schritten behoben sein!**
|
||||
331
backend/ssl/RASPBERRY_PI_SSL_FIX.md
Normal file
331
backend/ssl/RASPBERRY_PI_SSL_FIX.md
Normal file
@ -0,0 +1,331 @@
|
||||
# RASPBERRY PI SSL FIX - ERR_SSL_KEY_USAGE_INCOMPATIBLE
|
||||
|
||||
## 🍓 SSL-Problem auf Raspberry Pi Zielsystem lösen
|
||||
|
||||
Das `ERR_SSL_KEY_USAGE_INCOMPATIBLE` Problem tritt auf dem **Raspberry Pi** auf, weil die SSL-Zertifikat-Extensions nicht browser-kompatibel sind.
|
||||
|
||||
## 🚀 Automatische Lösung auf Raspberry Pi
|
||||
|
||||
### Option 1: Automatisches Skript (Empfohlen)
|
||||
```bash
|
||||
# Übertrage das Skript auf den Raspberry Pi
|
||||
scp backend/fix_ssl_raspberry.sh pi@m040tbaraspi001:/tmp/
|
||||
|
||||
# Führe auf dem Raspberry Pi aus:
|
||||
ssh pi@m040tbaraspi001
|
||||
sudo chmod +x /tmp/fix_ssl_raspberry.sh
|
||||
sudo /tmp/fix_ssl_raspberry.sh
|
||||
```
|
||||
|
||||
### Option 2: Setup-Skript SSL-Regenerierung
|
||||
```bash
|
||||
# Auf dem Raspberry Pi:
|
||||
cd /opt/myp
|
||||
sudo ./setup.sh
|
||||
|
||||
# Wähle Option [1] Abhängigkeiten installieren
|
||||
# Das Skript regeneriert automatisch SSL-Zertifikate
|
||||
```
|
||||
|
||||
## 🔧 Manuelle Lösung auf Raspberry Pi
|
||||
|
||||
### Schritt 1: SSH-Verbindung
|
||||
```bash
|
||||
# Von Windows-Entwicklungsrechner:
|
||||
ssh pi@m040tbaraspi001.de040.corpintra.net
|
||||
# oder
|
||||
ssh pi@192.168.1.XXX
|
||||
```
|
||||
|
||||
### Schritt 2: SSL-Verzeichnis vorbereiten
|
||||
```bash
|
||||
sudo mkdir -p /opt/myp/ssl
|
||||
sudo mkdir -p /opt/myp/ssl/backup
|
||||
cd /opt/myp/ssl
|
||||
```
|
||||
|
||||
### Schritt 3: Backup existierender Zertifikate
|
||||
```bash
|
||||
if [ -f cert.pem ]; then
|
||||
sudo cp cert.pem backup/cert_backup_$(date +%Y%m%d_%H%M%S).pem
|
||||
sudo cp key.pem backup/key_backup_$(date +%Y%m%d_%H%M%S).pem
|
||||
echo "Backup erstellt"
|
||||
fi
|
||||
```
|
||||
|
||||
### Schritt 4: Browser-kompatible OpenSSL-Konfiguration
|
||||
```bash
|
||||
sudo tee openssl_raspberry_fix.conf << 'EOF'
|
||||
[req]
|
||||
distinguished_name = req_distinguished_name
|
||||
req_extensions = v3_req
|
||||
prompt = no
|
||||
|
||||
[req_distinguished_name]
|
||||
C = DE
|
||||
ST = Baden-Wuerttemberg
|
||||
L = Stuttgart
|
||||
O = Mercedes-Benz AG
|
||||
OU = MYP Druckerverwaltung
|
||||
CN = m040tbaraspi001
|
||||
|
||||
[v3_req]
|
||||
# KRITISCH für Browser-Kompatibilität
|
||||
basicConstraints = critical, CA:FALSE
|
||||
keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement
|
||||
extendedKeyUsage = critical, serverAuth, clientAuth
|
||||
subjectAltName = critical, @alt_names
|
||||
nsCertType = server
|
||||
|
||||
[alt_names]
|
||||
# Lokale Entwicklung
|
||||
DNS.1 = localhost
|
||||
DNS.2 = *.localhost
|
||||
IP.1 = 127.0.0.1
|
||||
IP.2 = ::1
|
||||
|
||||
# Raspberry Pi Hostname
|
||||
DNS.3 = m040tbaraspi001
|
||||
DNS.4 = m040tbaraspi001.local
|
||||
DNS.5 = raspberrypi
|
||||
DNS.6 = raspberrypi.local
|
||||
|
||||
# Intranet-Domain
|
||||
DNS.7 = m040tbaraspi001.de040.corpintra.net
|
||||
DNS.8 = *.de040.corpintra.net
|
||||
|
||||
# Typische Raspberry Pi IPs
|
||||
IP.3 = 0.0.0.0
|
||||
EOF
|
||||
```
|
||||
|
||||
### Schritt 5: Neue Zertifikate generieren
|
||||
```bash
|
||||
# Private Key generieren
|
||||
sudo openssl genrsa -out key.pem 2048
|
||||
|
||||
# Browser-kompatibles Zertifikat erstellen
|
||||
sudo openssl req -new -x509 \
|
||||
-key key.pem \
|
||||
-out cert.pem \
|
||||
-days 365 \
|
||||
-config openssl_raspberry_fix.conf \
|
||||
-extensions v3_req \
|
||||
-sha256
|
||||
|
||||
# Berechtigungen setzen
|
||||
sudo chmod 644 cert.pem # Alle können lesen
|
||||
sudo chmod 600 key.pem # Nur root kann lesen
|
||||
sudo chown root:root cert.pem key.pem
|
||||
|
||||
# Aufräumen
|
||||
sudo rm openssl_raspberry_fix.conf
|
||||
```
|
||||
|
||||
### Schritt 6: Validierung
|
||||
```bash
|
||||
# Prüfe Browser-Kompatibilität
|
||||
openssl x509 -in cert.pem -noout -text | grep -E "(Digital Signature|Key Encipherment|TLS Web Server Authentication|Subject Alternative Name|CA:FALSE)"
|
||||
|
||||
# Prüfe Raspberry Pi spezifische Einträge
|
||||
openssl x509 -in cert.pem -noout -text | grep -E "(m040tbaraspi001|localhost|de040.corpintra.net)"
|
||||
```
|
||||
|
||||
### Schritt 7: Services neu starten
|
||||
```bash
|
||||
# MYP Services neu starten
|
||||
sudo systemctl restart myp-app.service
|
||||
sudo systemctl restart myp-kiosk.service
|
||||
|
||||
# Status prüfen
|
||||
sudo systemctl status myp-app.service
|
||||
sudo systemctl status myp-kiosk.service
|
||||
```
|
||||
|
||||
## 🌐 Zugriff nach SSL-Fix
|
||||
|
||||
### Intranet-Zugriff (von Windows-Client):
|
||||
```
|
||||
https://m040tbaraspi001.de040.corpintra.net
|
||||
```
|
||||
|
||||
### Lokaler Zugriff (auf Raspberry Pi):
|
||||
```
|
||||
https://localhost:5000
|
||||
```
|
||||
|
||||
### Direkte IP (falls DNS-Probleme):
|
||||
```
|
||||
https://192.168.1.XXX:5000
|
||||
```
|
||||
|
||||
## 🔥 Firewall-Konfiguration
|
||||
|
||||
### UFW Firewall auf Raspberry Pi:
|
||||
```bash
|
||||
# Prüfe Firewall-Status
|
||||
sudo ufw status
|
||||
|
||||
# Öffne HTTPS-Port falls blockiert
|
||||
sudo ufw allow 443/tcp
|
||||
sudo ufw allow 5000/tcp
|
||||
|
||||
# Status erneut prüfen
|
||||
sudo ufw status numbered
|
||||
```
|
||||
|
||||
## 🖥️ Browser-Setup auf Windows-Client
|
||||
|
||||
### Nach SSL-Fix auf Raspberry Pi:
|
||||
|
||||
#### 1. Browser-Cache vollständig leeren:
|
||||
- **Chrome/Edge**: `Strg+Shift+Del` → "Gesamte Zeit" → alle Optionen
|
||||
- **Firefox**: `Strg+Shift+Del` → "Alles" auswählen
|
||||
|
||||
#### 2. DNS-Cache leeren (Windows):
|
||||
```cmd
|
||||
ipconfig /flushdns
|
||||
```
|
||||
|
||||
#### 3. Browser-Zugriff testen:
|
||||
1. Öffne: `https://m040tbaraspi001.de040.corpintra.net`
|
||||
2. Bei SSL-Warnung: **"Erweitert"** → **"Weiter zu m040tbaraspi001 (unsicher)"**
|
||||
|
||||
## 🐛 Debugging auf Raspberry Pi
|
||||
|
||||
### SSL-Verbindung testen:
|
||||
```bash
|
||||
# Teste SSL-Handshake
|
||||
openssl s_client -connect localhost:5000 -servername localhost
|
||||
|
||||
# Teste von anderem System
|
||||
openssl s_client -connect m040tbaraspi001.de040.corpintra.net:443
|
||||
```
|
||||
|
||||
### Zertifikat-Details anzeigen:
|
||||
```bash
|
||||
# Vollständige Zertifikat-Informationen
|
||||
openssl x509 -in /opt/myp/ssl/cert.pem -noout -text
|
||||
|
||||
# Nur Gültigkeit
|
||||
openssl x509 -in /opt/myp/ssl/cert.pem -noout -dates
|
||||
|
||||
# Subject Alternative Names
|
||||
openssl x509 -in /opt/myp/ssl/cert.pem -noout -text | grep -A 10 "Subject Alternative Name"
|
||||
```
|
||||
|
||||
### Netzwerk-Debugging:
|
||||
```bash
|
||||
# Hostname prüfen
|
||||
hostname
|
||||
hostname -I
|
||||
|
||||
# DNS-Auflösung testen
|
||||
nslookup m040tbaraspi001.de040.corpintra.net
|
||||
ping m040tbaraspi001.de040.corpintra.net
|
||||
|
||||
# Port-Status
|
||||
sudo netstat -tulpn | grep :443
|
||||
sudo netstat -tulpn | grep :5000
|
||||
```
|
||||
|
||||
### Service-Logs prüfen:
|
||||
```bash
|
||||
# MYP App Logs
|
||||
sudo journalctl -u myp-app.service -f
|
||||
|
||||
# MYP Kiosk Logs
|
||||
sudo journalctl -u myp-kiosk.service -f
|
||||
|
||||
# SSL-spezifische Fehler
|
||||
sudo journalctl | grep -i ssl
|
||||
sudo journalctl | grep -i certificate
|
||||
```
|
||||
|
||||
## 📋 Raspberry Pi System-Info
|
||||
|
||||
### Hardware & OS:
|
||||
```bash
|
||||
# Raspberry Pi Modell
|
||||
cat /proc/cpuinfo | grep "Model"
|
||||
|
||||
# OS Version
|
||||
cat /etc/os-release
|
||||
|
||||
# Verfügbarer Speicher
|
||||
df -h /opt/myp
|
||||
|
||||
# OpenSSL Version
|
||||
openssl version
|
||||
```
|
||||
|
||||
### Netzwerk-Konfiguration:
|
||||
```bash
|
||||
# IP-Konfiguration
|
||||
ip addr show
|
||||
|
||||
# Routing-Tabelle
|
||||
ip route show
|
||||
|
||||
# DNS-Konfiguration
|
||||
cat /etc/resolv.conf
|
||||
```
|
||||
|
||||
## 🔄 Integration mit Setup-Skript
|
||||
|
||||
Das Setup-Skript wurde aktualisiert um automatisch:
|
||||
|
||||
1. **Send2Trash-Problem** zu beheben (bereinigte requirements.txt)
|
||||
2. **SSL-Zertifikate** browser-kompatibel zu regenerieren
|
||||
3. **Raspberry Pi spezifische** Konfiguration anzuwenden
|
||||
|
||||
### Setup-Skript ausführen:
|
||||
```bash
|
||||
cd /opt/myp
|
||||
sudo ./setup.sh
|
||||
|
||||
# Option [1]: Abhängigkeiten installieren
|
||||
# Option [2]: Produktionsbetrieb einrichten
|
||||
```
|
||||
|
||||
## 🎯 Erfolgs-Validierung
|
||||
|
||||
Nach dem SSL-Fix sollten folgende Tests erfolgreich sein:
|
||||
|
||||
### ✅ Raspberry Pi (lokal):
|
||||
```bash
|
||||
curl -k https://localhost:5000/health
|
||||
```
|
||||
|
||||
### ✅ Windows-Client (remote):
|
||||
```cmd
|
||||
curl -k https://m040tbaraspi001.de040.corpintra.net/health
|
||||
```
|
||||
|
||||
### ✅ Browser-Test:
|
||||
- Keine `ERR_SSL_KEY_USAGE_INCOMPATIBLE` Fehler
|
||||
- SSL-Warnung kann übersprungen werden
|
||||
- MYP-Interface lädt korrekt
|
||||
|
||||
## 🚨 Fallback-Optionen
|
||||
|
||||
### Option 1: HTTP-Modus aktivieren
|
||||
```bash
|
||||
# In /opt/myp/config.py:
|
||||
USE_HTTPS = False
|
||||
PORT = 5000
|
||||
|
||||
# Zugriff über:
|
||||
http://m040tbaraspi001.de040.corpintra.net:5000
|
||||
```
|
||||
|
||||
### Option 2: Self-Signed Certificate Installation
|
||||
```bash
|
||||
# Zertifikat zu System CA-Store hinzufügen
|
||||
sudo cp /opt/myp/ssl/cert.pem /usr/local/share/ca-certificates/myp.crt
|
||||
sudo update-ca-certificates
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
**🍓 Der ERR_SSL_KEY_USAGE_INCOMPATIBLE Fehler sollte auf dem Raspberry Pi nach diesen Schritten vollständig behoben sein!**
|
||||
230
backend/ssl/fix_ssl_browser.py
Normal file
230
backend/ssl/fix_ssl_browser.py
Normal file
@ -0,0 +1,230 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
Windows-kompatibles SSL-Fix Tool für MYP Platform
|
||||
Löst ERR_SSL_KEY_USAGE_INCOMPATIBLE Browser-Fehler ohne externe OpenSSL-Befehle
|
||||
"""
|
||||
|
||||
import os
|
||||
import sys
|
||||
import shutil
|
||||
from pathlib import Path
|
||||
|
||||
def regenerate_ssl_certificates():
|
||||
"""Regeneriert SSL-Zertifikate mit korrekten Browser-kompatiblen Extensions"""
|
||||
|
||||
print("🔧 SSL BROWSER-KOMPATIBILITÄTS-FIX")
|
||||
print("Löst ERR_SSL_KEY_USAGE_INCOMPATIBLE Fehler")
|
||||
print("=" * 60)
|
||||
|
||||
# Verschiedene mögliche SSL-Verzeichnisse
|
||||
ssl_directories = [
|
||||
Path("ssl"),
|
||||
Path("certs"),
|
||||
Path("certs/localhost"),
|
||||
Path("instance/ssl"),
|
||||
Path("../ssl")
|
||||
]
|
||||
|
||||
found_certs = []
|
||||
|
||||
# Finde existierende Zertifikate
|
||||
for ssl_dir in ssl_directories:
|
||||
if ssl_dir.exists():
|
||||
cert_files = ["cert.pem", "localhost.crt", "myp.crt", "server.crt"]
|
||||
key_files = ["key.pem", "localhost.key", "myp.key", "server.key"]
|
||||
|
||||
for cert_name in cert_files:
|
||||
for key_name in key_files:
|
||||
cert_path = ssl_dir / cert_name
|
||||
key_path = ssl_dir / key_name
|
||||
|
||||
if cert_path.exists() and key_path.exists():
|
||||
found_certs.append((cert_path, key_path, ssl_dir))
|
||||
print(f"📄 Gefunden: {cert_path}")
|
||||
|
||||
if not found_certs:
|
||||
print("📂 Keine SSL-Zertifikate gefunden - erstelle neue...")
|
||||
ssl_dir = Path("ssl")
|
||||
ssl_dir.mkdir(exist_ok=True)
|
||||
found_certs = [(ssl_dir / "cert.pem", ssl_dir / "key.pem", ssl_dir)]
|
||||
|
||||
# Verwende das SSL-Modul zur Neugenerierung
|
||||
print("\n🔄 Regeneriere browser-kompatible SSL-Zertifikate...")
|
||||
|
||||
try:
|
||||
# Importiere das SSL-Modul
|
||||
sys.path.insert(0, str(Path.cwd()))
|
||||
from utils.ssl_config import SSLCertificateManager
|
||||
|
||||
success_count = 0
|
||||
|
||||
for cert_path, key_path, ssl_dir in found_certs:
|
||||
print(f"\n📁 Bearbeite: {ssl_dir}")
|
||||
|
||||
# Backup erstellen
|
||||
backup_dir = ssl_dir / "backup"
|
||||
backup_dir.mkdir(exist_ok=True)
|
||||
|
||||
if cert_path.exists():
|
||||
backup_cert = backup_dir / f"{cert_path.name}.backup"
|
||||
backup_key = backup_dir / f"{key_path.name}.backup"
|
||||
|
||||
try:
|
||||
shutil.copy2(cert_path, backup_cert)
|
||||
shutil.copy2(key_path, backup_key)
|
||||
print(f"💾 Backup erstellt: {backup_cert}")
|
||||
except Exception as e:
|
||||
print(f"⚠️ Backup fehlgeschlagen: {e}")
|
||||
|
||||
# SSL-Manager konfigurieren
|
||||
app_dir = Path.cwd().absolute()
|
||||
ssl_manager = SSLCertificateManager(str(app_dir))
|
||||
|
||||
# Überschreibe Pfade für gefundenes Verzeichnis
|
||||
ssl_manager.ssl_dir = ssl_dir
|
||||
ssl_manager.cert_file = cert_path
|
||||
ssl_manager.key_file = key_path
|
||||
|
||||
# Regeneriere Zertifikat mit korrekten Extensions
|
||||
print("🔧 Generiere browser-kompatibles Zertifikat...")
|
||||
|
||||
if ssl_manager.generate_ssl_certificate(force_regenerate=True):
|
||||
print("✅ Browser-kompatibles Zertifikat generiert")
|
||||
success_count += 1
|
||||
|
||||
# Validiere das neue Zertifikat
|
||||
if validate_certificate_compatibility(cert_path):
|
||||
print("🎉 Browser-Kompatibilitäts-Check bestanden!")
|
||||
else:
|
||||
print("⚠️ Zertifikat generiert, aber möglicherweise nicht vollständig kompatibel")
|
||||
|
||||
else:
|
||||
print("❌ Zertifikat-Generierung fehlgeschlagen")
|
||||
|
||||
if success_count > 0:
|
||||
print(f"\n✅ SSL-FIX ERFOLGREICH!")
|
||||
print(f" {success_count} Zertifikat(e) erfolgreich regeneriert")
|
||||
print(f"\n🌐 NÄCHSTE SCHRITTE:")
|
||||
print(f" 1. Browser-Cache vollständig leeren:")
|
||||
print(f" • Chrome/Edge: Strg+Shift+Del → 'Alle Daten löschen'")
|
||||
print(f" • Firefox: Strg+Shift+Del → 'Alles' auswählen")
|
||||
print(f" 2. MYP-Anwendung neu starten")
|
||||
print(f" 3. https://localhost:5000 aufrufen")
|
||||
print(f" 4. Bei SSL-Warnung: 'Erweitert' → 'Unsicher fortfahren'")
|
||||
print(f"\n💡 Der Fehler ERR_SSL_KEY_USAGE_INCOMPATIBLE sollte behoben sein!")
|
||||
|
||||
else:
|
||||
print(f"\n❌ SSL-FIX FEHLGESCHLAGEN!")
|
||||
print(f" Keine Zertifikate konnten regeneriert werden")
|
||||
print(f" Prüfe die Logs und Berechtigungen")
|
||||
|
||||
except ImportError as e:
|
||||
print(f"❌ SSL-Modul konnte nicht importiert werden: {e}")
|
||||
print(f"💡 Fallback: Manuelle Zertifikat-Regenerierung erforderlich")
|
||||
return False
|
||||
|
||||
except Exception as e:
|
||||
print(f"❌ Unerwarteter Fehler: {e}")
|
||||
return False
|
||||
|
||||
return success_count > 0
|
||||
|
||||
def validate_certificate_compatibility(cert_path):
|
||||
"""
|
||||
Validiert Browser-Kompatibilität eines Zertifikats (ohne OpenSSL)
|
||||
Vereinfachte Version die nur die Datei-Existenz prüft
|
||||
"""
|
||||
try:
|
||||
if not cert_path.exists():
|
||||
return False
|
||||
|
||||
# Lese Zertifikat-Inhalt
|
||||
with open(cert_path, 'r') as f:
|
||||
cert_content = f.read()
|
||||
|
||||
# Basis-Checks
|
||||
checks = {
|
||||
"PEM Format": cert_content.startswith("-----BEGIN CERTIFICATE-----"),
|
||||
"PEM Ende": cert_content.endswith("-----END CERTIFICATE-----\n") or cert_content.endswith("-----END CERTIFICATE-----"),
|
||||
"Mindestlänge": len(cert_content) > 500,
|
||||
}
|
||||
|
||||
print("📋 Zertifikat-Validation:")
|
||||
all_passed = True
|
||||
for check_name, passed in checks.items():
|
||||
status = "✅" if passed else "❌"
|
||||
print(f" {status} {check_name}")
|
||||
if not passed:
|
||||
all_passed = False
|
||||
|
||||
return all_passed
|
||||
|
||||
except Exception as e:
|
||||
print(f"⚠️ Validation fehlgeschlagen: {e}")
|
||||
return False
|
||||
|
||||
def clean_browser_cache_instructions():
|
||||
"""Zeigt detaillierte Anweisungen zum Browser-Cache leeren"""
|
||||
|
||||
print("\n🧹 BROWSER-CACHE VOLLSTÄNDIG LEEREN")
|
||||
print("=" * 50)
|
||||
print("\n🌐 Google Chrome / Microsoft Edge:")
|
||||
print(" 1. Strg + Shift + Del drücken")
|
||||
print(" 2. Zeitraum: 'Gesamte Zeit' auswählen")
|
||||
print(" 3. Alle Optionen aktivieren:")
|
||||
print(" ☑️ Browserverlauf")
|
||||
print(" ☑️ Downloadverlauf")
|
||||
print(" ☑️ Cookies und andere Websitedaten")
|
||||
print(" ☑️ Bilder und Dateien im Cache")
|
||||
print(" ☑️ Gehostete App-Daten")
|
||||
print(" 4. 'Daten löschen' klicken")
|
||||
|
||||
print("\n🦊 Mozilla Firefox:")
|
||||
print(" 1. Strg + Shift + Del drücken")
|
||||
print(" 2. Zeitraum: 'Alles' auswählen")
|
||||
print(" 3. Alle Optionen aktivieren:")
|
||||
print(" ☑️ Chronik")
|
||||
print(" ☑️ Cookies")
|
||||
print(" ☑️ Cache")
|
||||
print(" ☑️ Aktive Logins")
|
||||
print(" ☑️ Offline-Website-Daten")
|
||||
print(" 4. 'Jetzt löschen' klicken")
|
||||
|
||||
print("\n🔄 Zusätzliche Schritte:")
|
||||
print(" • Browser komplett schließen und neu starten")
|
||||
print(" • Windows: Netzwerkadapter zurücksetzen")
|
||||
print(" ipconfig /flushdns")
|
||||
print(" • Bei Chrome: chrome://settings/certificates → Zwischenzertifikate löschen")
|
||||
|
||||
def main():
|
||||
"""Hauptfunktion"""
|
||||
|
||||
print("🔧 MYP SSL BROWSER-KOMPATIBILITÄTS-FIX")
|
||||
print("Windows-kompatible Version")
|
||||
print("=" * 60)
|
||||
|
||||
# Prüfe aktuelles Verzeichnis
|
||||
if not Path("utils").exists():
|
||||
print("❌ utils-Verzeichnis nicht gefunden")
|
||||
print("💡 Führe das Skript im backend-Verzeichnis aus:")
|
||||
print(" cd backend")
|
||||
print(" python fix_ssl_browser.py")
|
||||
return False
|
||||
|
||||
# Führe SSL-Fix durch
|
||||
success = regenerate_ssl_certificates()
|
||||
|
||||
if success:
|
||||
print("\n" + "="*60)
|
||||
clean_browser_cache_instructions()
|
||||
print("\n" + "="*60)
|
||||
print("✅ SSL-Fix abgeschlossen!")
|
||||
print("🌐 ERR_SSL_KEY_USAGE_INCOMPATIBLE sollte behoben sein.")
|
||||
else:
|
||||
print("\n❌ SSL-Fix fehlgeschlagen!")
|
||||
print("📞 Weitere Hilfe in COMMON_ERRORS.md")
|
||||
|
||||
return success
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
221
backend/ssl/ssl_fix.py
Normal file
221
backend/ssl/ssl_fix.py
Normal file
@ -0,0 +1,221 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
SSL Fix Tool für MYP Platform - ERR_SSL_KEY_USAGE_INCOMPATIBLE Lösung
|
||||
Behebt Browser-SSL-Kompatibilitätsprobleme durch Neugenerierung korrekter Zertifikate
|
||||
"""
|
||||
|
||||
import os
|
||||
import subprocess
|
||||
import shutil
|
||||
from pathlib import Path
|
||||
|
||||
def create_browser_compatible_ssl():
|
||||
"""Erstellt browser-kompatible SSL-Zertifikate für MYP"""
|
||||
|
||||
print("🔧 SSL BROWSER-KOMPATIBILITÄTS-FIX")
|
||||
print("=" * 50)
|
||||
|
||||
# Basis-Verzeichnis
|
||||
app_dir = Path.cwd()
|
||||
ssl_dir = app_dir / "ssl"
|
||||
|
||||
# Erstelle SSL-Verzeichnis
|
||||
ssl_dir.mkdir(exist_ok=True)
|
||||
|
||||
cert_path = ssl_dir / "cert.pem"
|
||||
key_path = ssl_dir / "key.pem"
|
||||
config_path = ssl_dir / "openssl_fix.conf"
|
||||
|
||||
print(f"📁 SSL-Verzeichnis: {ssl_dir}")
|
||||
|
||||
# Browser-kompatible OpenSSL-Konfiguration
|
||||
openssl_config = """[req]
|
||||
distinguished_name = req_distinguished_name
|
||||
req_extensions = v3_req
|
||||
prompt = no
|
||||
|
||||
[req_distinguished_name]
|
||||
C = DE
|
||||
ST = Baden-Wuerttemberg
|
||||
L = Stuttgart
|
||||
O = Mercedes-Benz AG
|
||||
OU = MYP Druckerverwaltung
|
||||
CN = m040tbaraspi001
|
||||
|
||||
[v3_req]
|
||||
# Basic Constraints - KRITISCH für Browser
|
||||
basicConstraints = critical, CA:FALSE
|
||||
|
||||
# Key Usage - KRITISCH für Browser-Kompatibilität
|
||||
keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement
|
||||
|
||||
# Extended Key Usage - TLS Server Authentication
|
||||
extendedKeyUsage = critical, serverAuth, clientAuth
|
||||
|
||||
# Subject Alternative Names - Alle Domains/IPs
|
||||
subjectAltName = critical, @alt_names
|
||||
|
||||
# Netscape Legacy-Kompatibilität
|
||||
nsCertType = server
|
||||
|
||||
# Identifikations-Kommentar
|
||||
nsComment = "MYP SSL Fix - ERR_SSL_KEY_USAGE_INCOMPATIBLE Lösung"
|
||||
|
||||
[alt_names]
|
||||
DNS.1 = localhost
|
||||
DNS.2 = *.localhost
|
||||
DNS.3 = m040tbaraspi001
|
||||
DNS.4 = m040tbaraspi001.local
|
||||
DNS.5 = m040tbaraspi001.de040.corpintra.net
|
||||
DNS.6 = *.de040.corpintra.net
|
||||
IP.1 = 127.0.0.1
|
||||
IP.2 = ::1
|
||||
IP.3 = 0.0.0.0
|
||||
"""
|
||||
|
||||
# Schreibe OpenSSL-Konfiguration
|
||||
with open(config_path, 'w') as f:
|
||||
f.write(openssl_config)
|
||||
|
||||
print("📝 OpenSSL-Konfiguration erstellt")
|
||||
|
||||
try:
|
||||
# Backup existierender Zertifikate
|
||||
if cert_path.exists():
|
||||
backup_cert = ssl_dir / f"cert_backup_{os.getpid()}.pem"
|
||||
backup_key = ssl_dir / f"key_backup_{os.getpid()}.pem"
|
||||
shutil.copy2(cert_path, backup_cert)
|
||||
shutil.copy2(key_path, backup_key)
|
||||
print(f"💾 Backup erstellt: {backup_cert}")
|
||||
|
||||
# Private Key generieren
|
||||
print("🔑 Generiere Private Key...")
|
||||
key_cmd = [
|
||||
"openssl", "genrsa",
|
||||
"-out", str(key_path),
|
||||
"2048"
|
||||
]
|
||||
|
||||
result = subprocess.run(key_cmd, capture_output=True, text=True)
|
||||
if result.returncode != 0:
|
||||
raise Exception(f"Private Key Generierung fehlgeschlagen: {result.stderr}")
|
||||
|
||||
print("✅ Private Key generiert")
|
||||
|
||||
# Browser-kompatibles Zertifikat erstellen
|
||||
print("📜 Generiere browser-kompatibles Zertifikat...")
|
||||
cert_cmd = [
|
||||
"openssl", "req",
|
||||
"-new", "-x509",
|
||||
"-key", str(key_path),
|
||||
"-out", str(cert_path),
|
||||
"-days", "365",
|
||||
"-config", str(config_path),
|
||||
"-extensions", "v3_req",
|
||||
"-sha256"
|
||||
]
|
||||
|
||||
result = subprocess.run(cert_cmd, capture_output=True, text=True)
|
||||
if result.returncode != 0:
|
||||
raise Exception(f"Zertifikat-Generierung fehlgeschlagen: {result.stderr}")
|
||||
|
||||
print("✅ Browser-kompatibles Zertifikat generiert")
|
||||
|
||||
# Berechtigungen setzen
|
||||
os.chmod(key_path, 0o600) # Nur Owner kann lesen
|
||||
os.chmod(cert_path, 0o644) # Alle können lesen
|
||||
|
||||
print("🔒 Berechtigungen gesetzt")
|
||||
|
||||
# Validierung
|
||||
print("🔍 Validiere Zertifikat...")
|
||||
|
||||
# Prüfe Key Usage Extensions
|
||||
check_cmd = ["openssl", "x509", "-in", str(cert_path), "-noout", "-text"]
|
||||
result = subprocess.run(check_cmd, capture_output=True, text=True)
|
||||
|
||||
if result.returncode == 0:
|
||||
cert_text = result.stdout
|
||||
|
||||
# Browser-Kompatibilitäts-Checks
|
||||
checks = {
|
||||
"Digital Signature": "Digital Signature" in cert_text,
|
||||
"Key Encipherment": "Key Encipherment" in cert_text,
|
||||
"TLS Web Server Authentication": "TLS Web Server Authentication" in cert_text,
|
||||
"Subject Alternative Name": "Subject Alternative Name" in cert_text,
|
||||
"CA:FALSE": "CA:FALSE" in cert_text,
|
||||
"SHA-256": "sha256WithRSAEncryption" in cert_text
|
||||
}
|
||||
|
||||
print("\n📋 BROWSER-KOMPATIBILITÄTS-PRÜFUNG:")
|
||||
all_passed = True
|
||||
for check_name, passed in checks.items():
|
||||
status = "✅" if passed else "❌"
|
||||
print(f" {status} {check_name}")
|
||||
if not passed:
|
||||
all_passed = False
|
||||
|
||||
if all_passed:
|
||||
print("\n🎉 ALLE BROWSER-KOMPATIBILITÄTS-CHECKS BESTANDEN!")
|
||||
else:
|
||||
print("\n⚠️ Einige Checks fehlgeschlagen - Zertifikat kann trotzdem funktionieren")
|
||||
|
||||
# Aufräumen
|
||||
config_path.unlink(missing_ok=True)
|
||||
|
||||
print(f"\n📊 ERGEBNIS:")
|
||||
print(f" 📄 Zertifikat: {cert_path}")
|
||||
print(f" 🔑 Private Key: {key_path}")
|
||||
print(f" 📅 Gültig bis: {365} Tage")
|
||||
|
||||
print(f"\n🌐 NÄCHSTE SCHRITTE:")
|
||||
print(f" 1. Browser-Cache leeren (Strg+Shift+Del)")
|
||||
print(f" 2. MYP-Anwendung neu starten")
|
||||
print(f" 3. https://localhost:5000 aufrufen")
|
||||
print(f" 4. Bei SSL-Warnung: 'Erweitert' → 'Weiter zu localhost (unsicher)'")
|
||||
|
||||
return True
|
||||
|
||||
except Exception as e:
|
||||
print(f"❌ FEHLER: {e}")
|
||||
return False
|
||||
|
||||
def check_openssl():
|
||||
"""Prüft ob OpenSSL verfügbar ist"""
|
||||
try:
|
||||
result = subprocess.run(["openssl", "version"], capture_output=True, text=True)
|
||||
if result.returncode == 0:
|
||||
print(f"✅ OpenSSL verfügbar: {result.stdout.strip()}")
|
||||
return True
|
||||
else:
|
||||
print("❌ OpenSSL nicht verfügbar")
|
||||
return False
|
||||
except FileNotFoundError:
|
||||
print("❌ OpenSSL nicht installiert")
|
||||
print("💡 Installiere mit: sudo apt install openssl")
|
||||
return False
|
||||
|
||||
def main():
|
||||
"""Hauptfunktion"""
|
||||
print("🔧 MYP SSL BROWSER-KOMPATIBILITÄTS-FIX")
|
||||
print("Löst ERR_SSL_KEY_USAGE_INCOMPATIBLE Fehler")
|
||||
print("=" * 60)
|
||||
|
||||
# Prüfe OpenSSL
|
||||
if not check_openssl():
|
||||
return False
|
||||
|
||||
# Erstelle browser-kompatible Zertifikate
|
||||
success = create_browser_compatible_ssl()
|
||||
|
||||
if success:
|
||||
print("\n✅ SSL-Fix erfolgreich abgeschlossen!")
|
||||
print("🌐 Browser-Fehler ERR_SSL_KEY_USAGE_INCOMPATIBLE sollte behoben sein.")
|
||||
else:
|
||||
print("\n❌ SSL-Fix fehlgeschlagen!")
|
||||
print("📞 Prüfe COMMON_ERRORS.md für weitere Hilfe.")
|
||||
|
||||
return success
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
Reference in New Issue
Block a user