🎉 Hinzugefügt: Skript zur Generierung browser-kompatibler SSL-Zertifikate mit umfassender Fehlerbehandlung und Validierung. 🔒✨
This commit is contained in:
@ -1 +1,480 @@
|
||||
|
||||
# MYP Platform - Häufige Fehler und Lösungen
|
||||
|
||||
Dieses Dokument sammelt häufige Installations- und Konfigurationsfehler mit ihren bewährten Lösungen.
|
||||
|
||||
## 📦 Python-Paket-Installationsfehler
|
||||
|
||||
### Send2Trash Installation schlägt fehl
|
||||
|
||||
**Problem:**
|
||||
```
|
||||
ERROR: Failed building wheel for Send2Trash
|
||||
error: Microsoft Visual C++ 14.0 is required
|
||||
```
|
||||
|
||||
**Lösung:**
|
||||
- Send2Trash wurde aus requirements.txt entfernt
|
||||
- Native Alternative in `backend/utils/file_utils.py` implementiert
|
||||
- Verwendet plattformspezifische Papierkorb-APIs:
|
||||
- Windows: PowerShell + Visual Basic FileSystem
|
||||
- Linux: gio/gvfs-trash/XDG-Standard
|
||||
- macOS: osascript + Finder
|
||||
|
||||
**Code-Ersatz:**
|
||||
```python
|
||||
# Alt:
|
||||
from send2trash import send2trash
|
||||
send2trash(file_path)
|
||||
|
||||
# Neu:
|
||||
from utils.file_utils import move_to_trash
|
||||
move_to_trash(file_path)
|
||||
```
|
||||
|
||||
### Python-magic-bin Windows-Fehler
|
||||
|
||||
**Problem:**
|
||||
```
|
||||
ERROR: Could not find a version that satisfies the requirement python-magic-bin
|
||||
```
|
||||
|
||||
**Lösung:**
|
||||
- Paket ist Windows-spezifisch und wird automatisch übersprungen auf Linux
|
||||
- Setup-Skript erstellt bereinigte requirements.txt ohne problematische Pakete
|
||||
- Plattformspezifische Conditional-Installation: `; sys_platform == "win32"`
|
||||
|
||||
### RPi.GPIO auf Non-Raspberry Pi
|
||||
|
||||
**Problem:**
|
||||
```
|
||||
RuntimeError: This module can only be run on a Raspberry Pi!
|
||||
```
|
||||
|
||||
**Lösung:**
|
||||
- Conditional-Installation: `RPi.GPIO; sys_platform == "linux"`
|
||||
- Wird automatisch übersprungen wenn nicht auf Raspberry Pi
|
||||
- Fallback-Hardware-Detection in Hardware-Modulen
|
||||
|
||||
## 🔧 Systemkonfigurationsfehler
|
||||
|
||||
### Hostname-Änderung schlägt fehl
|
||||
|
||||
**Problem:**
|
||||
```
|
||||
hostnamectl: command not found
|
||||
/etc/hostname: Permission denied
|
||||
```
|
||||
|
||||
**Lösung:**
|
||||
```bash
|
||||
# Prüfe systemd-Verfügbarkeit
|
||||
if command -v hostnamectl >/dev/null 2>&1; then
|
||||
sudo hostnamectl set-hostname m040tbaraspi001
|
||||
else
|
||||
# Fallback für ältere Systeme
|
||||
echo "m040tbaraspi001" | sudo tee /etc/hostname
|
||||
sudo hostname m040tbaraspi001
|
||||
fi
|
||||
|
||||
# Hosts-Datei aktualisieren
|
||||
sudo sed -i 's/127.0.1.1.*/127.0.1.1\tm040tbaraspi001/' /etc/hosts
|
||||
```
|
||||
|
||||
### SSL-Zertifikat-Generierung schlägt fehl
|
||||
|
||||
**Problem:**
|
||||
```
|
||||
openssl: command not found
|
||||
Permission denied: /opt/myp/ssl/
|
||||
```
|
||||
|
||||
**Lösung:**
|
||||
```bash
|
||||
# OpenSSL installieren
|
||||
sudo apt update && sudo apt install -y openssl
|
||||
|
||||
# Verzeichnis mit korrekten Berechtigungen erstellen
|
||||
sudo mkdir -p /opt/myp/ssl
|
||||
sudo chown -R $USER:$USER /opt/myp/ssl
|
||||
sudo chmod 755 /opt/myp/ssl
|
||||
|
||||
# Self-signed Zertifikat generieren
|
||||
openssl req -x509 -newkey rsa:4096 -keyout /opt/myp/ssl/key.pem \
|
||||
-out /opt/myp/ssl/cert.pem -days 365 -nodes \
|
||||
-subj "/C=DE/ST=NRW/L=Duesseldorf/O=Mercedes-Benz/CN=m040tbaraspi001"
|
||||
```
|
||||
|
||||
### Systemd-Service Installation schlägt fehl
|
||||
|
||||
**Problem:**
|
||||
```
|
||||
Failed to enable unit: Unit file does not exist
|
||||
systemctl: command not found
|
||||
```
|
||||
|
||||
**Lösung:**
|
||||
```bash
|
||||
# Prüfe systemd-Verfügbarkeit
|
||||
if ! command -v systemctl >/dev/null 2>&1; then
|
||||
echo "systemd nicht verfügbar - verwende alternatives Init-System"
|
||||
# Fallback auf SysV init oder manuelle Autostart-Einrichtung
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Service-Datei kopieren und aktivieren
|
||||
sudo cp myp-*.service /etc/systemd/system/
|
||||
sudo systemctl daemon-reload
|
||||
sudo systemctl enable myp-app.service
|
||||
sudo systemctl enable myp-kiosk.service
|
||||
```
|
||||
|
||||
## 🌐 Netzwerkkonfigurationsfehler
|
||||
|
||||
### Firewall blockiert Zugriff
|
||||
|
||||
**Problem:**
|
||||
```
|
||||
Connection refused: https://m040tbaraspi001.de040.corpintra.net:443
|
||||
curl: (7) Failed to connect
|
||||
```
|
||||
|
||||
**Lösung:**
|
||||
```bash
|
||||
# UFW-Firewall konfigurieren
|
||||
sudo ufw allow 22/tcp # SSH
|
||||
sudo ufw allow 80/tcp # HTTP
|
||||
sudo ufw allow 443/tcp # HTTPS
|
||||
sudo ufw allow 5000/tcp # Flask Development
|
||||
sudo ufw --force enable
|
||||
|
||||
# iptables direkt (falls UFW nicht verfügbar)
|
||||
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT
|
||||
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
|
||||
sudo iptables-save | sudo tee /etc/iptables/rules.v4
|
||||
```
|
||||
|
||||
### DNS-Auflösung schlägt fehl
|
||||
|
||||
**Problem:**
|
||||
```
|
||||
nslookup: can't resolve 'm040tbaraspi001.de040.corpintra.net'
|
||||
ping: unknown host
|
||||
```
|
||||
|
||||
**Lösung:**
|
||||
```bash
|
||||
# Lokale hosts-Datei erweitern
|
||||
echo "127.0.0.1 m040tbaraspi001.local" | sudo tee -a /etc/hosts
|
||||
echo "127.0.0.1 m040tbaraspi001.de040.corpintra.net" | sudo tee -a /etc/hosts
|
||||
|
||||
# DNS-Server prüfen und setzen
|
||||
echo "nameserver 8.8.8.8" | sudo tee -a /etc/resolv.conf
|
||||
echo "nameserver 8.8.4.4" | sudo tee -a /etc/resolv.conf
|
||||
|
||||
# NetworkManager DNS (Ubuntu/Debian)
|
||||
sudo systemctl restart NetworkManager
|
||||
```
|
||||
|
||||
## 🖥️ Desktop- und Kiosk-Fehler
|
||||
|
||||
### Chromium startet nicht im Kiosk-Modus
|
||||
|
||||
**Problem:**
|
||||
```
|
||||
chromium-browser: command not found
|
||||
[ERROR:gpu_init.cc] GPU initialization failed
|
||||
```
|
||||
|
||||
**Lösung:**
|
||||
```bash
|
||||
# Chromium installieren
|
||||
sudo apt update && sudo apt install -y chromium-browser
|
||||
|
||||
# GPU-Acceleration deaktivieren für Headless-Systeme
|
||||
chromium-browser --no-sandbox --disable-gpu --disable-software-rasterizer \
|
||||
--disable-background-timer-throttling --disable-renderer-backgrounding \
|
||||
--disable-backgrounding-occluded-windows --kiosk "$URL"
|
||||
|
||||
# Fallback auf andere Browser
|
||||
if ! command -v chromium-browser >/dev/null 2>&1; then
|
||||
if command -v firefox >/dev/null 2>&1; then
|
||||
firefox --kiosk "$URL"
|
||||
elif command -v google-chrome >/dev/null 2>&1; then
|
||||
google-chrome --kiosk --no-sandbox "$URL"
|
||||
fi
|
||||
fi
|
||||
```
|
||||
|
||||
### Desktop-Verknüpfung wird nicht angezeigt
|
||||
|
||||
**Problem:**
|
||||
```
|
||||
.desktop file created but not visible
|
||||
Icon not displayed
|
||||
```
|
||||
|
||||
**Lösung:**
|
||||
```bash
|
||||
# Desktop-Datei ausführbar machen
|
||||
chmod +x ~/Desktop/myp-kiosk.desktop
|
||||
|
||||
# Icon kopieren
|
||||
sudo cp backend/static/mercedes.svg /usr/share/pixmaps/myp-mercedes.svg
|
||||
sudo chmod 644 /usr/share/pixmaps/myp-mercedes.svg
|
||||
|
||||
# Desktop-Datenbank aktualisieren
|
||||
update-desktop-database ~/.local/share/applications/
|
||||
xdg-desktop-menu forceupdate
|
||||
|
||||
# Gnome: Trusted Application markieren
|
||||
dconf write /org/gnome/desktop/interface/enable-animations false
|
||||
```
|
||||
|
||||
## 📊 Datenbank- und Persistenzfehler
|
||||
|
||||
### SQLite-Datenbank Berechtigungsfehler
|
||||
|
||||
**Problem:**
|
||||
```
|
||||
sqlite3.OperationalError: attempt to write a readonly database
|
||||
PermissionError: [Errno 13] Permission denied: 'instance/myp.db'
|
||||
```
|
||||
|
||||
**Lösung:**
|
||||
```bash
|
||||
# Verzeichnis und Datei-Berechtigungen korrigieren
|
||||
sudo chown -R $USER:$USER /opt/myp/instance/
|
||||
chmod 755 /opt/myp/instance/
|
||||
chmod 644 /opt/myp/instance/*.db
|
||||
|
||||
# Backup-Verzeichnis mit Schreibrechten
|
||||
mkdir -p /opt/myp/instance/backups
|
||||
chmod 755 /opt/myp/instance/backups
|
||||
```
|
||||
|
||||
### Backup-Prozess schlägt fehl
|
||||
|
||||
**Problem:**
|
||||
```
|
||||
rsync: command not found
|
||||
tar: cannot create backup
|
||||
disk full
|
||||
```
|
||||
|
||||
**Lösung:**
|
||||
```bash
|
||||
# Notwendige Tools installieren
|
||||
sudo apt install -y rsync tar gzip
|
||||
|
||||
# Speicherplatz prüfen
|
||||
df -h /opt/myp/
|
||||
|
||||
# Alte Backups aufräumen (älter als 30 Tage)
|
||||
find /opt/myp/instance/backups -name "*.tar.gz" -mtime +30 -delete
|
||||
|
||||
# Komprimierte Backups
|
||||
tar -czf backup_$(date +%Y%m%d_%H%M%S).tar.gz instance/
|
||||
```
|
||||
|
||||
## 🔐 Sicherheits- und Authentifizierungsfehler
|
||||
|
||||
### JWT-Token-Validierung schlägt fehl
|
||||
|
||||
**Problem:**
|
||||
```
|
||||
jwt.DecodeError: Invalid token
|
||||
SECRET_KEY not set
|
||||
```
|
||||
|
||||
**Lösung:**
|
||||
```python
|
||||
# In config.py sicherstellen:
|
||||
import secrets
|
||||
SECRET_KEY = secrets.token_urlsafe(32)
|
||||
|
||||
# Oder aus Umgebungsvariable:
|
||||
SECRET_KEY = os.environ.get('SECRET_KEY') or secrets.token_urlsafe(32)
|
||||
|
||||
# Token-Expiration prüfen:
|
||||
JWT_ACCESS_TOKEN_EXPIRES = timedelta(hours=24)
|
||||
```
|
||||
|
||||
### SSL Browser-Kompatibilitätsfehler (ERR_SSL_KEY_USAGE_INCOMPATIBLE)
|
||||
|
||||
**Problem:**
|
||||
```
|
||||
ERR_SSL_KEY_USAGE_INCOMPATIBLE
|
||||
This site can't provide a secure connection
|
||||
SSL certificate key usage incompatible
|
||||
```
|
||||
|
||||
**Lösung:**
|
||||
```bash
|
||||
# Schnell-Fix mit dediziertem Tool
|
||||
cd backend
|
||||
python3 ssl_fix.py
|
||||
|
||||
# Oder manuell neue browser-kompatible Zertifikate generieren:
|
||||
cd backend/ssl
|
||||
openssl genrsa -out key.pem 2048
|
||||
|
||||
# Erstelle OpenSSL-Konfiguration mit korrekten Extensions
|
||||
cat > ssl_fix.conf << 'EOF'
|
||||
[req]
|
||||
distinguished_name = req_distinguished_name
|
||||
req_extensions = v3_req
|
||||
prompt = no
|
||||
|
||||
[req_distinguished_name]
|
||||
C = DE
|
||||
ST = Baden-Wuerttemberg
|
||||
L = Stuttgart
|
||||
O = Mercedes-Benz AG
|
||||
OU = MYP Druckerverwaltung
|
||||
CN = m040tbaraspi001
|
||||
|
||||
[v3_req]
|
||||
basicConstraints = critical, CA:FALSE
|
||||
keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement
|
||||
extendedKeyUsage = critical, serverAuth, clientAuth
|
||||
subjectAltName = critical, @alt_names
|
||||
nsCertType = server
|
||||
|
||||
[alt_names]
|
||||
DNS.1 = localhost
|
||||
DNS.2 = m040tbaraspi001
|
||||
DNS.3 = m040tbaraspi001.de040.corpintra.net
|
||||
IP.1 = 127.0.0.1
|
||||
EOF
|
||||
|
||||
# Generiere browser-kompatibles Zertifikat
|
||||
openssl req -new -x509 -key key.pem -out cert.pem -days 365 \
|
||||
-config ssl_fix.conf -extensions v3_req -sha256
|
||||
|
||||
# Validiere Extensions
|
||||
openssl x509 -in cert.pem -noout -text | grep -A5 "Key Usage"
|
||||
|
||||
# Danach: Browser-Cache leeren und MYP neu starten
|
||||
```
|
||||
|
||||
### HTTPS-Redirect-Loop
|
||||
|
||||
**Problem:**
|
||||
```
|
||||
ERR_TOO_MANY_REDIRECTS
|
||||
Infinite redirect between http and https
|
||||
```
|
||||
|
||||
**Lösung:**
|
||||
```python
|
||||
# In Flask-App prüfen:
|
||||
from flask_talisman import Talisman
|
||||
|
||||
# Nur HTTPS forcieren wenn Zertifikat verfügbar
|
||||
if os.path.exists('/opt/myp/ssl/cert.pem'):
|
||||
Talisman(app, force_https=True)
|
||||
else:
|
||||
# Development: HTTP erlauben
|
||||
Talisman(app, force_https=False)
|
||||
```
|
||||
|
||||
## 📝 Log-Dateien zur Fehlerdiagnose
|
||||
|
||||
### Wichtige Log-Standorte:
|
||||
```bash
|
||||
# MYP Application Logs
|
||||
/opt/myp/logs/app/app.log
|
||||
/opt/myp/logs/errors/error.log
|
||||
|
||||
# Systemd Service Logs
|
||||
journalctl -u myp-app.service -f
|
||||
journalctl -u myp-kiosk.service -f
|
||||
|
||||
# System-Logs
|
||||
/var/log/syslog
|
||||
/var/log/nginx/error.log # Falls Nginx verwendet wird
|
||||
```
|
||||
|
||||
### Log-Analyse-Befehle:
|
||||
```bash
|
||||
# Letzte 50 Fehler
|
||||
tail -50 /opt/myp/logs/errors/error.log | grep ERROR
|
||||
|
||||
# Live-Monitoring
|
||||
tail -f /opt/myp/logs/app/app.log
|
||||
|
||||
# Fehler der letzten Stunde
|
||||
journalctl -u myp-app.service --since "1 hour ago" | grep ERROR
|
||||
```
|
||||
|
||||
## 🛠️ Debugging-Tools
|
||||
|
||||
### System-Informationen sammeln:
|
||||
```bash
|
||||
# System-Overview
|
||||
uname -a
|
||||
lsb_release -a
|
||||
python3 --version
|
||||
pip3 list | grep -E "(Flask|requests)"
|
||||
|
||||
# Netzwerk-Status
|
||||
ip addr show
|
||||
ss -tulpn | grep :443
|
||||
curl -I http://localhost:5000/health
|
||||
|
||||
# Prozess-Status
|
||||
ps aux | grep -E "(python|myp)"
|
||||
systemctl status myp-*
|
||||
```
|
||||
|
||||
### Performance-Monitoring:
|
||||
```bash
|
||||
# CPU und Memory
|
||||
top -p $(pgrep -f "python.*myp")
|
||||
htop
|
||||
|
||||
# Disk I/O
|
||||
iotop
|
||||
df -h /opt/myp/
|
||||
|
||||
# Network
|
||||
iftop
|
||||
netstat -i
|
||||
```
|
||||
|
||||
## 📋 Vorbeugende Maßnahmen
|
||||
|
||||
### Regelmäßige Wartung:
|
||||
```bash
|
||||
# System-Updates
|
||||
sudo apt update && sudo apt upgrade -y
|
||||
|
||||
# Python-Pakete aktualisieren
|
||||
pip3 list --outdated
|
||||
python3 -m pip install --upgrade pip
|
||||
|
||||
# Log-Rotation einrichten
|
||||
sudo logrotate -f /etc/logrotate.conf
|
||||
|
||||
# Disk-Cleanup
|
||||
sudo apt autoremove -y
|
||||
sudo apt autoclean
|
||||
```
|
||||
|
||||
### Monitoring-Setup:
|
||||
```bash
|
||||
# Cron-Job für Health-Check (alle 5 Minuten)
|
||||
echo "*/5 * * * * curl -f http://localhost:5000/health || systemctl restart myp-app.service" | crontab -
|
||||
|
||||
# Log-Size monitoring
|
||||
echo "0 2 * * * find /opt/myp/logs -name '*.log' -size +100M -exec truncate -s 50M {} \;" | crontab -
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
**💡 Tipp:** Vor jeder größeren Änderung ein vollständiges Backup erstellen:
|
||||
```bash
|
||||
sudo tar -czf /tmp/myp_backup_$(date +%Y%m%d_%H%M%S).tar.gz /opt/myp/
|
||||
```
|
||||
|
||||
**📞 Support:** Bei ungelösten Problemen alle relevanten Logs und die Ausgabe der Debugging-Tools sammeln.
|
||||
165
backend/Fix-SSL-Browser.ps1
Normal file
165
backend/Fix-SSL-Browser.ps1
Normal file
@ -0,0 +1,165 @@
|
||||
# MYP SSL Browser-Kompatibilitäts-Fix
|
||||
# Löst ERR_SSL_KEY_USAGE_INCOMPATIBLE Fehler
|
||||
|
||||
Write-Host "=========================================================" -ForegroundColor Cyan
|
||||
Write-Host "MYP SSL BROWSER-KOMPATIBILITÄTS-FIX" -ForegroundColor Cyan
|
||||
Write-Host "Löst ERR_SSL_KEY_USAGE_INCOMPATIBLE Fehler" -ForegroundColor Cyan
|
||||
Write-Host "=========================================================" -ForegroundColor Cyan
|
||||
Write-Host ""
|
||||
|
||||
# Prüfe ob SSL-Verzeichnis existiert
|
||||
if (!(Test-Path "ssl")) {
|
||||
Write-Host "Erstelle SSL-Verzeichnis..." -ForegroundColor Yellow
|
||||
New-Item -ItemType Directory -Path "ssl" | Out-Null
|
||||
}
|
||||
|
||||
# Backup existierender Zertifikate
|
||||
if (Test-Path "ssl\cert.pem") {
|
||||
Write-Host "Erstelle Backup der alten Zertifikate..." -ForegroundColor Yellow
|
||||
if (!(Test-Path "ssl\backup")) {
|
||||
New-Item -ItemType Directory -Path "ssl\backup" | Out-Null
|
||||
}
|
||||
$timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
|
||||
Copy-Item "ssl\cert.pem" "ssl\backup\cert_backup_$timestamp.pem" -ErrorAction SilentlyContinue
|
||||
Copy-Item "ssl\key.pem" "ssl\backup\key_backup_$timestamp.pem" -ErrorAction SilentlyContinue
|
||||
Write-Host "Backup erstellt." -ForegroundColor Green
|
||||
}
|
||||
|
||||
# Prüfe ob OpenSSL verfügbar ist
|
||||
try {
|
||||
$null = & openssl version 2>$null
|
||||
Write-Host "OpenSSL gefunden. Generiere browser-kompatible SSL-Zertifikate..." -ForegroundColor Green
|
||||
Write-Host ""
|
||||
}
|
||||
catch {
|
||||
Write-Host ""
|
||||
Write-Host "FEHLER: OpenSSL ist nicht installiert oder nicht im PATH!" -ForegroundColor Red
|
||||
Write-Host ""
|
||||
Write-Host "Bitte installiere OpenSSL:" -ForegroundColor Yellow
|
||||
Write-Host "1. Lade OpenSSL für Windows herunter: https://slproweb.com/products/Win32OpenSSL.html" -ForegroundColor White
|
||||
Write-Host "2. Oder verwende das bestehende SSL-Modul mit Python" -ForegroundColor White
|
||||
Write-Host ""
|
||||
Write-Host "Alternative: Manueller Fix mit vorbereiteten Zertifikaten..." -ForegroundColor Yellow
|
||||
Write-Host ""
|
||||
Read-Host "Drücke Enter zum Beenden"
|
||||
exit 1
|
||||
}
|
||||
|
||||
# Erstelle browser-kompatible OpenSSL-Konfiguration
|
||||
$openssl_config = @"
|
||||
[req]
|
||||
distinguished_name = req_distinguished_name
|
||||
req_extensions = v3_req
|
||||
prompt = no
|
||||
|
||||
[req_distinguished_name]
|
||||
C = DE
|
||||
ST = Baden-Wuerttemberg
|
||||
L = Stuttgart
|
||||
O = Mercedes-Benz AG
|
||||
OU = MYP Druckerverwaltung
|
||||
CN = m040tbaraspi001
|
||||
|
||||
[v3_req]
|
||||
basicConstraints = critical, CA:FALSE
|
||||
keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement
|
||||
extendedKeyUsage = critical, serverAuth, clientAuth
|
||||
subjectAltName = critical, @alt_names
|
||||
nsCertType = server
|
||||
nsComment = "MYP SSL Fix - ERR_SSL_KEY_USAGE_INCOMPATIBLE Lösung"
|
||||
|
||||
[alt_names]
|
||||
DNS.1 = localhost
|
||||
DNS.2 = *.localhost
|
||||
DNS.3 = m040tbaraspi001
|
||||
DNS.4 = m040tbaraspi001.local
|
||||
DNS.5 = m040tbaraspi001.de040.corpintra.net
|
||||
DNS.6 = *.de040.corpintra.net
|
||||
IP.1 = 127.0.0.1
|
||||
IP.2 = ::1
|
||||
IP.3 = 0.0.0.0
|
||||
"@
|
||||
|
||||
# Schreibe OpenSSL-Konfiguration
|
||||
$openssl_config | Out-File -FilePath "ssl\openssl_browser_fix.conf" -Encoding UTF8
|
||||
Write-Host "OpenSSL-Konfiguration erstellt." -ForegroundColor Green
|
||||
|
||||
try {
|
||||
# Generiere Private Key
|
||||
Write-Host "Generiere Private Key (RSA 2048)..." -ForegroundColor Yellow
|
||||
& openssl genrsa -out "ssl\key.pem" 2048 2>$null
|
||||
if ($LASTEXITCODE -ne 0) {
|
||||
throw "Private Key Generierung fehlgeschlagen!"
|
||||
}
|
||||
Write-Host "Private Key generiert." -ForegroundColor Green
|
||||
|
||||
# Generiere browser-kompatibles Zertifikat
|
||||
Write-Host "Generiere browser-kompatibles Zertifikat..." -ForegroundColor Yellow
|
||||
& openssl req -new -x509 -key "ssl\key.pem" -out "ssl\cert.pem" -days 365 -config "ssl\openssl_browser_fix.conf" -extensions v3_req -sha256 2>$null
|
||||
if ($LASTEXITCODE -ne 0) {
|
||||
throw "Zertifikat-Generierung fehlgeschlagen!"
|
||||
}
|
||||
Write-Host "Browser-kompatibles Zertifikat generiert." -ForegroundColor Green
|
||||
|
||||
# Aufräumen
|
||||
Remove-Item "ssl\openssl_browser_fix.conf" -ErrorAction SilentlyContinue
|
||||
|
||||
# Validierung
|
||||
Write-Host ""
|
||||
Write-Host "=========================================================" -ForegroundColor Cyan
|
||||
Write-Host "BROWSER-KOMPATIBILITÄTS-VALIDIERUNG" -ForegroundColor Cyan
|
||||
Write-Host "=========================================================" -ForegroundColor Cyan
|
||||
Write-Host "Prüfe Zertifikat-Extensions..." -ForegroundColor Yellow
|
||||
|
||||
$cert_info = & openssl x509 -in "ssl\cert.pem" -noout -text 2>$null
|
||||
|
||||
$checks = @(
|
||||
@{ Name = "Digital Signature"; Pattern = "Digital Signature" },
|
||||
@{ Name = "Key Encipherment"; Pattern = "Key Encipherment" },
|
||||
@{ Name = "TLS Web Server Authentication"; Pattern = "TLS Web Server Authentication" },
|
||||
@{ Name = "Subject Alternative Name"; Pattern = "Subject Alternative Name" },
|
||||
@{ Name = "CA:FALSE"; Pattern = "CA:FALSE" }
|
||||
)
|
||||
|
||||
foreach ($check in $checks) {
|
||||
if ($cert_info -match $check.Pattern) {
|
||||
Write-Host "✅ $($check.Name)" -ForegroundColor Green
|
||||
} else {
|
||||
Write-Host "❌ $($check.Name)" -ForegroundColor Red
|
||||
}
|
||||
}
|
||||
|
||||
Write-Host ""
|
||||
Write-Host "=========================================================" -ForegroundColor Green
|
||||
Write-Host "SSL-FIX ERFOLGREICH ABGESCHLOSSEN!" -ForegroundColor Green
|
||||
Write-Host "=========================================================" -ForegroundColor Green
|
||||
Write-Host ""
|
||||
Write-Host "Nächste Schritte:" -ForegroundColor Cyan
|
||||
Write-Host "1. Browser-Cache vollständig leeren:" -ForegroundColor White
|
||||
Write-Host " - Chrome/Edge: Strg+Shift+Del, 'Gesamte Zeit', alle Optionen" -ForegroundColor Gray
|
||||
Write-Host " - Firefox: Strg+Shift+Del, 'Alles' auswählen" -ForegroundColor Gray
|
||||
Write-Host ""
|
||||
Write-Host "2. MYP-Anwendung neu starten" -ForegroundColor White
|
||||
Write-Host ""
|
||||
Write-Host "3. https://localhost:5000 aufrufen" -ForegroundColor White
|
||||
Write-Host ""
|
||||
Write-Host "4. Bei SSL-Warnung: 'Erweitert' → 'Weiter zu localhost (unsicher)'" -ForegroundColor White
|
||||
Write-Host ""
|
||||
Write-Host "💡 Der Fehler ERR_SSL_KEY_USAGE_INCOMPATIBLE sollte behoben sein!" -ForegroundColor Green
|
||||
Write-Host ""
|
||||
Write-Host "Zertifikat gespeichert in: ssl\cert.pem" -ForegroundColor Gray
|
||||
Write-Host "Private Key gespeichert in: ssl\key.pem" -ForegroundColor Gray
|
||||
Write-Host ""
|
||||
|
||||
} catch {
|
||||
Write-Host ""
|
||||
Write-Host "FEHLER: $_" -ForegroundColor Red
|
||||
Write-Host ""
|
||||
Write-Host "Mögliche Lösungen:" -ForegroundColor Yellow
|
||||
Write-Host "1. OpenSSL neu installieren und dem PATH hinzufügen" -ForegroundColor White
|
||||
Write-Host "2. PowerShell als Administrator ausführen" -ForegroundColor White
|
||||
Write-Host "3. Prüfe Schreibberechtigungen im ssl-Verzeichnis" -ForegroundColor White
|
||||
Write-Host ""
|
||||
}
|
||||
|
||||
Read-Host "Drücke Enter zum Beenden"
|
||||
175
backend/QUICK_SSL_FIX.md
Normal file
175
backend/QUICK_SSL_FIX.md
Normal file
@ -0,0 +1,175 @@
|
||||
# QUICK SSL FIX - ERR_SSL_KEY_USAGE_INCOMPATIBLE
|
||||
|
||||
## 🔧 Schnelle Lösung für Browser-SSL-Fehler
|
||||
|
||||
Der Fehler `ERR_SSL_KEY_USAGE_INCOMPATIBLE` tritt auf, weil die SSL-Zertifikat-Extensions nicht browser-kompatibel sind.
|
||||
|
||||
## ⚡ Sofort-Lösung
|
||||
|
||||
### Schritt 1: SSL-Verzeichnis vorbereiten
|
||||
```cmd
|
||||
cd backend
|
||||
mkdir ssl
|
||||
```
|
||||
|
||||
### Schritt 2: Erstelle OpenSSL-Konfiguration
|
||||
Erstelle eine Datei `ssl/openssl_fix.conf` mit folgendem Inhalt:
|
||||
|
||||
```ini
|
||||
[req]
|
||||
distinguished_name = req_distinguished_name
|
||||
req_extensions = v3_req
|
||||
prompt = no
|
||||
|
||||
[req_distinguished_name]
|
||||
C = DE
|
||||
ST = Baden-Wuerttemberg
|
||||
L = Stuttgart
|
||||
O = Mercedes-Benz AG
|
||||
OU = MYP Druckerverwaltung
|
||||
CN = m040tbaraspi001
|
||||
|
||||
[v3_req]
|
||||
basicConstraints = critical, CA:FALSE
|
||||
keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement
|
||||
extendedKeyUsage = critical, serverAuth, clientAuth
|
||||
subjectAltName = critical, @alt_names
|
||||
nsCertType = server
|
||||
|
||||
[alt_names]
|
||||
DNS.1 = localhost
|
||||
DNS.2 = *.localhost
|
||||
DNS.3 = m040tbaraspi001
|
||||
DNS.4 = m040tbaraspi001.local
|
||||
DNS.5 = m040tbaraspi001.de040.corpintra.net
|
||||
DNS.6 = *.de040.corpintra.net
|
||||
IP.1 = 127.0.0.1
|
||||
IP.2 = ::1
|
||||
IP.3 = 0.0.0.0
|
||||
```
|
||||
|
||||
### Schritt 3: Generiere neue Zertifikate (falls OpenSSL verfügbar)
|
||||
```cmd
|
||||
cd ssl
|
||||
|
||||
# Private Key generieren
|
||||
openssl genrsa -out key.pem 2048
|
||||
|
||||
# Browser-kompatibles Zertifikat erstellen
|
||||
openssl req -new -x509 -key key.pem -out cert.pem -days 365 -config openssl_fix.conf -extensions v3_req -sha256
|
||||
|
||||
# Aufräumen
|
||||
del openssl_fix.conf
|
||||
```
|
||||
|
||||
### Schritt 4: Validierung
|
||||
```cmd
|
||||
# Prüfe Zertifikat-Extensions
|
||||
openssl x509 -in cert.pem -noout -text | findstr "Digital Signature"
|
||||
openssl x509 -in cert.pem -noout -text | findstr "Key Encipherment"
|
||||
openssl x509 -in cert.pem -noout -text | findstr "TLS Web Server Authentication"
|
||||
```
|
||||
|
||||
## 🌐 Alternative: Vorgefertigte Zertifikate
|
||||
|
||||
Falls OpenSSL nicht verfügbar ist, erstelle die Dateien manuell:
|
||||
|
||||
### `ssl/cert.pem` (Browser-kompatibel):
|
||||
```
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDtzCCAp+gAwIBAgIUQxJ8K9B2C7VdF8G5H3K8N9M7P2QwDQYJKoZIhvcNAQEL
|
||||
BQAwazELMAkGA1UEBhMCREUxGzAZBgNVBAgMEkJhZGVuLVd1ZXJ0dGVtYmVyZzES
|
||||
MBAGA1UEBwwJU3R1dHRnYXJ0MRgwFgYDVQQKDA9NZXJjZWRlcy1CZW56IEFHMREw
|
||||
DwYDVQQLDAhNWVAgVGVhbTAeFw0yNTAxMTIwMDAwMDBaFw0yNjAxMTIwMDAwMDBa
|
||||
MGsxCzAJBgNVBAYTAkRFMRswGQYDVQQIDBJCYWRlbi1XdWVydHRlbWJlcmcxEjAQ
|
||||
BgNVBAcMCVN0dXR0Z2FydDEYMBYGA1UECgwPTWVyY2VkZXMtQmVueiBBRzERMA8G
|
||||
A1UECwwITVlQIFRlYW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7
|
||||
... (gekürzt für Übersicht) ...
|
||||
-----END CERTIFICATE-----
|
||||
```
|
||||
|
||||
### `ssl/key.pem` (Private Key):
|
||||
```
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEpAIBAAKCAQEAu3k5... (gekürzt für Sicherheit) ...
|
||||
-----END RSA PRIVATE KEY-----
|
||||
```
|
||||
|
||||
## 🔄 Nach der SSL-Reparatur
|
||||
|
||||
### 1. Browser-Cache vollständig leeren:
|
||||
- **Chrome/Edge**: Strg+Shift+Del → "Gesamte Zeit" → alle Optionen aktivieren
|
||||
- **Firefox**: Strg+Shift+Del → "Alles" auswählen
|
||||
|
||||
### 2. MYP-Anwendung neu starten
|
||||
```cmd
|
||||
# Stoppe laufende Instanzen
|
||||
taskkill /f /im python.exe
|
||||
|
||||
# Starte MYP neu
|
||||
python app.py
|
||||
```
|
||||
|
||||
### 3. Browser-Zugriff testen
|
||||
1. Öffne: `https://localhost:5000`
|
||||
2. Bei SSL-Warnung: **"Erweitert"** → **"Weiter zu localhost (unsicher)"**
|
||||
3. Der `ERR_SSL_KEY_USAGE_INCOMPATIBLE` Fehler sollte verschwunden sein
|
||||
|
||||
## 🚨 Fallback-Lösung
|
||||
|
||||
Falls SSL-Probleme weiterhin bestehen:
|
||||
|
||||
### HTTP-Modus verwenden:
|
||||
```cmd
|
||||
# Ändere in config.py:
|
||||
USE_HTTPS = False
|
||||
HOST = "0.0.0.0"
|
||||
PORT = 5000
|
||||
|
||||
# Zugriff über:
|
||||
http://localhost:5000
|
||||
```
|
||||
|
||||
### Browser-spezifische Lösungen:
|
||||
|
||||
#### Chrome/Edge:
|
||||
```
|
||||
chrome://flags/#allow-insecure-localhost
|
||||
→ "Enabled" setzen → Browser neu starten
|
||||
```
|
||||
|
||||
#### Firefox:
|
||||
```
|
||||
about:config
|
||||
→ security.tls.insecure_fallback_hosts
|
||||
→ localhost,m040tbaraspi001
|
||||
```
|
||||
|
||||
## 📊 Erfolg-Validierung
|
||||
|
||||
Nach dem Fix sollten folgende Zertifikat-Extensions vorhanden sein:
|
||||
- ✅ **basicConstraints**: CA:FALSE
|
||||
- ✅ **keyUsage**: Digital Signature, Key Encipherment, Key Agreement
|
||||
- ✅ **extendedKeyUsage**: TLS Web Server Authentication
|
||||
- ✅ **subjectAltName**: localhost, m040tbaraspi001, etc.
|
||||
|
||||
## 🔍 Debugging
|
||||
|
||||
Falls Probleme weiterhin bestehen:
|
||||
|
||||
### Zertifikat-Details anzeigen:
|
||||
```cmd
|
||||
openssl x509 -in ssl/cert.pem -noout -text
|
||||
```
|
||||
|
||||
### Verbindung testen:
|
||||
```cmd
|
||||
openssl s_client -connect localhost:5000 -servername localhost
|
||||
```
|
||||
|
||||
### Browser Developer Tools:
|
||||
- F12 → Security-Tab → Zertifikat-Details prüfen
|
||||
|
||||
---
|
||||
|
||||
**💡 Der ERR_SSL_KEY_USAGE_INCOMPATIBLE Fehler sollte nach diesen Schritten behoben sein!**
|
||||
@ -1 +1,131 @@
|
||||
|
||||
@echo off
|
||||
echo =========================================================
|
||||
echo MYP SSL BROWSER-KOMPATIBILITAETS-FIX
|
||||
echo Loest ERR_SSL_KEY_USAGE_INCOMPATIBLE Fehler
|
||||
echo =========================================================
|
||||
echo.
|
||||
|
||||
REM Pruefe ob SSL-Verzeichnis existiert
|
||||
if not exist "ssl" (
|
||||
echo Erstelle SSL-Verzeichnis...
|
||||
mkdir ssl
|
||||
)
|
||||
|
||||
REM Losche alte Zertifikate
|
||||
if exist "ssl\cert.pem" (
|
||||
echo Erstelle Backup der alten Zertifikate...
|
||||
if not exist "ssl\backup" mkdir ssl\backup
|
||||
copy "ssl\cert.pem" "ssl\backup\cert_backup_%date:~-4,4%%date:~-10,2%%date:~-7,2%.pem" >nul 2>&1
|
||||
copy "ssl\key.pem" "ssl\backup\key_backup_%date:~-4,4%%date:~-10,2%%date:~-7,2%.pem" >nul 2>&1
|
||||
echo Backup erstellt.
|
||||
)
|
||||
|
||||
REM Pruefe ob OpenSSL verfuegbar ist
|
||||
openssl version >nul 2>&1
|
||||
if errorlevel 1 (
|
||||
echo.
|
||||
echo FEHLER: OpenSSL ist nicht installiert oder nicht im PATH!
|
||||
echo.
|
||||
echo Bitte installiere OpenSSL:
|
||||
echo 1. Lade OpenSSL fuer Windows herunter: https://slproweb.com/products/Win32OpenSSL.html
|
||||
echo 2. Oder verwende das bestehende SSL-Modul mit Python
|
||||
echo.
|
||||
echo Alternative: Verwende das Python-basierte SSL-Fix Tool:
|
||||
echo python -c "from utils.ssl_config import ensure_ssl_certificates; ensure_ssl_certificates('.', True)"
|
||||
echo.
|
||||
pause
|
||||
exit /b 1
|
||||
)
|
||||
|
||||
echo OpenSSL gefunden. Generiere browser-kompatible SSL-Zertifikate...
|
||||
echo.
|
||||
|
||||
REM Erstelle browser-kompatible OpenSSL-Konfiguration
|
||||
echo [req] > ssl\openssl_browser_fix.conf
|
||||
echo distinguished_name = req_distinguished_name >> ssl\openssl_browser_fix.conf
|
||||
echo req_extensions = v3_req >> ssl\openssl_browser_fix.conf
|
||||
echo prompt = no >> ssl\openssl_browser_fix.conf
|
||||
echo. >> ssl\openssl_browser_fix.conf
|
||||
echo [req_distinguished_name] >> ssl\openssl_browser_fix.conf
|
||||
echo C = DE >> ssl\openssl_browser_fix.conf
|
||||
echo ST = Baden-Wuerttemberg >> ssl\openssl_browser_fix.conf
|
||||
echo L = Stuttgart >> ssl\openssl_browser_fix.conf
|
||||
echo O = Mercedes-Benz AG >> ssl\openssl_browser_fix.conf
|
||||
echo OU = MYP Druckerverwaltung >> ssl\openssl_browser_fix.conf
|
||||
echo CN = m040tbaraspi001 >> ssl\openssl_browser_fix.conf
|
||||
echo. >> ssl\openssl_browser_fix.conf
|
||||
echo [v3_req] >> ssl\openssl_browser_fix.conf
|
||||
echo basicConstraints = critical, CA:FALSE >> ssl\openssl_browser_fix.conf
|
||||
echo keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement >> ssl\openssl_browser_fix.conf
|
||||
echo extendedKeyUsage = critical, serverAuth, clientAuth >> ssl\openssl_browser_fix.conf
|
||||
echo subjectAltName = critical, @alt_names >> ssl\openssl_browser_fix.conf
|
||||
echo nsCertType = server >> ssl\openssl_browser_fix.conf
|
||||
echo nsComment = "MYP SSL Fix - ERR_SSL_KEY_USAGE_INCOMPATIBLE Loesung" >> ssl\openssl_browser_fix.conf
|
||||
echo. >> ssl\openssl_browser_fix.conf
|
||||
echo [alt_names] >> ssl\openssl_browser_fix.conf
|
||||
echo DNS.1 = localhost >> ssl\openssl_browser_fix.conf
|
||||
echo DNS.2 = *.localhost >> ssl\openssl_browser_fix.conf
|
||||
echo DNS.3 = m040tbaraspi001 >> ssl\openssl_browser_fix.conf
|
||||
echo DNS.4 = m040tbaraspi001.local >> ssl\openssl_browser_fix.conf
|
||||
echo DNS.5 = m040tbaraspi001.de040.corpintra.net >> ssl\openssl_browser_fix.conf
|
||||
echo DNS.6 = *.de040.corpintra.net >> ssl\openssl_browser_fix.conf
|
||||
echo IP.1 = 127.0.0.1 >> ssl\openssl_browser_fix.conf
|
||||
echo IP.2 = ::1 >> ssl\openssl_browser_fix.conf
|
||||
echo IP.3 = 0.0.0.0 >> ssl\openssl_browser_fix.conf
|
||||
|
||||
echo OpenSSL-Konfiguration erstellt.
|
||||
|
||||
REM Generiere Private Key
|
||||
echo Generiere Private Key (RSA 2048)...
|
||||
openssl genrsa -out ssl\key.pem 2048
|
||||
if errorlevel 1 (
|
||||
echo FEHLER: Private Key Generierung fehlgeschlagen!
|
||||
pause
|
||||
exit /b 1
|
||||
)
|
||||
echo Private Key generiert.
|
||||
|
||||
REM Generiere browser-kompatibles Zertifikat
|
||||
echo Generiere browser-kompatibles Zertifikat...
|
||||
openssl req -new -x509 -key ssl\key.pem -out ssl\cert.pem -days 365 -config ssl\openssl_browser_fix.conf -extensions v3_req -sha256
|
||||
if errorlevel 1 (
|
||||
echo FEHLER: Zertifikat-Generierung fehlgeschlagen!
|
||||
pause
|
||||
exit /b 1
|
||||
)
|
||||
echo Browser-kompatibles Zertifikat generiert.
|
||||
|
||||
REM Aufraumen
|
||||
del ssl\openssl_browser_fix.conf >nul 2>&1
|
||||
|
||||
REM Validierung
|
||||
echo.
|
||||
echo =========================================================
|
||||
echo BROWSER-KOMPATIBILITAETS-VALIDIERUNG
|
||||
echo =========================================================
|
||||
echo Pruefe Zertifikat-Extensions...
|
||||
openssl x509 -in ssl\cert.pem -noout -text | findstr /C:"Digital Signature" /C:"Key Encipherment" /C:"TLS Web Server Authentication" /C:"Subject Alternative Name" /C:"CA:FALSE"
|
||||
|
||||
echo.
|
||||
echo =========================================================
|
||||
echo SSL-FIX ERFOLGREICH ABGESCHLOSSEN!
|
||||
echo =========================================================
|
||||
echo.
|
||||
echo Naechste Schritte:
|
||||
echo 1. Browser-Cache vollstaendig leeren:
|
||||
echo - Chrome/Edge: Strg+Shift+Del, "Gesamte Zeit", alle Optionen
|
||||
echo - Firefox: Strg+Shift+Del, "Alles" auswaehlen
|
||||
echo.
|
||||
echo 2. MYP-Anwendung neu starten
|
||||
echo.
|
||||
echo 3. https://localhost:5000 aufrufen
|
||||
echo.
|
||||
echo 4. Bei SSL-Warnung: "Erweitert" - "Weiter zu localhost (unsicher)"
|
||||
echo.
|
||||
echo Der Fehler ERR_SSL_KEY_USAGE_INCOMPATIBLE sollte behoben sein!
|
||||
echo.
|
||||
echo Zertifikat gespeichert in: ssl\cert.pem
|
||||
echo Private Key gespeichert in: ssl\key.pem
|
||||
echo.
|
||||
|
||||
pause
|
||||
Reference in New Issue
Block a user