🎉 Hinzugefügt: Skript zur Generierung browser-kompatibler SSL-Zertifikate mit umfassender Fehlerbehandlung und Validierung. 🔒✨
This commit is contained in:
@@ -1 +1,480 @@
|
|||||||
|
# MYP Platform - Häufige Fehler und Lösungen
|
||||||
|
|
||||||
|
Dieses Dokument sammelt häufige Installations- und Konfigurationsfehler mit ihren bewährten Lösungen.
|
||||||
|
|
||||||
|
## 📦 Python-Paket-Installationsfehler
|
||||||
|
|
||||||
|
### Send2Trash Installation schlägt fehl
|
||||||
|
|
||||||
|
**Problem:**
|
||||||
|
```
|
||||||
|
ERROR: Failed building wheel for Send2Trash
|
||||||
|
error: Microsoft Visual C++ 14.0 is required
|
||||||
|
```
|
||||||
|
|
||||||
|
**Lösung:**
|
||||||
|
- Send2Trash wurde aus requirements.txt entfernt
|
||||||
|
- Native Alternative in `backend/utils/file_utils.py` implementiert
|
||||||
|
- Verwendet plattformspezifische Papierkorb-APIs:
|
||||||
|
- Windows: PowerShell + Visual Basic FileSystem
|
||||||
|
- Linux: gio/gvfs-trash/XDG-Standard
|
||||||
|
- macOS: osascript + Finder
|
||||||
|
|
||||||
|
**Code-Ersatz:**
|
||||||
|
```python
|
||||||
|
# Alt:
|
||||||
|
from send2trash import send2trash
|
||||||
|
send2trash(file_path)
|
||||||
|
|
||||||
|
# Neu:
|
||||||
|
from utils.file_utils import move_to_trash
|
||||||
|
move_to_trash(file_path)
|
||||||
|
```
|
||||||
|
|
||||||
|
### Python-magic-bin Windows-Fehler
|
||||||
|
|
||||||
|
**Problem:**
|
||||||
|
```
|
||||||
|
ERROR: Could not find a version that satisfies the requirement python-magic-bin
|
||||||
|
```
|
||||||
|
|
||||||
|
**Lösung:**
|
||||||
|
- Paket ist Windows-spezifisch und wird automatisch übersprungen auf Linux
|
||||||
|
- Setup-Skript erstellt bereinigte requirements.txt ohne problematische Pakete
|
||||||
|
- Plattformspezifische Conditional-Installation: `; sys_platform == "win32"`
|
||||||
|
|
||||||
|
### RPi.GPIO auf Non-Raspberry Pi
|
||||||
|
|
||||||
|
**Problem:**
|
||||||
|
```
|
||||||
|
RuntimeError: This module can only be run on a Raspberry Pi!
|
||||||
|
```
|
||||||
|
|
||||||
|
**Lösung:**
|
||||||
|
- Conditional-Installation: `RPi.GPIO; sys_platform == "linux"`
|
||||||
|
- Wird automatisch übersprungen wenn nicht auf Raspberry Pi
|
||||||
|
- Fallback-Hardware-Detection in Hardware-Modulen
|
||||||
|
|
||||||
|
## 🔧 Systemkonfigurationsfehler
|
||||||
|
|
||||||
|
### Hostname-Änderung schlägt fehl
|
||||||
|
|
||||||
|
**Problem:**
|
||||||
|
```
|
||||||
|
hostnamectl: command not found
|
||||||
|
/etc/hostname: Permission denied
|
||||||
|
```
|
||||||
|
|
||||||
|
**Lösung:**
|
||||||
|
```bash
|
||||||
|
# Prüfe systemd-Verfügbarkeit
|
||||||
|
if command -v hostnamectl >/dev/null 2>&1; then
|
||||||
|
sudo hostnamectl set-hostname m040tbaraspi001
|
||||||
|
else
|
||||||
|
# Fallback für ältere Systeme
|
||||||
|
echo "m040tbaraspi001" | sudo tee /etc/hostname
|
||||||
|
sudo hostname m040tbaraspi001
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Hosts-Datei aktualisieren
|
||||||
|
sudo sed -i 's/127.0.1.1.*/127.0.1.1\tm040tbaraspi001/' /etc/hosts
|
||||||
|
```
|
||||||
|
|
||||||
|
### SSL-Zertifikat-Generierung schlägt fehl
|
||||||
|
|
||||||
|
**Problem:**
|
||||||
|
```
|
||||||
|
openssl: command not found
|
||||||
|
Permission denied: /opt/myp/ssl/
|
||||||
|
```
|
||||||
|
|
||||||
|
**Lösung:**
|
||||||
|
```bash
|
||||||
|
# OpenSSL installieren
|
||||||
|
sudo apt update && sudo apt install -y openssl
|
||||||
|
|
||||||
|
# Verzeichnis mit korrekten Berechtigungen erstellen
|
||||||
|
sudo mkdir -p /opt/myp/ssl
|
||||||
|
sudo chown -R $USER:$USER /opt/myp/ssl
|
||||||
|
sudo chmod 755 /opt/myp/ssl
|
||||||
|
|
||||||
|
# Self-signed Zertifikat generieren
|
||||||
|
openssl req -x509 -newkey rsa:4096 -keyout /opt/myp/ssl/key.pem \
|
||||||
|
-out /opt/myp/ssl/cert.pem -days 365 -nodes \
|
||||||
|
-subj "/C=DE/ST=NRW/L=Duesseldorf/O=Mercedes-Benz/CN=m040tbaraspi001"
|
||||||
|
```
|
||||||
|
|
||||||
|
### Systemd-Service Installation schlägt fehl
|
||||||
|
|
||||||
|
**Problem:**
|
||||||
|
```
|
||||||
|
Failed to enable unit: Unit file does not exist
|
||||||
|
systemctl: command not found
|
||||||
|
```
|
||||||
|
|
||||||
|
**Lösung:**
|
||||||
|
```bash
|
||||||
|
# Prüfe systemd-Verfügbarkeit
|
||||||
|
if ! command -v systemctl >/dev/null 2>&1; then
|
||||||
|
echo "systemd nicht verfügbar - verwende alternatives Init-System"
|
||||||
|
# Fallback auf SysV init oder manuelle Autostart-Einrichtung
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Service-Datei kopieren und aktivieren
|
||||||
|
sudo cp myp-*.service /etc/systemd/system/
|
||||||
|
sudo systemctl daemon-reload
|
||||||
|
sudo systemctl enable myp-app.service
|
||||||
|
sudo systemctl enable myp-kiosk.service
|
||||||
|
```
|
||||||
|
|
||||||
|
## 🌐 Netzwerkkonfigurationsfehler
|
||||||
|
|
||||||
|
### Firewall blockiert Zugriff
|
||||||
|
|
||||||
|
**Problem:**
|
||||||
|
```
|
||||||
|
Connection refused: https://m040tbaraspi001.de040.corpintra.net:443
|
||||||
|
curl: (7) Failed to connect
|
||||||
|
```
|
||||||
|
|
||||||
|
**Lösung:**
|
||||||
|
```bash
|
||||||
|
# UFW-Firewall konfigurieren
|
||||||
|
sudo ufw allow 22/tcp # SSH
|
||||||
|
sudo ufw allow 80/tcp # HTTP
|
||||||
|
sudo ufw allow 443/tcp # HTTPS
|
||||||
|
sudo ufw allow 5000/tcp # Flask Development
|
||||||
|
sudo ufw --force enable
|
||||||
|
|
||||||
|
# iptables direkt (falls UFW nicht verfügbar)
|
||||||
|
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT
|
||||||
|
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
|
||||||
|
sudo iptables-save | sudo tee /etc/iptables/rules.v4
|
||||||
|
```
|
||||||
|
|
||||||
|
### DNS-Auflösung schlägt fehl
|
||||||
|
|
||||||
|
**Problem:**
|
||||||
|
```
|
||||||
|
nslookup: can't resolve 'm040tbaraspi001.de040.corpintra.net'
|
||||||
|
ping: unknown host
|
||||||
|
```
|
||||||
|
|
||||||
|
**Lösung:**
|
||||||
|
```bash
|
||||||
|
# Lokale hosts-Datei erweitern
|
||||||
|
echo "127.0.0.1 m040tbaraspi001.local" | sudo tee -a /etc/hosts
|
||||||
|
echo "127.0.0.1 m040tbaraspi001.de040.corpintra.net" | sudo tee -a /etc/hosts
|
||||||
|
|
||||||
|
# DNS-Server prüfen und setzen
|
||||||
|
echo "nameserver 8.8.8.8" | sudo tee -a /etc/resolv.conf
|
||||||
|
echo "nameserver 8.8.4.4" | sudo tee -a /etc/resolv.conf
|
||||||
|
|
||||||
|
# NetworkManager DNS (Ubuntu/Debian)
|
||||||
|
sudo systemctl restart NetworkManager
|
||||||
|
```
|
||||||
|
|
||||||
|
## 🖥️ Desktop- und Kiosk-Fehler
|
||||||
|
|
||||||
|
### Chromium startet nicht im Kiosk-Modus
|
||||||
|
|
||||||
|
**Problem:**
|
||||||
|
```
|
||||||
|
chromium-browser: command not found
|
||||||
|
[ERROR:gpu_init.cc] GPU initialization failed
|
||||||
|
```
|
||||||
|
|
||||||
|
**Lösung:**
|
||||||
|
```bash
|
||||||
|
# Chromium installieren
|
||||||
|
sudo apt update && sudo apt install -y chromium-browser
|
||||||
|
|
||||||
|
# GPU-Acceleration deaktivieren für Headless-Systeme
|
||||||
|
chromium-browser --no-sandbox --disable-gpu --disable-software-rasterizer \
|
||||||
|
--disable-background-timer-throttling --disable-renderer-backgrounding \
|
||||||
|
--disable-backgrounding-occluded-windows --kiosk "$URL"
|
||||||
|
|
||||||
|
# Fallback auf andere Browser
|
||||||
|
if ! command -v chromium-browser >/dev/null 2>&1; then
|
||||||
|
if command -v firefox >/dev/null 2>&1; then
|
||||||
|
firefox --kiosk "$URL"
|
||||||
|
elif command -v google-chrome >/dev/null 2>&1; then
|
||||||
|
google-chrome --kiosk --no-sandbox "$URL"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
```
|
||||||
|
|
||||||
|
### Desktop-Verknüpfung wird nicht angezeigt
|
||||||
|
|
||||||
|
**Problem:**
|
||||||
|
```
|
||||||
|
.desktop file created but not visible
|
||||||
|
Icon not displayed
|
||||||
|
```
|
||||||
|
|
||||||
|
**Lösung:**
|
||||||
|
```bash
|
||||||
|
# Desktop-Datei ausführbar machen
|
||||||
|
chmod +x ~/Desktop/myp-kiosk.desktop
|
||||||
|
|
||||||
|
# Icon kopieren
|
||||||
|
sudo cp backend/static/mercedes.svg /usr/share/pixmaps/myp-mercedes.svg
|
||||||
|
sudo chmod 644 /usr/share/pixmaps/myp-mercedes.svg
|
||||||
|
|
||||||
|
# Desktop-Datenbank aktualisieren
|
||||||
|
update-desktop-database ~/.local/share/applications/
|
||||||
|
xdg-desktop-menu forceupdate
|
||||||
|
|
||||||
|
# Gnome: Trusted Application markieren
|
||||||
|
dconf write /org/gnome/desktop/interface/enable-animations false
|
||||||
|
```
|
||||||
|
|
||||||
|
## 📊 Datenbank- und Persistenzfehler
|
||||||
|
|
||||||
|
### SQLite-Datenbank Berechtigungsfehler
|
||||||
|
|
||||||
|
**Problem:**
|
||||||
|
```
|
||||||
|
sqlite3.OperationalError: attempt to write a readonly database
|
||||||
|
PermissionError: [Errno 13] Permission denied: 'instance/myp.db'
|
||||||
|
```
|
||||||
|
|
||||||
|
**Lösung:**
|
||||||
|
```bash
|
||||||
|
# Verzeichnis und Datei-Berechtigungen korrigieren
|
||||||
|
sudo chown -R $USER:$USER /opt/myp/instance/
|
||||||
|
chmod 755 /opt/myp/instance/
|
||||||
|
chmod 644 /opt/myp/instance/*.db
|
||||||
|
|
||||||
|
# Backup-Verzeichnis mit Schreibrechten
|
||||||
|
mkdir -p /opt/myp/instance/backups
|
||||||
|
chmod 755 /opt/myp/instance/backups
|
||||||
|
```
|
||||||
|
|
||||||
|
### Backup-Prozess schlägt fehl
|
||||||
|
|
||||||
|
**Problem:**
|
||||||
|
```
|
||||||
|
rsync: command not found
|
||||||
|
tar: cannot create backup
|
||||||
|
disk full
|
||||||
|
```
|
||||||
|
|
||||||
|
**Lösung:**
|
||||||
|
```bash
|
||||||
|
# Notwendige Tools installieren
|
||||||
|
sudo apt install -y rsync tar gzip
|
||||||
|
|
||||||
|
# Speicherplatz prüfen
|
||||||
|
df -h /opt/myp/
|
||||||
|
|
||||||
|
# Alte Backups aufräumen (älter als 30 Tage)
|
||||||
|
find /opt/myp/instance/backups -name "*.tar.gz" -mtime +30 -delete
|
||||||
|
|
||||||
|
# Komprimierte Backups
|
||||||
|
tar -czf backup_$(date +%Y%m%d_%H%M%S).tar.gz instance/
|
||||||
|
```
|
||||||
|
|
||||||
|
## 🔐 Sicherheits- und Authentifizierungsfehler
|
||||||
|
|
||||||
|
### JWT-Token-Validierung schlägt fehl
|
||||||
|
|
||||||
|
**Problem:**
|
||||||
|
```
|
||||||
|
jwt.DecodeError: Invalid token
|
||||||
|
SECRET_KEY not set
|
||||||
|
```
|
||||||
|
|
||||||
|
**Lösung:**
|
||||||
|
```python
|
||||||
|
# In config.py sicherstellen:
|
||||||
|
import secrets
|
||||||
|
SECRET_KEY = secrets.token_urlsafe(32)
|
||||||
|
|
||||||
|
# Oder aus Umgebungsvariable:
|
||||||
|
SECRET_KEY = os.environ.get('SECRET_KEY') or secrets.token_urlsafe(32)
|
||||||
|
|
||||||
|
# Token-Expiration prüfen:
|
||||||
|
JWT_ACCESS_TOKEN_EXPIRES = timedelta(hours=24)
|
||||||
|
```
|
||||||
|
|
||||||
|
### SSL Browser-Kompatibilitätsfehler (ERR_SSL_KEY_USAGE_INCOMPATIBLE)
|
||||||
|
|
||||||
|
**Problem:**
|
||||||
|
```
|
||||||
|
ERR_SSL_KEY_USAGE_INCOMPATIBLE
|
||||||
|
This site can't provide a secure connection
|
||||||
|
SSL certificate key usage incompatible
|
||||||
|
```
|
||||||
|
|
||||||
|
**Lösung:**
|
||||||
|
```bash
|
||||||
|
# Schnell-Fix mit dediziertem Tool
|
||||||
|
cd backend
|
||||||
|
python3 ssl_fix.py
|
||||||
|
|
||||||
|
# Oder manuell neue browser-kompatible Zertifikate generieren:
|
||||||
|
cd backend/ssl
|
||||||
|
openssl genrsa -out key.pem 2048
|
||||||
|
|
||||||
|
# Erstelle OpenSSL-Konfiguration mit korrekten Extensions
|
||||||
|
cat > ssl_fix.conf << 'EOF'
|
||||||
|
[req]
|
||||||
|
distinguished_name = req_distinguished_name
|
||||||
|
req_extensions = v3_req
|
||||||
|
prompt = no
|
||||||
|
|
||||||
|
[req_distinguished_name]
|
||||||
|
C = DE
|
||||||
|
ST = Baden-Wuerttemberg
|
||||||
|
L = Stuttgart
|
||||||
|
O = Mercedes-Benz AG
|
||||||
|
OU = MYP Druckerverwaltung
|
||||||
|
CN = m040tbaraspi001
|
||||||
|
|
||||||
|
[v3_req]
|
||||||
|
basicConstraints = critical, CA:FALSE
|
||||||
|
keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement
|
||||||
|
extendedKeyUsage = critical, serverAuth, clientAuth
|
||||||
|
subjectAltName = critical, @alt_names
|
||||||
|
nsCertType = server
|
||||||
|
|
||||||
|
[alt_names]
|
||||||
|
DNS.1 = localhost
|
||||||
|
DNS.2 = m040tbaraspi001
|
||||||
|
DNS.3 = m040tbaraspi001.de040.corpintra.net
|
||||||
|
IP.1 = 127.0.0.1
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# Generiere browser-kompatibles Zertifikat
|
||||||
|
openssl req -new -x509 -key key.pem -out cert.pem -days 365 \
|
||||||
|
-config ssl_fix.conf -extensions v3_req -sha256
|
||||||
|
|
||||||
|
# Validiere Extensions
|
||||||
|
openssl x509 -in cert.pem -noout -text | grep -A5 "Key Usage"
|
||||||
|
|
||||||
|
# Danach: Browser-Cache leeren und MYP neu starten
|
||||||
|
```
|
||||||
|
|
||||||
|
### HTTPS-Redirect-Loop
|
||||||
|
|
||||||
|
**Problem:**
|
||||||
|
```
|
||||||
|
ERR_TOO_MANY_REDIRECTS
|
||||||
|
Infinite redirect between http and https
|
||||||
|
```
|
||||||
|
|
||||||
|
**Lösung:**
|
||||||
|
```python
|
||||||
|
# In Flask-App prüfen:
|
||||||
|
from flask_talisman import Talisman
|
||||||
|
|
||||||
|
# Nur HTTPS forcieren wenn Zertifikat verfügbar
|
||||||
|
if os.path.exists('/opt/myp/ssl/cert.pem'):
|
||||||
|
Talisman(app, force_https=True)
|
||||||
|
else:
|
||||||
|
# Development: HTTP erlauben
|
||||||
|
Talisman(app, force_https=False)
|
||||||
|
```
|
||||||
|
|
||||||
|
## 📝 Log-Dateien zur Fehlerdiagnose
|
||||||
|
|
||||||
|
### Wichtige Log-Standorte:
|
||||||
|
```bash
|
||||||
|
# MYP Application Logs
|
||||||
|
/opt/myp/logs/app/app.log
|
||||||
|
/opt/myp/logs/errors/error.log
|
||||||
|
|
||||||
|
# Systemd Service Logs
|
||||||
|
journalctl -u myp-app.service -f
|
||||||
|
journalctl -u myp-kiosk.service -f
|
||||||
|
|
||||||
|
# System-Logs
|
||||||
|
/var/log/syslog
|
||||||
|
/var/log/nginx/error.log # Falls Nginx verwendet wird
|
||||||
|
```
|
||||||
|
|
||||||
|
### Log-Analyse-Befehle:
|
||||||
|
```bash
|
||||||
|
# Letzte 50 Fehler
|
||||||
|
tail -50 /opt/myp/logs/errors/error.log | grep ERROR
|
||||||
|
|
||||||
|
# Live-Monitoring
|
||||||
|
tail -f /opt/myp/logs/app/app.log
|
||||||
|
|
||||||
|
# Fehler der letzten Stunde
|
||||||
|
journalctl -u myp-app.service --since "1 hour ago" | grep ERROR
|
||||||
|
```
|
||||||
|
|
||||||
|
## 🛠️ Debugging-Tools
|
||||||
|
|
||||||
|
### System-Informationen sammeln:
|
||||||
|
```bash
|
||||||
|
# System-Overview
|
||||||
|
uname -a
|
||||||
|
lsb_release -a
|
||||||
|
python3 --version
|
||||||
|
pip3 list | grep -E "(Flask|requests)"
|
||||||
|
|
||||||
|
# Netzwerk-Status
|
||||||
|
ip addr show
|
||||||
|
ss -tulpn | grep :443
|
||||||
|
curl -I http://localhost:5000/health
|
||||||
|
|
||||||
|
# Prozess-Status
|
||||||
|
ps aux | grep -E "(python|myp)"
|
||||||
|
systemctl status myp-*
|
||||||
|
```
|
||||||
|
|
||||||
|
### Performance-Monitoring:
|
||||||
|
```bash
|
||||||
|
# CPU und Memory
|
||||||
|
top -p $(pgrep -f "python.*myp")
|
||||||
|
htop
|
||||||
|
|
||||||
|
# Disk I/O
|
||||||
|
iotop
|
||||||
|
df -h /opt/myp/
|
||||||
|
|
||||||
|
# Network
|
||||||
|
iftop
|
||||||
|
netstat -i
|
||||||
|
```
|
||||||
|
|
||||||
|
## 📋 Vorbeugende Maßnahmen
|
||||||
|
|
||||||
|
### Regelmäßige Wartung:
|
||||||
|
```bash
|
||||||
|
# System-Updates
|
||||||
|
sudo apt update && sudo apt upgrade -y
|
||||||
|
|
||||||
|
# Python-Pakete aktualisieren
|
||||||
|
pip3 list --outdated
|
||||||
|
python3 -m pip install --upgrade pip
|
||||||
|
|
||||||
|
# Log-Rotation einrichten
|
||||||
|
sudo logrotate -f /etc/logrotate.conf
|
||||||
|
|
||||||
|
# Disk-Cleanup
|
||||||
|
sudo apt autoremove -y
|
||||||
|
sudo apt autoclean
|
||||||
|
```
|
||||||
|
|
||||||
|
### Monitoring-Setup:
|
||||||
|
```bash
|
||||||
|
# Cron-Job für Health-Check (alle 5 Minuten)
|
||||||
|
echo "*/5 * * * * curl -f http://localhost:5000/health || systemctl restart myp-app.service" | crontab -
|
||||||
|
|
||||||
|
# Log-Size monitoring
|
||||||
|
echo "0 2 * * * find /opt/myp/logs -name '*.log' -size +100M -exec truncate -s 50M {} \;" | crontab -
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
**💡 Tipp:** Vor jeder größeren Änderung ein vollständiges Backup erstellen:
|
||||||
|
```bash
|
||||||
|
sudo tar -czf /tmp/myp_backup_$(date +%Y%m%d_%H%M%S).tar.gz /opt/myp/
|
||||||
|
```
|
||||||
|
|
||||||
|
**📞 Support:** Bei ungelösten Problemen alle relevanten Logs und die Ausgabe der Debugging-Tools sammeln.
|
||||||
165
backend/Fix-SSL-Browser.ps1
Normal file
165
backend/Fix-SSL-Browser.ps1
Normal file
@@ -0,0 +1,165 @@
|
|||||||
|
# MYP SSL Browser-Kompatibilitäts-Fix
|
||||||
|
# Löst ERR_SSL_KEY_USAGE_INCOMPATIBLE Fehler
|
||||||
|
|
||||||
|
Write-Host "=========================================================" -ForegroundColor Cyan
|
||||||
|
Write-Host "MYP SSL BROWSER-KOMPATIBILITÄTS-FIX" -ForegroundColor Cyan
|
||||||
|
Write-Host "Löst ERR_SSL_KEY_USAGE_INCOMPATIBLE Fehler" -ForegroundColor Cyan
|
||||||
|
Write-Host "=========================================================" -ForegroundColor Cyan
|
||||||
|
Write-Host ""
|
||||||
|
|
||||||
|
# Prüfe ob SSL-Verzeichnis existiert
|
||||||
|
if (!(Test-Path "ssl")) {
|
||||||
|
Write-Host "Erstelle SSL-Verzeichnis..." -ForegroundColor Yellow
|
||||||
|
New-Item -ItemType Directory -Path "ssl" | Out-Null
|
||||||
|
}
|
||||||
|
|
||||||
|
# Backup existierender Zertifikate
|
||||||
|
if (Test-Path "ssl\cert.pem") {
|
||||||
|
Write-Host "Erstelle Backup der alten Zertifikate..." -ForegroundColor Yellow
|
||||||
|
if (!(Test-Path "ssl\backup")) {
|
||||||
|
New-Item -ItemType Directory -Path "ssl\backup" | Out-Null
|
||||||
|
}
|
||||||
|
$timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
|
||||||
|
Copy-Item "ssl\cert.pem" "ssl\backup\cert_backup_$timestamp.pem" -ErrorAction SilentlyContinue
|
||||||
|
Copy-Item "ssl\key.pem" "ssl\backup\key_backup_$timestamp.pem" -ErrorAction SilentlyContinue
|
||||||
|
Write-Host "Backup erstellt." -ForegroundColor Green
|
||||||
|
}
|
||||||
|
|
||||||
|
# Prüfe ob OpenSSL verfügbar ist
|
||||||
|
try {
|
||||||
|
$null = & openssl version 2>$null
|
||||||
|
Write-Host "OpenSSL gefunden. Generiere browser-kompatible SSL-Zertifikate..." -ForegroundColor Green
|
||||||
|
Write-Host ""
|
||||||
|
}
|
||||||
|
catch {
|
||||||
|
Write-Host ""
|
||||||
|
Write-Host "FEHLER: OpenSSL ist nicht installiert oder nicht im PATH!" -ForegroundColor Red
|
||||||
|
Write-Host ""
|
||||||
|
Write-Host "Bitte installiere OpenSSL:" -ForegroundColor Yellow
|
||||||
|
Write-Host "1. Lade OpenSSL für Windows herunter: https://slproweb.com/products/Win32OpenSSL.html" -ForegroundColor White
|
||||||
|
Write-Host "2. Oder verwende das bestehende SSL-Modul mit Python" -ForegroundColor White
|
||||||
|
Write-Host ""
|
||||||
|
Write-Host "Alternative: Manueller Fix mit vorbereiteten Zertifikaten..." -ForegroundColor Yellow
|
||||||
|
Write-Host ""
|
||||||
|
Read-Host "Drücke Enter zum Beenden"
|
||||||
|
exit 1
|
||||||
|
}
|
||||||
|
|
||||||
|
# Erstelle browser-kompatible OpenSSL-Konfiguration
|
||||||
|
$openssl_config = @"
|
||||||
|
[req]
|
||||||
|
distinguished_name = req_distinguished_name
|
||||||
|
req_extensions = v3_req
|
||||||
|
prompt = no
|
||||||
|
|
||||||
|
[req_distinguished_name]
|
||||||
|
C = DE
|
||||||
|
ST = Baden-Wuerttemberg
|
||||||
|
L = Stuttgart
|
||||||
|
O = Mercedes-Benz AG
|
||||||
|
OU = MYP Druckerverwaltung
|
||||||
|
CN = m040tbaraspi001
|
||||||
|
|
||||||
|
[v3_req]
|
||||||
|
basicConstraints = critical, CA:FALSE
|
||||||
|
keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement
|
||||||
|
extendedKeyUsage = critical, serverAuth, clientAuth
|
||||||
|
subjectAltName = critical, @alt_names
|
||||||
|
nsCertType = server
|
||||||
|
nsComment = "MYP SSL Fix - ERR_SSL_KEY_USAGE_INCOMPATIBLE Lösung"
|
||||||
|
|
||||||
|
[alt_names]
|
||||||
|
DNS.1 = localhost
|
||||||
|
DNS.2 = *.localhost
|
||||||
|
DNS.3 = m040tbaraspi001
|
||||||
|
DNS.4 = m040tbaraspi001.local
|
||||||
|
DNS.5 = m040tbaraspi001.de040.corpintra.net
|
||||||
|
DNS.6 = *.de040.corpintra.net
|
||||||
|
IP.1 = 127.0.0.1
|
||||||
|
IP.2 = ::1
|
||||||
|
IP.3 = 0.0.0.0
|
||||||
|
"@
|
||||||
|
|
||||||
|
# Schreibe OpenSSL-Konfiguration
|
||||||
|
$openssl_config | Out-File -FilePath "ssl\openssl_browser_fix.conf" -Encoding UTF8
|
||||||
|
Write-Host "OpenSSL-Konfiguration erstellt." -ForegroundColor Green
|
||||||
|
|
||||||
|
try {
|
||||||
|
# Generiere Private Key
|
||||||
|
Write-Host "Generiere Private Key (RSA 2048)..." -ForegroundColor Yellow
|
||||||
|
& openssl genrsa -out "ssl\key.pem" 2048 2>$null
|
||||||
|
if ($LASTEXITCODE -ne 0) {
|
||||||
|
throw "Private Key Generierung fehlgeschlagen!"
|
||||||
|
}
|
||||||
|
Write-Host "Private Key generiert." -ForegroundColor Green
|
||||||
|
|
||||||
|
# Generiere browser-kompatibles Zertifikat
|
||||||
|
Write-Host "Generiere browser-kompatibles Zertifikat..." -ForegroundColor Yellow
|
||||||
|
& openssl req -new -x509 -key "ssl\key.pem" -out "ssl\cert.pem" -days 365 -config "ssl\openssl_browser_fix.conf" -extensions v3_req -sha256 2>$null
|
||||||
|
if ($LASTEXITCODE -ne 0) {
|
||||||
|
throw "Zertifikat-Generierung fehlgeschlagen!"
|
||||||
|
}
|
||||||
|
Write-Host "Browser-kompatibles Zertifikat generiert." -ForegroundColor Green
|
||||||
|
|
||||||
|
# Aufräumen
|
||||||
|
Remove-Item "ssl\openssl_browser_fix.conf" -ErrorAction SilentlyContinue
|
||||||
|
|
||||||
|
# Validierung
|
||||||
|
Write-Host ""
|
||||||
|
Write-Host "=========================================================" -ForegroundColor Cyan
|
||||||
|
Write-Host "BROWSER-KOMPATIBILITÄTS-VALIDIERUNG" -ForegroundColor Cyan
|
||||||
|
Write-Host "=========================================================" -ForegroundColor Cyan
|
||||||
|
Write-Host "Prüfe Zertifikat-Extensions..." -ForegroundColor Yellow
|
||||||
|
|
||||||
|
$cert_info = & openssl x509 -in "ssl\cert.pem" -noout -text 2>$null
|
||||||
|
|
||||||
|
$checks = @(
|
||||||
|
@{ Name = "Digital Signature"; Pattern = "Digital Signature" },
|
||||||
|
@{ Name = "Key Encipherment"; Pattern = "Key Encipherment" },
|
||||||
|
@{ Name = "TLS Web Server Authentication"; Pattern = "TLS Web Server Authentication" },
|
||||||
|
@{ Name = "Subject Alternative Name"; Pattern = "Subject Alternative Name" },
|
||||||
|
@{ Name = "CA:FALSE"; Pattern = "CA:FALSE" }
|
||||||
|
)
|
||||||
|
|
||||||
|
foreach ($check in $checks) {
|
||||||
|
if ($cert_info -match $check.Pattern) {
|
||||||
|
Write-Host "✅ $($check.Name)" -ForegroundColor Green
|
||||||
|
} else {
|
||||||
|
Write-Host "❌ $($check.Name)" -ForegroundColor Red
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
Write-Host ""
|
||||||
|
Write-Host "=========================================================" -ForegroundColor Green
|
||||||
|
Write-Host "SSL-FIX ERFOLGREICH ABGESCHLOSSEN!" -ForegroundColor Green
|
||||||
|
Write-Host "=========================================================" -ForegroundColor Green
|
||||||
|
Write-Host ""
|
||||||
|
Write-Host "Nächste Schritte:" -ForegroundColor Cyan
|
||||||
|
Write-Host "1. Browser-Cache vollständig leeren:" -ForegroundColor White
|
||||||
|
Write-Host " - Chrome/Edge: Strg+Shift+Del, 'Gesamte Zeit', alle Optionen" -ForegroundColor Gray
|
||||||
|
Write-Host " - Firefox: Strg+Shift+Del, 'Alles' auswählen" -ForegroundColor Gray
|
||||||
|
Write-Host ""
|
||||||
|
Write-Host "2. MYP-Anwendung neu starten" -ForegroundColor White
|
||||||
|
Write-Host ""
|
||||||
|
Write-Host "3. https://localhost:5000 aufrufen" -ForegroundColor White
|
||||||
|
Write-Host ""
|
||||||
|
Write-Host "4. Bei SSL-Warnung: 'Erweitert' → 'Weiter zu localhost (unsicher)'" -ForegroundColor White
|
||||||
|
Write-Host ""
|
||||||
|
Write-Host "💡 Der Fehler ERR_SSL_KEY_USAGE_INCOMPATIBLE sollte behoben sein!" -ForegroundColor Green
|
||||||
|
Write-Host ""
|
||||||
|
Write-Host "Zertifikat gespeichert in: ssl\cert.pem" -ForegroundColor Gray
|
||||||
|
Write-Host "Private Key gespeichert in: ssl\key.pem" -ForegroundColor Gray
|
||||||
|
Write-Host ""
|
||||||
|
|
||||||
|
} catch {
|
||||||
|
Write-Host ""
|
||||||
|
Write-Host "FEHLER: $_" -ForegroundColor Red
|
||||||
|
Write-Host ""
|
||||||
|
Write-Host "Mögliche Lösungen:" -ForegroundColor Yellow
|
||||||
|
Write-Host "1. OpenSSL neu installieren und dem PATH hinzufügen" -ForegroundColor White
|
||||||
|
Write-Host "2. PowerShell als Administrator ausführen" -ForegroundColor White
|
||||||
|
Write-Host "3. Prüfe Schreibberechtigungen im ssl-Verzeichnis" -ForegroundColor White
|
||||||
|
Write-Host ""
|
||||||
|
}
|
||||||
|
|
||||||
|
Read-Host "Drücke Enter zum Beenden"
|
||||||
175
backend/QUICK_SSL_FIX.md
Normal file
175
backend/QUICK_SSL_FIX.md
Normal file
@@ -0,0 +1,175 @@
|
|||||||
|
# QUICK SSL FIX - ERR_SSL_KEY_USAGE_INCOMPATIBLE
|
||||||
|
|
||||||
|
## 🔧 Schnelle Lösung für Browser-SSL-Fehler
|
||||||
|
|
||||||
|
Der Fehler `ERR_SSL_KEY_USAGE_INCOMPATIBLE` tritt auf, weil die SSL-Zertifikat-Extensions nicht browser-kompatibel sind.
|
||||||
|
|
||||||
|
## ⚡ Sofort-Lösung
|
||||||
|
|
||||||
|
### Schritt 1: SSL-Verzeichnis vorbereiten
|
||||||
|
```cmd
|
||||||
|
cd backend
|
||||||
|
mkdir ssl
|
||||||
|
```
|
||||||
|
|
||||||
|
### Schritt 2: Erstelle OpenSSL-Konfiguration
|
||||||
|
Erstelle eine Datei `ssl/openssl_fix.conf` mit folgendem Inhalt:
|
||||||
|
|
||||||
|
```ini
|
||||||
|
[req]
|
||||||
|
distinguished_name = req_distinguished_name
|
||||||
|
req_extensions = v3_req
|
||||||
|
prompt = no
|
||||||
|
|
||||||
|
[req_distinguished_name]
|
||||||
|
C = DE
|
||||||
|
ST = Baden-Wuerttemberg
|
||||||
|
L = Stuttgart
|
||||||
|
O = Mercedes-Benz AG
|
||||||
|
OU = MYP Druckerverwaltung
|
||||||
|
CN = m040tbaraspi001
|
||||||
|
|
||||||
|
[v3_req]
|
||||||
|
basicConstraints = critical, CA:FALSE
|
||||||
|
keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement
|
||||||
|
extendedKeyUsage = critical, serverAuth, clientAuth
|
||||||
|
subjectAltName = critical, @alt_names
|
||||||
|
nsCertType = server
|
||||||
|
|
||||||
|
[alt_names]
|
||||||
|
DNS.1 = localhost
|
||||||
|
DNS.2 = *.localhost
|
||||||
|
DNS.3 = m040tbaraspi001
|
||||||
|
DNS.4 = m040tbaraspi001.local
|
||||||
|
DNS.5 = m040tbaraspi001.de040.corpintra.net
|
||||||
|
DNS.6 = *.de040.corpintra.net
|
||||||
|
IP.1 = 127.0.0.1
|
||||||
|
IP.2 = ::1
|
||||||
|
IP.3 = 0.0.0.0
|
||||||
|
```
|
||||||
|
|
||||||
|
### Schritt 3: Generiere neue Zertifikate (falls OpenSSL verfügbar)
|
||||||
|
```cmd
|
||||||
|
cd ssl
|
||||||
|
|
||||||
|
# Private Key generieren
|
||||||
|
openssl genrsa -out key.pem 2048
|
||||||
|
|
||||||
|
# Browser-kompatibles Zertifikat erstellen
|
||||||
|
openssl req -new -x509 -key key.pem -out cert.pem -days 365 -config openssl_fix.conf -extensions v3_req -sha256
|
||||||
|
|
||||||
|
# Aufräumen
|
||||||
|
del openssl_fix.conf
|
||||||
|
```
|
||||||
|
|
||||||
|
### Schritt 4: Validierung
|
||||||
|
```cmd
|
||||||
|
# Prüfe Zertifikat-Extensions
|
||||||
|
openssl x509 -in cert.pem -noout -text | findstr "Digital Signature"
|
||||||
|
openssl x509 -in cert.pem -noout -text | findstr "Key Encipherment"
|
||||||
|
openssl x509 -in cert.pem -noout -text | findstr "TLS Web Server Authentication"
|
||||||
|
```
|
||||||
|
|
||||||
|
## 🌐 Alternative: Vorgefertigte Zertifikate
|
||||||
|
|
||||||
|
Falls OpenSSL nicht verfügbar ist, erstelle die Dateien manuell:
|
||||||
|
|
||||||
|
### `ssl/cert.pem` (Browser-kompatibel):
|
||||||
|
```
|
||||||
|
-----BEGIN CERTIFICATE-----
|
||||||
|
MIIDtzCCAp+gAwIBAgIUQxJ8K9B2C7VdF8G5H3K8N9M7P2QwDQYJKoZIhvcNAQEL
|
||||||
|
BQAwazELMAkGA1UEBhMCREUxGzAZBgNVBAgMEkJhZGVuLVd1ZXJ0dGVtYmVyZzES
|
||||||
|
MBAGA1UEBwwJU3R1dHRnYXJ0MRgwFgYDVQQKDA9NZXJjZWRlcy1CZW56IEFHMREw
|
||||||
|
DwYDVQQLDAhNWVAgVGVhbTAeFw0yNTAxMTIwMDAwMDBaFw0yNjAxMTIwMDAwMDBa
|
||||||
|
MGsxCzAJBgNVBAYTAkRFMRswGQYDVQQIDBJCYWRlbi1XdWVydHRlbWJlcmcxEjAQ
|
||||||
|
BgNVBAcMCVN0dXR0Z2FydDEYMBYGA1UECgwPTWVyY2VkZXMtQmVueiBBRzERMA8G
|
||||||
|
A1UECwwITVlQIFRlYW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7
|
||||||
|
... (gekürzt für Übersicht) ...
|
||||||
|
-----END CERTIFICATE-----
|
||||||
|
```
|
||||||
|
|
||||||
|
### `ssl/key.pem` (Private Key):
|
||||||
|
```
|
||||||
|
-----BEGIN RSA PRIVATE KEY-----
|
||||||
|
MIIEpAIBAAKCAQEAu3k5... (gekürzt für Sicherheit) ...
|
||||||
|
-----END RSA PRIVATE KEY-----
|
||||||
|
```
|
||||||
|
|
||||||
|
## 🔄 Nach der SSL-Reparatur
|
||||||
|
|
||||||
|
### 1. Browser-Cache vollständig leeren:
|
||||||
|
- **Chrome/Edge**: Strg+Shift+Del → "Gesamte Zeit" → alle Optionen aktivieren
|
||||||
|
- **Firefox**: Strg+Shift+Del → "Alles" auswählen
|
||||||
|
|
||||||
|
### 2. MYP-Anwendung neu starten
|
||||||
|
```cmd
|
||||||
|
# Stoppe laufende Instanzen
|
||||||
|
taskkill /f /im python.exe
|
||||||
|
|
||||||
|
# Starte MYP neu
|
||||||
|
python app.py
|
||||||
|
```
|
||||||
|
|
||||||
|
### 3. Browser-Zugriff testen
|
||||||
|
1. Öffne: `https://localhost:5000`
|
||||||
|
2. Bei SSL-Warnung: **"Erweitert"** → **"Weiter zu localhost (unsicher)"**
|
||||||
|
3. Der `ERR_SSL_KEY_USAGE_INCOMPATIBLE` Fehler sollte verschwunden sein
|
||||||
|
|
||||||
|
## 🚨 Fallback-Lösung
|
||||||
|
|
||||||
|
Falls SSL-Probleme weiterhin bestehen:
|
||||||
|
|
||||||
|
### HTTP-Modus verwenden:
|
||||||
|
```cmd
|
||||||
|
# Ändere in config.py:
|
||||||
|
USE_HTTPS = False
|
||||||
|
HOST = "0.0.0.0"
|
||||||
|
PORT = 5000
|
||||||
|
|
||||||
|
# Zugriff über:
|
||||||
|
http://localhost:5000
|
||||||
|
```
|
||||||
|
|
||||||
|
### Browser-spezifische Lösungen:
|
||||||
|
|
||||||
|
#### Chrome/Edge:
|
||||||
|
```
|
||||||
|
chrome://flags/#allow-insecure-localhost
|
||||||
|
→ "Enabled" setzen → Browser neu starten
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Firefox:
|
||||||
|
```
|
||||||
|
about:config
|
||||||
|
→ security.tls.insecure_fallback_hosts
|
||||||
|
→ localhost,m040tbaraspi001
|
||||||
|
```
|
||||||
|
|
||||||
|
## 📊 Erfolg-Validierung
|
||||||
|
|
||||||
|
Nach dem Fix sollten folgende Zertifikat-Extensions vorhanden sein:
|
||||||
|
- ✅ **basicConstraints**: CA:FALSE
|
||||||
|
- ✅ **keyUsage**: Digital Signature, Key Encipherment, Key Agreement
|
||||||
|
- ✅ **extendedKeyUsage**: TLS Web Server Authentication
|
||||||
|
- ✅ **subjectAltName**: localhost, m040tbaraspi001, etc.
|
||||||
|
|
||||||
|
## 🔍 Debugging
|
||||||
|
|
||||||
|
Falls Probleme weiterhin bestehen:
|
||||||
|
|
||||||
|
### Zertifikat-Details anzeigen:
|
||||||
|
```cmd
|
||||||
|
openssl x509 -in ssl/cert.pem -noout -text
|
||||||
|
```
|
||||||
|
|
||||||
|
### Verbindung testen:
|
||||||
|
```cmd
|
||||||
|
openssl s_client -connect localhost:5000 -servername localhost
|
||||||
|
```
|
||||||
|
|
||||||
|
### Browser Developer Tools:
|
||||||
|
- F12 → Security-Tab → Zertifikat-Details prüfen
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
**💡 Der ERR_SSL_KEY_USAGE_INCOMPATIBLE Fehler sollte nach diesen Schritten behoben sein!**
|
||||||
@@ -1 +1,131 @@
|
|||||||
|
@echo off
|
||||||
|
echo =========================================================
|
||||||
|
echo MYP SSL BROWSER-KOMPATIBILITAETS-FIX
|
||||||
|
echo Loest ERR_SSL_KEY_USAGE_INCOMPATIBLE Fehler
|
||||||
|
echo =========================================================
|
||||||
|
echo.
|
||||||
|
|
||||||
|
REM Pruefe ob SSL-Verzeichnis existiert
|
||||||
|
if not exist "ssl" (
|
||||||
|
echo Erstelle SSL-Verzeichnis...
|
||||||
|
mkdir ssl
|
||||||
|
)
|
||||||
|
|
||||||
|
REM Losche alte Zertifikate
|
||||||
|
if exist "ssl\cert.pem" (
|
||||||
|
echo Erstelle Backup der alten Zertifikate...
|
||||||
|
if not exist "ssl\backup" mkdir ssl\backup
|
||||||
|
copy "ssl\cert.pem" "ssl\backup\cert_backup_%date:~-4,4%%date:~-10,2%%date:~-7,2%.pem" >nul 2>&1
|
||||||
|
copy "ssl\key.pem" "ssl\backup\key_backup_%date:~-4,4%%date:~-10,2%%date:~-7,2%.pem" >nul 2>&1
|
||||||
|
echo Backup erstellt.
|
||||||
|
)
|
||||||
|
|
||||||
|
REM Pruefe ob OpenSSL verfuegbar ist
|
||||||
|
openssl version >nul 2>&1
|
||||||
|
if errorlevel 1 (
|
||||||
|
echo.
|
||||||
|
echo FEHLER: OpenSSL ist nicht installiert oder nicht im PATH!
|
||||||
|
echo.
|
||||||
|
echo Bitte installiere OpenSSL:
|
||||||
|
echo 1. Lade OpenSSL fuer Windows herunter: https://slproweb.com/products/Win32OpenSSL.html
|
||||||
|
echo 2. Oder verwende das bestehende SSL-Modul mit Python
|
||||||
|
echo.
|
||||||
|
echo Alternative: Verwende das Python-basierte SSL-Fix Tool:
|
||||||
|
echo python -c "from utils.ssl_config import ensure_ssl_certificates; ensure_ssl_certificates('.', True)"
|
||||||
|
echo.
|
||||||
|
pause
|
||||||
|
exit /b 1
|
||||||
|
)
|
||||||
|
|
||||||
|
echo OpenSSL gefunden. Generiere browser-kompatible SSL-Zertifikate...
|
||||||
|
echo.
|
||||||
|
|
||||||
|
REM Erstelle browser-kompatible OpenSSL-Konfiguration
|
||||||
|
echo [req] > ssl\openssl_browser_fix.conf
|
||||||
|
echo distinguished_name = req_distinguished_name >> ssl\openssl_browser_fix.conf
|
||||||
|
echo req_extensions = v3_req >> ssl\openssl_browser_fix.conf
|
||||||
|
echo prompt = no >> ssl\openssl_browser_fix.conf
|
||||||
|
echo. >> ssl\openssl_browser_fix.conf
|
||||||
|
echo [req_distinguished_name] >> ssl\openssl_browser_fix.conf
|
||||||
|
echo C = DE >> ssl\openssl_browser_fix.conf
|
||||||
|
echo ST = Baden-Wuerttemberg >> ssl\openssl_browser_fix.conf
|
||||||
|
echo L = Stuttgart >> ssl\openssl_browser_fix.conf
|
||||||
|
echo O = Mercedes-Benz AG >> ssl\openssl_browser_fix.conf
|
||||||
|
echo OU = MYP Druckerverwaltung >> ssl\openssl_browser_fix.conf
|
||||||
|
echo CN = m040tbaraspi001 >> ssl\openssl_browser_fix.conf
|
||||||
|
echo. >> ssl\openssl_browser_fix.conf
|
||||||
|
echo [v3_req] >> ssl\openssl_browser_fix.conf
|
||||||
|
echo basicConstraints = critical, CA:FALSE >> ssl\openssl_browser_fix.conf
|
||||||
|
echo keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement >> ssl\openssl_browser_fix.conf
|
||||||
|
echo extendedKeyUsage = critical, serverAuth, clientAuth >> ssl\openssl_browser_fix.conf
|
||||||
|
echo subjectAltName = critical, @alt_names >> ssl\openssl_browser_fix.conf
|
||||||
|
echo nsCertType = server >> ssl\openssl_browser_fix.conf
|
||||||
|
echo nsComment = "MYP SSL Fix - ERR_SSL_KEY_USAGE_INCOMPATIBLE Loesung" >> ssl\openssl_browser_fix.conf
|
||||||
|
echo. >> ssl\openssl_browser_fix.conf
|
||||||
|
echo [alt_names] >> ssl\openssl_browser_fix.conf
|
||||||
|
echo DNS.1 = localhost >> ssl\openssl_browser_fix.conf
|
||||||
|
echo DNS.2 = *.localhost >> ssl\openssl_browser_fix.conf
|
||||||
|
echo DNS.3 = m040tbaraspi001 >> ssl\openssl_browser_fix.conf
|
||||||
|
echo DNS.4 = m040tbaraspi001.local >> ssl\openssl_browser_fix.conf
|
||||||
|
echo DNS.5 = m040tbaraspi001.de040.corpintra.net >> ssl\openssl_browser_fix.conf
|
||||||
|
echo DNS.6 = *.de040.corpintra.net >> ssl\openssl_browser_fix.conf
|
||||||
|
echo IP.1 = 127.0.0.1 >> ssl\openssl_browser_fix.conf
|
||||||
|
echo IP.2 = ::1 >> ssl\openssl_browser_fix.conf
|
||||||
|
echo IP.3 = 0.0.0.0 >> ssl\openssl_browser_fix.conf
|
||||||
|
|
||||||
|
echo OpenSSL-Konfiguration erstellt.
|
||||||
|
|
||||||
|
REM Generiere Private Key
|
||||||
|
echo Generiere Private Key (RSA 2048)...
|
||||||
|
openssl genrsa -out ssl\key.pem 2048
|
||||||
|
if errorlevel 1 (
|
||||||
|
echo FEHLER: Private Key Generierung fehlgeschlagen!
|
||||||
|
pause
|
||||||
|
exit /b 1
|
||||||
|
)
|
||||||
|
echo Private Key generiert.
|
||||||
|
|
||||||
|
REM Generiere browser-kompatibles Zertifikat
|
||||||
|
echo Generiere browser-kompatibles Zertifikat...
|
||||||
|
openssl req -new -x509 -key ssl\key.pem -out ssl\cert.pem -days 365 -config ssl\openssl_browser_fix.conf -extensions v3_req -sha256
|
||||||
|
if errorlevel 1 (
|
||||||
|
echo FEHLER: Zertifikat-Generierung fehlgeschlagen!
|
||||||
|
pause
|
||||||
|
exit /b 1
|
||||||
|
)
|
||||||
|
echo Browser-kompatibles Zertifikat generiert.
|
||||||
|
|
||||||
|
REM Aufraumen
|
||||||
|
del ssl\openssl_browser_fix.conf >nul 2>&1
|
||||||
|
|
||||||
|
REM Validierung
|
||||||
|
echo.
|
||||||
|
echo =========================================================
|
||||||
|
echo BROWSER-KOMPATIBILITAETS-VALIDIERUNG
|
||||||
|
echo =========================================================
|
||||||
|
echo Pruefe Zertifikat-Extensions...
|
||||||
|
openssl x509 -in ssl\cert.pem -noout -text | findstr /C:"Digital Signature" /C:"Key Encipherment" /C:"TLS Web Server Authentication" /C:"Subject Alternative Name" /C:"CA:FALSE"
|
||||||
|
|
||||||
|
echo.
|
||||||
|
echo =========================================================
|
||||||
|
echo SSL-FIX ERFOLGREICH ABGESCHLOSSEN!
|
||||||
|
echo =========================================================
|
||||||
|
echo.
|
||||||
|
echo Naechste Schritte:
|
||||||
|
echo 1. Browser-Cache vollstaendig leeren:
|
||||||
|
echo - Chrome/Edge: Strg+Shift+Del, "Gesamte Zeit", alle Optionen
|
||||||
|
echo - Firefox: Strg+Shift+Del, "Alles" auswaehlen
|
||||||
|
echo.
|
||||||
|
echo 2. MYP-Anwendung neu starten
|
||||||
|
echo.
|
||||||
|
echo 3. https://localhost:5000 aufrufen
|
||||||
|
echo.
|
||||||
|
echo 4. Bei SSL-Warnung: "Erweitert" - "Weiter zu localhost (unsicher)"
|
||||||
|
echo.
|
||||||
|
echo Der Fehler ERR_SSL_KEY_USAGE_INCOMPATIBLE sollte behoben sein!
|
||||||
|
echo.
|
||||||
|
echo Zertifikat gespeichert in: ssl\cert.pem
|
||||||
|
echo Private Key gespeichert in: ssl\key.pem
|
||||||
|
echo.
|
||||||
|
|
||||||
|
pause
|
||||||
Reference in New Issue
Block a user