📚 Reorganized documentation files and renamed for clarity
This commit is contained in:
Till Tomczak
331
backend/DOCS/RASPBERRY_PI_SSL_FIX.md
Normal file
331
backend/DOCS/RASPBERRY_PI_SSL_FIX.md
Normal file
@ -0,0 +1,331 @@
|
||||
# RASPBERRY PI SSL FIX - ERR_SSL_KEY_USAGE_INCOMPATIBLE
|
||||
|
||||
## 🍓 SSL-Problem auf Raspberry Pi Zielsystem lösen
|
||||
|
||||
Das `ERR_SSL_KEY_USAGE_INCOMPATIBLE` Problem tritt auf dem **Raspberry Pi** auf, weil die SSL-Zertifikat-Extensions nicht browser-kompatibel sind.
|
||||
|
||||
## 🚀 Automatische Lösung auf Raspberry Pi
|
||||
|
||||
### Option 1: Automatisches Skript (Empfohlen)
|
||||
```bash
|
||||
# Übertrage das Skript auf den Raspberry Pi
|
||||
scp backend/fix_ssl_raspberry.sh pi@m040tbaraspi001:/tmp/
|
||||
|
||||
# Führe auf dem Raspberry Pi aus:
|
||||
ssh pi@m040tbaraspi001
|
||||
sudo chmod +x /tmp/fix_ssl_raspberry.sh
|
||||
sudo /tmp/fix_ssl_raspberry.sh
|
||||
```
|
||||
|
||||
### Option 2: Setup-Skript SSL-Regenerierung
|
||||
```bash
|
||||
# Auf dem Raspberry Pi:
|
||||
cd /opt/myp
|
||||
sudo ./setup.sh
|
||||
|
||||
# Wähle Option [1] Abhängigkeiten installieren
|
||||
# Das Skript regeneriert automatisch SSL-Zertifikate
|
||||
```
|
||||
|
||||
## 🔧 Manuelle Lösung auf Raspberry Pi
|
||||
|
||||
### Schritt 1: SSH-Verbindung
|
||||
```bash
|
||||
# Von Windows-Entwicklungsrechner:
|
||||
ssh pi@m040tbaraspi001.de040.corpintra.net
|
||||
# oder
|
||||
ssh pi@192.168.1.XXX
|
||||
```
|
||||
|
||||
### Schritt 2: SSL-Verzeichnis vorbereiten
|
||||
```bash
|
||||
sudo mkdir -p /opt/myp/ssl
|
||||
sudo mkdir -p /opt/myp/ssl/backup
|
||||
cd /opt/myp/ssl
|
||||
```
|
||||
|
||||
### Schritt 3: Backup existierender Zertifikate
|
||||
```bash
|
||||
if [ -f cert.pem ]; then
|
||||
sudo cp cert.pem backup/cert_backup_$(date +%Y%m%d_%H%M%S).pem
|
||||
sudo cp key.pem backup/key_backup_$(date +%Y%m%d_%H%M%S).pem
|
||||
echo "Backup erstellt"
|
||||
fi
|
||||
```
|
||||
|
||||
### Schritt 4: Browser-kompatible OpenSSL-Konfiguration
|
||||
```bash
|
||||
sudo tee openssl_raspberry_fix.conf << 'EOF'
|
||||
[req]
|
||||
distinguished_name = req_distinguished_name
|
||||
req_extensions = v3_req
|
||||
prompt = no
|
||||
|
||||
[req_distinguished_name]
|
||||
C = DE
|
||||
ST = Baden-Wuerttemberg
|
||||
L = Stuttgart
|
||||
O = Mercedes-Benz AG
|
||||
OU = MYP Druckerverwaltung
|
||||
CN = m040tbaraspi001
|
||||
|
||||
[v3_req]
|
||||
# KRITISCH für Browser-Kompatibilität
|
||||
basicConstraints = critical, CA:FALSE
|
||||
keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement
|
||||
extendedKeyUsage = critical, serverAuth, clientAuth
|
||||
subjectAltName = critical, @alt_names
|
||||
nsCertType = server
|
||||
|
||||
[alt_names]
|
||||
# Lokale Entwicklung
|
||||
DNS.1 = localhost
|
||||
DNS.2 = *.localhost
|
||||
IP.1 = 127.0.0.1
|
||||
IP.2 = ::1
|
||||
|
||||
# Raspberry Pi Hostname
|
||||
DNS.3 = m040tbaraspi001
|
||||
DNS.4 = m040tbaraspi001.local
|
||||
DNS.5 = raspberrypi
|
||||
DNS.6 = raspberrypi.local
|
||||
|
||||
# Intranet-Domain
|
||||
DNS.7 = m040tbaraspi001.de040.corpintra.net
|
||||
DNS.8 = *.de040.corpintra.net
|
||||
|
||||
# Typische Raspberry Pi IPs
|
||||
IP.3 = 0.0.0.0
|
||||
EOF
|
||||
```
|
||||
|
||||
### Schritt 5: Neue Zertifikate generieren
|
||||
```bash
|
||||
# Private Key generieren
|
||||
sudo openssl genrsa -out key.pem 2048
|
||||
|
||||
# Browser-kompatibles Zertifikat erstellen
|
||||
sudo openssl req -new -x509 \
|
||||
-key key.pem \
|
||||
-out cert.pem \
|
||||
-days 365 \
|
||||
-config openssl_raspberry_fix.conf \
|
||||
-extensions v3_req \
|
||||
-sha256
|
||||
|
||||
# Berechtigungen setzen
|
||||
sudo chmod 644 cert.pem # Alle können lesen
|
||||
sudo chmod 600 key.pem # Nur root kann lesen
|
||||
sudo chown root:root cert.pem key.pem
|
||||
|
||||
# Aufräumen
|
||||
sudo rm openssl_raspberry_fix.conf
|
||||
```
|
||||
|
||||
### Schritt 6: Validierung
|
||||
```bash
|
||||
# Prüfe Browser-Kompatibilität
|
||||
openssl x509 -in cert.pem -noout -text | grep -E "(Digital Signature|Key Encipherment|TLS Web Server Authentication|Subject Alternative Name|CA:FALSE)"
|
||||
|
||||
# Prüfe Raspberry Pi spezifische Einträge
|
||||
openssl x509 -in cert.pem -noout -text | grep -E "(m040tbaraspi001|localhost|de040.corpintra.net)"
|
||||
```
|
||||
|
||||
### Schritt 7: Services neu starten
|
||||
```bash
|
||||
# MYP Services neu starten
|
||||
sudo systemctl restart myp-app.service
|
||||
sudo systemctl restart myp-kiosk.service
|
||||
|
||||
# Status prüfen
|
||||
sudo systemctl status myp-app.service
|
||||
sudo systemctl status myp-kiosk.service
|
||||
```
|
||||
|
||||
## 🌐 Zugriff nach SSL-Fix
|
||||
|
||||
### Intranet-Zugriff (von Windows-Client):
|
||||
```
|
||||
https://m040tbaraspi001.de040.corpintra.net
|
||||
```
|
||||
|
||||
### Lokaler Zugriff (auf Raspberry Pi):
|
||||
```
|
||||
https://localhost:5000
|
||||
```
|
||||
|
||||
### Direkte IP (falls DNS-Probleme):
|
||||
```
|
||||
https://192.168.1.XXX:5000
|
||||
```
|
||||
|
||||
## 🔥 Firewall-Konfiguration
|
||||
|
||||
### UFW Firewall auf Raspberry Pi:
|
||||
```bash
|
||||
# Prüfe Firewall-Status
|
||||
sudo ufw status
|
||||
|
||||
# Öffne HTTPS-Port falls blockiert
|
||||
sudo ufw allow 443/tcp
|
||||
sudo ufw allow 5000/tcp
|
||||
|
||||
# Status erneut prüfen
|
||||
sudo ufw status numbered
|
||||
```
|
||||
|
||||
## 🖥️ Browser-Setup auf Windows-Client
|
||||
|
||||
### Nach SSL-Fix auf Raspberry Pi:
|
||||
|
||||
#### 1. Browser-Cache vollständig leeren:
|
||||
- **Chrome/Edge**: `Strg+Shift+Del` → "Gesamte Zeit" → alle Optionen
|
||||
- **Firefox**: `Strg+Shift+Del` → "Alles" auswählen
|
||||
|
||||
#### 2. DNS-Cache leeren (Windows):
|
||||
```cmd
|
||||
ipconfig /flushdns
|
||||
```
|
||||
|
||||
#### 3. Browser-Zugriff testen:
|
||||
1. Öffne: `https://m040tbaraspi001.de040.corpintra.net`
|
||||
2. Bei SSL-Warnung: **"Erweitert"** → **"Weiter zu m040tbaraspi001 (unsicher)"**
|
||||
|
||||
## 🐛 Debugging auf Raspberry Pi
|
||||
|
||||
### SSL-Verbindung testen:
|
||||
```bash
|
||||
# Teste SSL-Handshake
|
||||
openssl s_client -connect localhost:5000 -servername localhost
|
||||
|
||||
# Teste von anderem System
|
||||
openssl s_client -connect m040tbaraspi001.de040.corpintra.net:443
|
||||
```
|
||||
|
||||
### Zertifikat-Details anzeigen:
|
||||
```bash
|
||||
# Vollständige Zertifikat-Informationen
|
||||
openssl x509 -in /opt/myp/ssl/cert.pem -noout -text
|
||||
|
||||
# Nur Gültigkeit
|
||||
openssl x509 -in /opt/myp/ssl/cert.pem -noout -dates
|
||||
|
||||
# Subject Alternative Names
|
||||
openssl x509 -in /opt/myp/ssl/cert.pem -noout -text | grep -A 10 "Subject Alternative Name"
|
||||
```
|
||||
|
||||
### Netzwerk-Debugging:
|
||||
```bash
|
||||
# Hostname prüfen
|
||||
hostname
|
||||
hostname -I
|
||||
|
||||
# DNS-Auflösung testen
|
||||
nslookup m040tbaraspi001.de040.corpintra.net
|
||||
ping m040tbaraspi001.de040.corpintra.net
|
||||
|
||||
# Port-Status
|
||||
sudo netstat -tulpn | grep :443
|
||||
sudo netstat -tulpn | grep :5000
|
||||
```
|
||||
|
||||
### Service-Logs prüfen:
|
||||
```bash
|
||||
# MYP App Logs
|
||||
sudo journalctl -u myp-app.service -f
|
||||
|
||||
# MYP Kiosk Logs
|
||||
sudo journalctl -u myp-kiosk.service -f
|
||||
|
||||
# SSL-spezifische Fehler
|
||||
sudo journalctl | grep -i ssl
|
||||
sudo journalctl | grep -i certificate
|
||||
```
|
||||
|
||||
## 📋 Raspberry Pi System-Info
|
||||
|
||||
### Hardware & OS:
|
||||
```bash
|
||||
# Raspberry Pi Modell
|
||||
cat /proc/cpuinfo | grep "Model"
|
||||
|
||||
# OS Version
|
||||
cat /etc/os-release
|
||||
|
||||
# Verfügbarer Speicher
|
||||
df -h /opt/myp
|
||||
|
||||
# OpenSSL Version
|
||||
openssl version
|
||||
```
|
||||
|
||||
### Netzwerk-Konfiguration:
|
||||
```bash
|
||||
# IP-Konfiguration
|
||||
ip addr show
|
||||
|
||||
# Routing-Tabelle
|
||||
ip route show
|
||||
|
||||
# DNS-Konfiguration
|
||||
cat /etc/resolv.conf
|
||||
```
|
||||
|
||||
## 🔄 Integration mit Setup-Skript
|
||||
|
||||
Das Setup-Skript wurde aktualisiert um automatisch:
|
||||
|
||||
1. **Send2Trash-Problem** zu beheben (bereinigte requirements.txt)
|
||||
2. **SSL-Zertifikate** browser-kompatibel zu regenerieren
|
||||
3. **Raspberry Pi spezifische** Konfiguration anzuwenden
|
||||
|
||||
### Setup-Skript ausführen:
|
||||
```bash
|
||||
cd /opt/myp
|
||||
sudo ./setup.sh
|
||||
|
||||
# Option [1]: Abhängigkeiten installieren
|
||||
# Option [2]: Produktionsbetrieb einrichten
|
||||
```
|
||||
|
||||
## 🎯 Erfolgs-Validierung
|
||||
|
||||
Nach dem SSL-Fix sollten folgende Tests erfolgreich sein:
|
||||
|
||||
### ✅ Raspberry Pi (lokal):
|
||||
```bash
|
||||
curl -k https://localhost:5000/health
|
||||
```
|
||||
|
||||
### ✅ Windows-Client (remote):
|
||||
```cmd
|
||||
curl -k https://m040tbaraspi001.de040.corpintra.net/health
|
||||
```
|
||||
|
||||
### ✅ Browser-Test:
|
||||
- Keine `ERR_SSL_KEY_USAGE_INCOMPATIBLE` Fehler
|
||||
- SSL-Warnung kann übersprungen werden
|
||||
- MYP-Interface lädt korrekt
|
||||
|
||||
## 🚨 Fallback-Optionen
|
||||
|
||||
### Option 1: HTTP-Modus aktivieren
|
||||
```bash
|
||||
# In /opt/myp/config.py:
|
||||
USE_HTTPS = False
|
||||
PORT = 5000
|
||||
|
||||
# Zugriff über:
|
||||
http://m040tbaraspi001.de040.corpintra.net:5000
|
||||
```
|
||||
|
||||
### Option 2: Self-Signed Certificate Installation
|
||||
```bash
|
||||
# Zertifikat zu System CA-Store hinzufügen
|
||||
sudo cp /opt/myp/ssl/cert.pem /usr/local/share/ca-certificates/myp.crt
|
||||
sudo update-ca-certificates
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
**🍓 Der ERR_SSL_KEY_USAGE_INCOMPATIBLE Fehler sollte auf dem Raspberry Pi nach diesen Schritten vollständig behoben sein!**
|
||||
Reference in New Issue
Block a user