🔧 Aktualisiert: Backend-Setup-Skript zur Verwendung einer bereinigten requirements.txt für die Installation von Python-Paketen mit verbesserter Fehlerbehandlung. 🚀
This commit is contained in:
@ -309,8 +309,22 @@ SSL certificate key usage incompatible
|
||||
```
|
||||
|
||||
**Lösung:**
|
||||
|
||||
**🍓 RASPBERRY PI (Zielsystem) - PRIMÄRE LÖSUNG:**
|
||||
```bash
|
||||
# Schnell-Fix mit dediziertem Tool
|
||||
# SSL-Fix auf Raspberry Pi ausführen
|
||||
ssh pi@m040tbaraspi001
|
||||
sudo chmod +x /tmp/fix_ssl_raspberry.sh
|
||||
sudo /tmp/fix_ssl_raspberry.sh
|
||||
|
||||
# Oder via Setup-Skript
|
||||
cd /opt/myp
|
||||
sudo ./setup.sh # Option [1] wählen
|
||||
```
|
||||
|
||||
**🔧 Alternative Tools:**
|
||||
```bash
|
||||
# Cross-Platform Python Tool
|
||||
cd backend
|
||||
python3 ssl_fix.py
|
||||
|
||||
|
||||
331
backend/RASPBERRY_PI_SSL_FIX.md
Normal file
331
backend/RASPBERRY_PI_SSL_FIX.md
Normal file
@ -0,0 +1,331 @@
|
||||
# RASPBERRY PI SSL FIX - ERR_SSL_KEY_USAGE_INCOMPATIBLE
|
||||
|
||||
## 🍓 SSL-Problem auf Raspberry Pi Zielsystem lösen
|
||||
|
||||
Das `ERR_SSL_KEY_USAGE_INCOMPATIBLE` Problem tritt auf dem **Raspberry Pi** auf, weil die SSL-Zertifikat-Extensions nicht browser-kompatibel sind.
|
||||
|
||||
## 🚀 Automatische Lösung auf Raspberry Pi
|
||||
|
||||
### Option 1: Automatisches Skript (Empfohlen)
|
||||
```bash
|
||||
# Übertrage das Skript auf den Raspberry Pi
|
||||
scp backend/fix_ssl_raspberry.sh pi@m040tbaraspi001:/tmp/
|
||||
|
||||
# Führe auf dem Raspberry Pi aus:
|
||||
ssh pi@m040tbaraspi001
|
||||
sudo chmod +x /tmp/fix_ssl_raspberry.sh
|
||||
sudo /tmp/fix_ssl_raspberry.sh
|
||||
```
|
||||
|
||||
### Option 2: Setup-Skript SSL-Regenerierung
|
||||
```bash
|
||||
# Auf dem Raspberry Pi:
|
||||
cd /opt/myp
|
||||
sudo ./setup.sh
|
||||
|
||||
# Wähle Option [1] Abhängigkeiten installieren
|
||||
# Das Skript regeneriert automatisch SSL-Zertifikate
|
||||
```
|
||||
|
||||
## 🔧 Manuelle Lösung auf Raspberry Pi
|
||||
|
||||
### Schritt 1: SSH-Verbindung
|
||||
```bash
|
||||
# Von Windows-Entwicklungsrechner:
|
||||
ssh pi@m040tbaraspi001.de040.corpintra.net
|
||||
# oder
|
||||
ssh pi@192.168.1.XXX
|
||||
```
|
||||
|
||||
### Schritt 2: SSL-Verzeichnis vorbereiten
|
||||
```bash
|
||||
sudo mkdir -p /opt/myp/ssl
|
||||
sudo mkdir -p /opt/myp/ssl/backup
|
||||
cd /opt/myp/ssl
|
||||
```
|
||||
|
||||
### Schritt 3: Backup existierender Zertifikate
|
||||
```bash
|
||||
if [ -f cert.pem ]; then
|
||||
sudo cp cert.pem backup/cert_backup_$(date +%Y%m%d_%H%M%S).pem
|
||||
sudo cp key.pem backup/key_backup_$(date +%Y%m%d_%H%M%S).pem
|
||||
echo "Backup erstellt"
|
||||
fi
|
||||
```
|
||||
|
||||
### Schritt 4: Browser-kompatible OpenSSL-Konfiguration
|
||||
```bash
|
||||
sudo tee openssl_raspberry_fix.conf << 'EOF'
|
||||
[req]
|
||||
distinguished_name = req_distinguished_name
|
||||
req_extensions = v3_req
|
||||
prompt = no
|
||||
|
||||
[req_distinguished_name]
|
||||
C = DE
|
||||
ST = Baden-Wuerttemberg
|
||||
L = Stuttgart
|
||||
O = Mercedes-Benz AG
|
||||
OU = MYP Druckerverwaltung
|
||||
CN = m040tbaraspi001
|
||||
|
||||
[v3_req]
|
||||
# KRITISCH für Browser-Kompatibilität
|
||||
basicConstraints = critical, CA:FALSE
|
||||
keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement
|
||||
extendedKeyUsage = critical, serverAuth, clientAuth
|
||||
subjectAltName = critical, @alt_names
|
||||
nsCertType = server
|
||||
|
||||
[alt_names]
|
||||
# Lokale Entwicklung
|
||||
DNS.1 = localhost
|
||||
DNS.2 = *.localhost
|
||||
IP.1 = 127.0.0.1
|
||||
IP.2 = ::1
|
||||
|
||||
# Raspberry Pi Hostname
|
||||
DNS.3 = m040tbaraspi001
|
||||
DNS.4 = m040tbaraspi001.local
|
||||
DNS.5 = raspberrypi
|
||||
DNS.6 = raspberrypi.local
|
||||
|
||||
# Intranet-Domain
|
||||
DNS.7 = m040tbaraspi001.de040.corpintra.net
|
||||
DNS.8 = *.de040.corpintra.net
|
||||
|
||||
# Typische Raspberry Pi IPs
|
||||
IP.3 = 0.0.0.0
|
||||
EOF
|
||||
```
|
||||
|
||||
### Schritt 5: Neue Zertifikate generieren
|
||||
```bash
|
||||
# Private Key generieren
|
||||
sudo openssl genrsa -out key.pem 2048
|
||||
|
||||
# Browser-kompatibles Zertifikat erstellen
|
||||
sudo openssl req -new -x509 \
|
||||
-key key.pem \
|
||||
-out cert.pem \
|
||||
-days 365 \
|
||||
-config openssl_raspberry_fix.conf \
|
||||
-extensions v3_req \
|
||||
-sha256
|
||||
|
||||
# Berechtigungen setzen
|
||||
sudo chmod 644 cert.pem # Alle können lesen
|
||||
sudo chmod 600 key.pem # Nur root kann lesen
|
||||
sudo chown root:root cert.pem key.pem
|
||||
|
||||
# Aufräumen
|
||||
sudo rm openssl_raspberry_fix.conf
|
||||
```
|
||||
|
||||
### Schritt 6: Validierung
|
||||
```bash
|
||||
# Prüfe Browser-Kompatibilität
|
||||
openssl x509 -in cert.pem -noout -text | grep -E "(Digital Signature|Key Encipherment|TLS Web Server Authentication|Subject Alternative Name|CA:FALSE)"
|
||||
|
||||
# Prüfe Raspberry Pi spezifische Einträge
|
||||
openssl x509 -in cert.pem -noout -text | grep -E "(m040tbaraspi001|localhost|de040.corpintra.net)"
|
||||
```
|
||||
|
||||
### Schritt 7: Services neu starten
|
||||
```bash
|
||||
# MYP Services neu starten
|
||||
sudo systemctl restart myp-app.service
|
||||
sudo systemctl restart myp-kiosk.service
|
||||
|
||||
# Status prüfen
|
||||
sudo systemctl status myp-app.service
|
||||
sudo systemctl status myp-kiosk.service
|
||||
```
|
||||
|
||||
## 🌐 Zugriff nach SSL-Fix
|
||||
|
||||
### Intranet-Zugriff (von Windows-Client):
|
||||
```
|
||||
https://m040tbaraspi001.de040.corpintra.net
|
||||
```
|
||||
|
||||
### Lokaler Zugriff (auf Raspberry Pi):
|
||||
```
|
||||
https://localhost:5000
|
||||
```
|
||||
|
||||
### Direkte IP (falls DNS-Probleme):
|
||||
```
|
||||
https://192.168.1.XXX:5000
|
||||
```
|
||||
|
||||
## 🔥 Firewall-Konfiguration
|
||||
|
||||
### UFW Firewall auf Raspberry Pi:
|
||||
```bash
|
||||
# Prüfe Firewall-Status
|
||||
sudo ufw status
|
||||
|
||||
# Öffne HTTPS-Port falls blockiert
|
||||
sudo ufw allow 443/tcp
|
||||
sudo ufw allow 5000/tcp
|
||||
|
||||
# Status erneut prüfen
|
||||
sudo ufw status numbered
|
||||
```
|
||||
|
||||
## 🖥️ Browser-Setup auf Windows-Client
|
||||
|
||||
### Nach SSL-Fix auf Raspberry Pi:
|
||||
|
||||
#### 1. Browser-Cache vollständig leeren:
|
||||
- **Chrome/Edge**: `Strg+Shift+Del` → "Gesamte Zeit" → alle Optionen
|
||||
- **Firefox**: `Strg+Shift+Del` → "Alles" auswählen
|
||||
|
||||
#### 2. DNS-Cache leeren (Windows):
|
||||
```cmd
|
||||
ipconfig /flushdns
|
||||
```
|
||||
|
||||
#### 3. Browser-Zugriff testen:
|
||||
1. Öffne: `https://m040tbaraspi001.de040.corpintra.net`
|
||||
2. Bei SSL-Warnung: **"Erweitert"** → **"Weiter zu m040tbaraspi001 (unsicher)"**
|
||||
|
||||
## 🐛 Debugging auf Raspberry Pi
|
||||
|
||||
### SSL-Verbindung testen:
|
||||
```bash
|
||||
# Teste SSL-Handshake
|
||||
openssl s_client -connect localhost:5000 -servername localhost
|
||||
|
||||
# Teste von anderem System
|
||||
openssl s_client -connect m040tbaraspi001.de040.corpintra.net:443
|
||||
```
|
||||
|
||||
### Zertifikat-Details anzeigen:
|
||||
```bash
|
||||
# Vollständige Zertifikat-Informationen
|
||||
openssl x509 -in /opt/myp/ssl/cert.pem -noout -text
|
||||
|
||||
# Nur Gültigkeit
|
||||
openssl x509 -in /opt/myp/ssl/cert.pem -noout -dates
|
||||
|
||||
# Subject Alternative Names
|
||||
openssl x509 -in /opt/myp/ssl/cert.pem -noout -text | grep -A 10 "Subject Alternative Name"
|
||||
```
|
||||
|
||||
### Netzwerk-Debugging:
|
||||
```bash
|
||||
# Hostname prüfen
|
||||
hostname
|
||||
hostname -I
|
||||
|
||||
# DNS-Auflösung testen
|
||||
nslookup m040tbaraspi001.de040.corpintra.net
|
||||
ping m040tbaraspi001.de040.corpintra.net
|
||||
|
||||
# Port-Status
|
||||
sudo netstat -tulpn | grep :443
|
||||
sudo netstat -tulpn | grep :5000
|
||||
```
|
||||
|
||||
### Service-Logs prüfen:
|
||||
```bash
|
||||
# MYP App Logs
|
||||
sudo journalctl -u myp-app.service -f
|
||||
|
||||
# MYP Kiosk Logs
|
||||
sudo journalctl -u myp-kiosk.service -f
|
||||
|
||||
# SSL-spezifische Fehler
|
||||
sudo journalctl | grep -i ssl
|
||||
sudo journalctl | grep -i certificate
|
||||
```
|
||||
|
||||
## 📋 Raspberry Pi System-Info
|
||||
|
||||
### Hardware & OS:
|
||||
```bash
|
||||
# Raspberry Pi Modell
|
||||
cat /proc/cpuinfo | grep "Model"
|
||||
|
||||
# OS Version
|
||||
cat /etc/os-release
|
||||
|
||||
# Verfügbarer Speicher
|
||||
df -h /opt/myp
|
||||
|
||||
# OpenSSL Version
|
||||
openssl version
|
||||
```
|
||||
|
||||
### Netzwerk-Konfiguration:
|
||||
```bash
|
||||
# IP-Konfiguration
|
||||
ip addr show
|
||||
|
||||
# Routing-Tabelle
|
||||
ip route show
|
||||
|
||||
# DNS-Konfiguration
|
||||
cat /etc/resolv.conf
|
||||
```
|
||||
|
||||
## 🔄 Integration mit Setup-Skript
|
||||
|
||||
Das Setup-Skript wurde aktualisiert um automatisch:
|
||||
|
||||
1. **Send2Trash-Problem** zu beheben (bereinigte requirements.txt)
|
||||
2. **SSL-Zertifikate** browser-kompatibel zu regenerieren
|
||||
3. **Raspberry Pi spezifische** Konfiguration anzuwenden
|
||||
|
||||
### Setup-Skript ausführen:
|
||||
```bash
|
||||
cd /opt/myp
|
||||
sudo ./setup.sh
|
||||
|
||||
# Option [1]: Abhängigkeiten installieren
|
||||
# Option [2]: Produktionsbetrieb einrichten
|
||||
```
|
||||
|
||||
## 🎯 Erfolgs-Validierung
|
||||
|
||||
Nach dem SSL-Fix sollten folgende Tests erfolgreich sein:
|
||||
|
||||
### ✅ Raspberry Pi (lokal):
|
||||
```bash
|
||||
curl -k https://localhost:5000/health
|
||||
```
|
||||
|
||||
### ✅ Windows-Client (remote):
|
||||
```cmd
|
||||
curl -k https://m040tbaraspi001.de040.corpintra.net/health
|
||||
```
|
||||
|
||||
### ✅ Browser-Test:
|
||||
- Keine `ERR_SSL_KEY_USAGE_INCOMPATIBLE` Fehler
|
||||
- SSL-Warnung kann übersprungen werden
|
||||
- MYP-Interface lädt korrekt
|
||||
|
||||
## 🚨 Fallback-Optionen
|
||||
|
||||
### Option 1: HTTP-Modus aktivieren
|
||||
```bash
|
||||
# In /opt/myp/config.py:
|
||||
USE_HTTPS = False
|
||||
PORT = 5000
|
||||
|
||||
# Zugriff über:
|
||||
http://m040tbaraspi001.de040.corpintra.net:5000
|
||||
```
|
||||
|
||||
### Option 2: Self-Signed Certificate Installation
|
||||
```bash
|
||||
# Zertifikat zu System CA-Store hinzufügen
|
||||
sudo cp /opt/myp/ssl/cert.pem /usr/local/share/ca-certificates/myp.crt
|
||||
sudo update-ca-certificates
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
**🍓 Der ERR_SSL_KEY_USAGE_INCOMPATIBLE Fehler sollte auf dem Raspberry Pi nach diesen Schritten vollständig behoben sein!**
|
||||
305
backend/fix_ssl_raspberry.sh
Normal file
305
backend/fix_ssl_raspberry.sh
Normal file
@ -0,0 +1,305 @@
|
||||
#!/bin/bash
|
||||
# MYP SSL Browser-Kompatibilitäts-Fix für Raspberry Pi
|
||||
# Löst ERR_SSL_KEY_USAGE_INCOMPATIBLE Fehler auf Linux-Zielsystem
|
||||
|
||||
set -e # Beende bei Fehler
|
||||
|
||||
# Farbcodes für Output
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
BLUE='\033[0;34m'
|
||||
CYAN='\033[0;36m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
echo -e "${CYAN}=========================================================${NC}"
|
||||
echo -e "${CYAN}MYP SSL BROWSER-KOMPATIBILITÄTS-FIX für Raspberry Pi${NC}"
|
||||
echo -e "${CYAN}Löst ERR_SSL_KEY_USAGE_INCOMPATIBLE Fehler${NC}"
|
||||
echo -e "${CYAN}=========================================================${NC}"
|
||||
echo ""
|
||||
|
||||
# Aktuelles Verzeichnis und Pfade
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
APP_DIR="/opt/myp"
|
||||
SSL_DIR="$APP_DIR/ssl"
|
||||
CERT_PATH="$SSL_DIR/cert.pem"
|
||||
KEY_PATH="$SSL_DIR/key.pem"
|
||||
|
||||
echo -e "${BLUE}📁 Arbeitsverzeichnis: $SCRIPT_DIR${NC}"
|
||||
echo -e "${BLUE}📁 App-Verzeichnis: $APP_DIR${NC}"
|
||||
echo -e "${BLUE}🔐 SSL-Verzeichnis: $SSL_DIR${NC}"
|
||||
echo ""
|
||||
|
||||
# Prüfe ob als root/sudo ausgeführt wird
|
||||
if [[ $EUID -ne 0 ]]; then
|
||||
echo -e "${RED}❌ Dieses Skript muss als root ausgeführt werden!${NC}"
|
||||
echo -e "${YELLOW}💡 Verwende: sudo $0${NC}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Prüfe ob OpenSSL verfügbar ist
|
||||
if ! command -v openssl &> /dev/null; then
|
||||
echo -e "${RED}❌ OpenSSL ist nicht installiert!${NC}"
|
||||
echo -e "${YELLOW}📦 Installiere OpenSSL...${NC}"
|
||||
apt update && apt install -y openssl
|
||||
|
||||
if ! command -v openssl &> /dev/null; then
|
||||
echo -e "${RED}❌ OpenSSL Installation fehlgeschlagen!${NC}"
|
||||
exit 1
|
||||
fi
|
||||
echo -e "${GREEN}✅ OpenSSL erfolgreich installiert${NC}"
|
||||
fi
|
||||
|
||||
# SSL-Verzeichnis erstellen
|
||||
echo -e "${YELLOW}📁 Erstelle SSL-Verzeichnis...${NC}"
|
||||
mkdir -p "$SSL_DIR"
|
||||
mkdir -p "$SSL_DIR/backup"
|
||||
|
||||
# Backup existierender Zertifikate
|
||||
if [ -f "$CERT_PATH" ]; then
|
||||
TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
|
||||
echo -e "${YELLOW}💾 Erstelle Backup der alten Zertifikate...${NC}"
|
||||
cp "$CERT_PATH" "$SSL_DIR/backup/cert_backup_$TIMESTAMP.pem" 2>/dev/null || true
|
||||
cp "$KEY_PATH" "$SSL_DIR/backup/key_backup_$TIMESTAMP.pem" 2>/dev/null || true
|
||||
echo -e "${GREEN}✅ Backup erstellt: $SSL_DIR/backup/cert_backup_$TIMESTAMP.pem${NC}"
|
||||
fi
|
||||
|
||||
# Erstelle Raspberry Pi spezifische OpenSSL-Konfiguration
|
||||
echo -e "${YELLOW}📝 Erstelle browser-kompatible OpenSSL-Konfiguration...${NC}"
|
||||
|
||||
cat > "$SSL_DIR/openssl_raspberry_fix.conf" << 'EOF'
|
||||
[req]
|
||||
distinguished_name = req_distinguished_name
|
||||
req_extensions = v3_req
|
||||
prompt = no
|
||||
|
||||
[req_distinguished_name]
|
||||
C = DE
|
||||
ST = Baden-Wuerttemberg
|
||||
L = Stuttgart
|
||||
O = Mercedes-Benz AG
|
||||
OU = MYP Druckerverwaltung
|
||||
CN = m040tbaraspi001
|
||||
|
||||
[v3_req]
|
||||
# Basic Constraints - KRITISCH für Browser-Kompatibilität
|
||||
basicConstraints = critical, CA:FALSE
|
||||
|
||||
# Key Usage - KRITISCH für ERR_SSL_KEY_USAGE_INCOMPATIBLE Fix
|
||||
keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement
|
||||
|
||||
# Extended Key Usage - TLS Server Authentication
|
||||
extendedKeyUsage = critical, serverAuth, clientAuth
|
||||
|
||||
# Subject Alternative Names - Alle Raspberry Pi Domains/IPs
|
||||
subjectAltName = critical, @alt_names
|
||||
|
||||
# Netscape Extensions für Legacy-Browser
|
||||
nsCertType = server
|
||||
nsComment = "MYP Raspberry Pi SSL Fix - ERR_SSL_KEY_USAGE_INCOMPATIBLE Lösung"
|
||||
|
||||
[alt_names]
|
||||
# Lokale Entwicklung
|
||||
DNS.1 = localhost
|
||||
DNS.2 = *.localhost
|
||||
IP.1 = 127.0.0.1
|
||||
IP.2 = ::1
|
||||
|
||||
# Raspberry Pi Hostname
|
||||
DNS.3 = m040tbaraspi001
|
||||
DNS.4 = m040tbaraspi001.local
|
||||
DNS.5 = raspberrypi
|
||||
DNS.6 = raspberrypi.local
|
||||
|
||||
# Intranet-Domain
|
||||
DNS.7 = m040tbaraspi001.de040.corpintra.net
|
||||
DNS.8 = *.de040.corpintra.net
|
||||
|
||||
# Raspberry Pi typische IPs
|
||||
IP.3 = 0.0.0.0
|
||||
IP.4 = 192.168.1.0/24
|
||||
IP.5 = 10.0.0.0/8
|
||||
EOF
|
||||
|
||||
echo -e "${GREEN}✅ OpenSSL-Konfiguration erstellt${NC}"
|
||||
|
||||
# Generiere Private Key
|
||||
echo -e "${YELLOW}🔑 Generiere Private Key (RSA 2048)...${NC}"
|
||||
openssl genrsa -out "$KEY_PATH" 2048
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
echo -e "${GREEN}✅ Private Key generiert${NC}"
|
||||
else
|
||||
echo -e "${RED}❌ Private Key Generierung fehlgeschlagen!${NC}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Generiere browser-kompatibles Zertifikat
|
||||
echo -e "${YELLOW}📜 Generiere browser-kompatibles Zertifikat...${NC}"
|
||||
openssl req -new -x509 \
|
||||
-key "$KEY_PATH" \
|
||||
-out "$CERT_PATH" \
|
||||
-days 365 \
|
||||
-config "$SSL_DIR/openssl_raspberry_fix.conf" \
|
||||
-extensions v3_req \
|
||||
-sha256
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
echo -e "${GREEN}✅ Browser-kompatibles Zertifikat generiert${NC}"
|
||||
else
|
||||
echo -e "${RED}❌ Zertifikat-Generierung fehlgeschlagen!${NC}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Berechtigungen setzen
|
||||
echo -e "${YELLOW}🔒 Setze korrekte Berechtigungen...${NC}"
|
||||
chown root:root "$CERT_PATH" "$KEY_PATH"
|
||||
chmod 644 "$CERT_PATH" # Alle können lesen
|
||||
chmod 600 "$KEY_PATH" # Nur root kann lesen
|
||||
echo -e "${GREEN}✅ Berechtigungen gesetzt${NC}"
|
||||
|
||||
# Aufräumen
|
||||
rm -f "$SSL_DIR/openssl_raspberry_fix.conf"
|
||||
|
||||
# Validierung der Browser-Kompatibilität
|
||||
echo ""
|
||||
echo -e "${CYAN}=========================================================${NC}"
|
||||
echo -e "${CYAN}🔍 BROWSER-KOMPATIBILITÄTS-VALIDIERUNG${NC}"
|
||||
echo -e "${CYAN}=========================================================${NC}"
|
||||
|
||||
echo -e "${YELLOW}Prüfe Zertifikat-Extensions...${NC}"
|
||||
|
||||
# Extrahiere Zertifikat-Informationen
|
||||
CERT_INFO=$(openssl x509 -in "$CERT_PATH" -noout -text 2>/dev/null)
|
||||
|
||||
# Browser-Kompatibilitäts-Checks
|
||||
declare -A checks=(
|
||||
["Digital Signature"]="Digital Signature"
|
||||
["Key Encipherment"]="Key Encipherment"
|
||||
["Key Agreement"]="Key Agreement"
|
||||
["TLS Web Server Authentication"]="TLS Web Server Authentication"
|
||||
["Subject Alternative Name"]="Subject Alternative Name"
|
||||
["CA:FALSE"]="CA:FALSE"
|
||||
["SHA-256 Signature"]="sha256WithRSAEncryption"
|
||||
)
|
||||
|
||||
all_passed=true
|
||||
|
||||
for check_name in "${!checks[@]}"; do
|
||||
pattern="${checks[$check_name]}"
|
||||
if echo "$CERT_INFO" | grep -q "$pattern"; then
|
||||
echo -e " ${GREEN}✅ $check_name${NC}"
|
||||
else
|
||||
echo -e " ${RED}❌ $check_name${NC}"
|
||||
all_passed=false
|
||||
fi
|
||||
done
|
||||
|
||||
# Zusätzliche Raspberry Pi spezifische Checks
|
||||
echo ""
|
||||
echo -e "${YELLOW}Prüfe Raspberry Pi spezifische Konfiguration...${NC}"
|
||||
|
||||
# Hostname Check
|
||||
if echo "$CERT_INFO" | grep -q "m040tbaraspi001"; then
|
||||
echo -e " ${GREEN}✅ Raspberry Pi Hostname (m040tbaraspi001)${NC}"
|
||||
else
|
||||
echo -e " ${RED}❌ Raspberry Pi Hostname fehlt${NC}"
|
||||
fi
|
||||
|
||||
# Localhost Check
|
||||
if echo "$CERT_INFO" | grep -q "localhost"; then
|
||||
echo -e " ${GREEN}✅ Localhost Support${NC}"
|
||||
else
|
||||
echo -e " ${RED}❌ Localhost Support fehlt${NC}"
|
||||
fi
|
||||
|
||||
# Intranet Domain Check
|
||||
if echo "$CERT_INFO" | grep -q "de040.corpintra.net"; then
|
||||
echo -e " ${GREEN}✅ Intranet Domain Support${NC}"
|
||||
else
|
||||
echo -e " ${YELLOW}⚠️ Intranet Domain möglicherweise nicht verfügbar${NC}"
|
||||
fi
|
||||
|
||||
# Zertifikat-Details anzeigen
|
||||
echo ""
|
||||
echo -e "${BLUE}📋 Zertifikat-Details:${NC}"
|
||||
openssl x509 -in "$CERT_PATH" -noout -subject -dates
|
||||
|
||||
# Systemd Service Integration
|
||||
echo ""
|
||||
echo -e "${YELLOW}🔄 Integriere mit MYP Services...${NC}"
|
||||
|
||||
# Prüfe ob MYP App Service existiert
|
||||
if systemctl list-units --type=service | grep -q "myp-app"; then
|
||||
echo -e "${BLUE}🔄 Starte MYP App Service neu...${NC}"
|
||||
systemctl restart myp-app.service
|
||||
echo -e "${GREEN}✅ MYP App Service neu gestartet${NC}"
|
||||
fi
|
||||
|
||||
# Prüfe ob MYP Kiosk Service existiert
|
||||
if systemctl list-units --type=service | grep -q "myp-kiosk"; then
|
||||
echo -e "${BLUE}🔄 Starte MYP Kiosk Service neu...${NC}"
|
||||
systemctl restart myp-kiosk.service
|
||||
echo -e "${GREEN}✅ MYP Kiosk Service neu gestartet${NC}"
|
||||
fi
|
||||
|
||||
# Abschlussbericht
|
||||
echo ""
|
||||
if [ "$all_passed" = true ]; then
|
||||
echo -e "${GREEN}=========================================================${NC}"
|
||||
echo -e "${GREEN}🎉 SSL-FIX ERFOLGREICH ABGESCHLOSSEN!${NC}"
|
||||
echo -e "${GREEN}=========================================================${NC}"
|
||||
else
|
||||
echo -e "${YELLOW}=========================================================${NC}"
|
||||
echo -e "${YELLOW}⚠️ SSL-FIX ABGESCHLOSSEN (mit Warnungen)${NC}"
|
||||
echo -e "${YELLOW}=========================================================${NC}"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo -e "${CYAN}📊 ERGEBNIS:${NC}"
|
||||
echo -e " 📄 Zertifikat: $CERT_PATH"
|
||||
echo -e " 🔑 Private Key: $KEY_PATH"
|
||||
echo -e " 📅 Gültig bis: $(date -d '+365 days' '+%Y-%m-%d')"
|
||||
echo ""
|
||||
|
||||
echo -e "${CYAN}🌐 NÄCHSTE SCHRITTE:${NC}"
|
||||
echo -e "${BLUE}1. Browser-Cache auf CLIENT-SYSTEM leeren:${NC}"
|
||||
echo -e " • Chrome/Edge: Strg+Shift+Del → 'Gesamte Zeit' → alle Optionen"
|
||||
echo -e " • Firefox: Strg+Shift+Del → 'Alles' auswählen"
|
||||
echo ""
|
||||
echo -e "${BLUE}2. Zugriff testen:${NC}"
|
||||
echo -e " • Lokal: https://localhost:5000"
|
||||
echo -e " • Intranet: https://m040tbaraspi001.de040.corpintra.net"
|
||||
echo ""
|
||||
echo -e "${BLUE}3. Bei SSL-Warnung im Browser:${NC}"
|
||||
echo -e " • 'Erweitert' → 'Weiter zu [hostname] (unsicher)'"
|
||||
echo ""
|
||||
echo -e "${GREEN}💡 Der Fehler ERR_SSL_KEY_USAGE_INCOMPATIBLE sollte behoben sein!${NC}"
|
||||
echo ""
|
||||
|
||||
# System-Info für Debugging
|
||||
echo -e "${BLUE}🔍 System-Informationen:${NC}"
|
||||
echo -e " 📟 Hostname: $(hostname)"
|
||||
echo -e " 🌐 IP-Adressen: $(hostname -I | tr ' ' '\n' | head -3 | tr '\n' ' ')"
|
||||
echo -e " 🐧 OS: $(cat /etc/os-release | grep PRETTY_NAME | cut -d'"' -f2)"
|
||||
echo -e " 🔐 OpenSSL: $(openssl version)"
|
||||
echo ""
|
||||
|
||||
# Firewall-Check
|
||||
if command -v ufw &> /dev/null; then
|
||||
echo -e "${YELLOW}🔥 Prüfe Firewall (UFW)...${NC}"
|
||||
ufw_status=$(ufw status | grep "Status:")
|
||||
if echo "$ufw_status" | grep -q "active"; then
|
||||
echo -e " 🔥 UFW aktiv - prüfe HTTPS Port 443..."
|
||||
if ufw status | grep -q "443"; then
|
||||
echo -e " ${GREEN}✅ Port 443 (HTTPS) ist geöffnet${NC}"
|
||||
else
|
||||
echo -e " ${YELLOW}⚠️ Port 443 (HTTPS) möglicherweise blockiert${NC}"
|
||||
echo -e " 💡 Öffne mit: sudo ufw allow 443"
|
||||
fi
|
||||
else
|
||||
echo -e " ${GREEN}✅ UFW inaktiv - keine Firewall-Blockierung${NC}"
|
||||
fi
|
||||
fi
|
||||
|
||||
echo -e "${GREEN}🏁 SSL-Fix für Raspberry Pi abgeschlossen!${NC}"
|
||||
@ -1574,11 +1574,16 @@ install_python_packages_with_break_system() {
|
||||
# Mehrere Installationsversuche mit verschiedenen Strategien
|
||||
local install_success=false
|
||||
|
||||
# Strategie 1: Mit --break-system-packages und --force-reinstall
|
||||
if python3.11 -m pip install -r "$CURRENT_DIR/requirements.txt" --break-system-packages --force-reinstall --no-cache-dir; then
|
||||
install_success=true
|
||||
success "✅ requirements.txt mit --break-system-packages erfolgreich installiert"
|
||||
else
|
||||
# Erstelle bereinigte requirements.txt für Installation
|
||||
if [ ! -f "$CURRENT_DIR/requirements_clean.txt" ]; then
|
||||
create_clean_requirements
|
||||
fi
|
||||
|
||||
# Strategie 1: Mit --break-system-packages und bereinigter requirements.txt
|
||||
if python3.11 -m pip install -r "$CURRENT_DIR/requirements_clean.txt" --break-system-packages --force-reinstall --no-cache-dir; then
|
||||
install_success=true
|
||||
success "✅ Bereinigte requirements.txt mit --break-system-packages erfolgreich installiert"
|
||||
else
|
||||
warning "⚠️ Strategie 1 fehlgeschlagen, versuche Alternative..."
|
||||
|
||||
# Strategie 2: Bereinigte Einzelinstallation
|
||||
|
||||
Reference in New Issue
Block a user