305 lines
9.7 KiB
Bash
305 lines
9.7 KiB
Bash
#!/bin/bash
|
|
# MYP SSL Browser-Kompatibilitäts-Fix für Raspberry Pi
|
|
# Löst ERR_SSL_KEY_USAGE_INCOMPATIBLE Fehler auf Linux-Zielsystem
|
|
|
|
set -e # Beende bei Fehler
|
|
|
|
# Farbcodes für Output
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
BLUE='\033[0;34m'
|
|
CYAN='\033[0;36m'
|
|
NC='\033[0m' # No Color
|
|
|
|
echo -e "${CYAN}=========================================================${NC}"
|
|
echo -e "${CYAN}MYP SSL BROWSER-KOMPATIBILITÄTS-FIX für Raspberry Pi${NC}"
|
|
echo -e "${CYAN}Löst ERR_SSL_KEY_USAGE_INCOMPATIBLE Fehler${NC}"
|
|
echo -e "${CYAN}=========================================================${NC}"
|
|
echo ""
|
|
|
|
# Aktuelles Verzeichnis und Pfade
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
APP_DIR="/opt/myp"
|
|
SSL_DIR="$APP_DIR/ssl"
|
|
CERT_PATH="$SSL_DIR/cert.pem"
|
|
KEY_PATH="$SSL_DIR/key.pem"
|
|
|
|
echo -e "${BLUE}📁 Arbeitsverzeichnis: $SCRIPT_DIR${NC}"
|
|
echo -e "${BLUE}📁 App-Verzeichnis: $APP_DIR${NC}"
|
|
echo -e "${BLUE}🔐 SSL-Verzeichnis: $SSL_DIR${NC}"
|
|
echo ""
|
|
|
|
# Prüfe ob als root/sudo ausgeführt wird
|
|
if [[ $EUID -ne 0 ]]; then
|
|
echo -e "${RED}❌ Dieses Skript muss als root ausgeführt werden!${NC}"
|
|
echo -e "${YELLOW}💡 Verwende: sudo $0${NC}"
|
|
exit 1
|
|
fi
|
|
|
|
# Prüfe ob OpenSSL verfügbar ist
|
|
if ! command -v openssl &> /dev/null; then
|
|
echo -e "${RED}❌ OpenSSL ist nicht installiert!${NC}"
|
|
echo -e "${YELLOW}📦 Installiere OpenSSL...${NC}"
|
|
apt update && apt install -y openssl
|
|
|
|
if ! command -v openssl &> /dev/null; then
|
|
echo -e "${RED}❌ OpenSSL Installation fehlgeschlagen!${NC}"
|
|
exit 1
|
|
fi
|
|
echo -e "${GREEN}✅ OpenSSL erfolgreich installiert${NC}"
|
|
fi
|
|
|
|
# SSL-Verzeichnis erstellen
|
|
echo -e "${YELLOW}📁 Erstelle SSL-Verzeichnis...${NC}"
|
|
mkdir -p "$SSL_DIR"
|
|
mkdir -p "$SSL_DIR/backup"
|
|
|
|
# Backup existierender Zertifikate
|
|
if [ -f "$CERT_PATH" ]; then
|
|
TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
|
|
echo -e "${YELLOW}💾 Erstelle Backup der alten Zertifikate...${NC}"
|
|
cp "$CERT_PATH" "$SSL_DIR/backup/cert_backup_$TIMESTAMP.pem" 2>/dev/null || true
|
|
cp "$KEY_PATH" "$SSL_DIR/backup/key_backup_$TIMESTAMP.pem" 2>/dev/null || true
|
|
echo -e "${GREEN}✅ Backup erstellt: $SSL_DIR/backup/cert_backup_$TIMESTAMP.pem${NC}"
|
|
fi
|
|
|
|
# Erstelle Raspberry Pi spezifische OpenSSL-Konfiguration
|
|
echo -e "${YELLOW}📝 Erstelle browser-kompatible OpenSSL-Konfiguration...${NC}"
|
|
|
|
cat > "$SSL_DIR/openssl_raspberry_fix.conf" << 'EOF'
|
|
[req]
|
|
distinguished_name = req_distinguished_name
|
|
req_extensions = v3_req
|
|
prompt = no
|
|
|
|
[req_distinguished_name]
|
|
C = DE
|
|
ST = Baden-Wuerttemberg
|
|
L = Stuttgart
|
|
O = Mercedes-Benz AG
|
|
OU = MYP Druckerverwaltung
|
|
CN = m040tbaraspi001
|
|
|
|
[v3_req]
|
|
# Basic Constraints - KRITISCH für Browser-Kompatibilität
|
|
basicConstraints = critical, CA:FALSE
|
|
|
|
# Key Usage - KRITISCH für ERR_SSL_KEY_USAGE_INCOMPATIBLE Fix
|
|
keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement
|
|
|
|
# Extended Key Usage - TLS Server Authentication
|
|
extendedKeyUsage = critical, serverAuth, clientAuth
|
|
|
|
# Subject Alternative Names - Alle Raspberry Pi Domains/IPs
|
|
subjectAltName = critical, @alt_names
|
|
|
|
# Netscape Extensions für Legacy-Browser
|
|
nsCertType = server
|
|
nsComment = "MYP Raspberry Pi SSL Fix - ERR_SSL_KEY_USAGE_INCOMPATIBLE Lösung"
|
|
|
|
[alt_names]
|
|
# Lokale Entwicklung
|
|
DNS.1 = localhost
|
|
DNS.2 = *.localhost
|
|
IP.1 = 127.0.0.1
|
|
IP.2 = ::1
|
|
|
|
# Raspberry Pi Hostname
|
|
DNS.3 = m040tbaraspi001
|
|
DNS.4 = m040tbaraspi001.local
|
|
DNS.5 = raspberrypi
|
|
DNS.6 = raspberrypi.local
|
|
|
|
# Intranet-Domain
|
|
DNS.7 = m040tbaraspi001.de040.corpintra.net
|
|
DNS.8 = *.de040.corpintra.net
|
|
|
|
# Raspberry Pi typische IPs
|
|
IP.3 = 0.0.0.0
|
|
IP.4 = 192.168.1.0/24
|
|
IP.5 = 10.0.0.0/8
|
|
EOF
|
|
|
|
echo -e "${GREEN}✅ OpenSSL-Konfiguration erstellt${NC}"
|
|
|
|
# Generiere Private Key
|
|
echo -e "${YELLOW}🔑 Generiere Private Key (RSA 2048)...${NC}"
|
|
openssl genrsa -out "$KEY_PATH" 2048
|
|
|
|
if [ $? -eq 0 ]; then
|
|
echo -e "${GREEN}✅ Private Key generiert${NC}"
|
|
else
|
|
echo -e "${RED}❌ Private Key Generierung fehlgeschlagen!${NC}"
|
|
exit 1
|
|
fi
|
|
|
|
# Generiere browser-kompatibles Zertifikat
|
|
echo -e "${YELLOW}📜 Generiere browser-kompatibles Zertifikat...${NC}"
|
|
openssl req -new -x509 \
|
|
-key "$KEY_PATH" \
|
|
-out "$CERT_PATH" \
|
|
-days 365 \
|
|
-config "$SSL_DIR/openssl_raspberry_fix.conf" \
|
|
-extensions v3_req \
|
|
-sha256
|
|
|
|
if [ $? -eq 0 ]; then
|
|
echo -e "${GREEN}✅ Browser-kompatibles Zertifikat generiert${NC}"
|
|
else
|
|
echo -e "${RED}❌ Zertifikat-Generierung fehlgeschlagen!${NC}"
|
|
exit 1
|
|
fi
|
|
|
|
# Berechtigungen setzen
|
|
echo -e "${YELLOW}🔒 Setze korrekte Berechtigungen...${NC}"
|
|
chown root:root "$CERT_PATH" "$KEY_PATH"
|
|
chmod 644 "$CERT_PATH" # Alle können lesen
|
|
chmod 600 "$KEY_PATH" # Nur root kann lesen
|
|
echo -e "${GREEN}✅ Berechtigungen gesetzt${NC}"
|
|
|
|
# Aufräumen
|
|
rm -f "$SSL_DIR/openssl_raspberry_fix.conf"
|
|
|
|
# Validierung der Browser-Kompatibilität
|
|
echo ""
|
|
echo -e "${CYAN}=========================================================${NC}"
|
|
echo -e "${CYAN}🔍 BROWSER-KOMPATIBILITÄTS-VALIDIERUNG${NC}"
|
|
echo -e "${CYAN}=========================================================${NC}"
|
|
|
|
echo -e "${YELLOW}Prüfe Zertifikat-Extensions...${NC}"
|
|
|
|
# Extrahiere Zertifikat-Informationen
|
|
CERT_INFO=$(openssl x509 -in "$CERT_PATH" -noout -text 2>/dev/null)
|
|
|
|
# Browser-Kompatibilitäts-Checks
|
|
declare -A checks=(
|
|
["Digital Signature"]="Digital Signature"
|
|
["Key Encipherment"]="Key Encipherment"
|
|
["Key Agreement"]="Key Agreement"
|
|
["TLS Web Server Authentication"]="TLS Web Server Authentication"
|
|
["Subject Alternative Name"]="Subject Alternative Name"
|
|
["CA:FALSE"]="CA:FALSE"
|
|
["SHA-256 Signature"]="sha256WithRSAEncryption"
|
|
)
|
|
|
|
all_passed=true
|
|
|
|
for check_name in "${!checks[@]}"; do
|
|
pattern="${checks[$check_name]}"
|
|
if echo "$CERT_INFO" | grep -q "$pattern"; then
|
|
echo -e " ${GREEN}✅ $check_name${NC}"
|
|
else
|
|
echo -e " ${RED}❌ $check_name${NC}"
|
|
all_passed=false
|
|
fi
|
|
done
|
|
|
|
# Zusätzliche Raspberry Pi spezifische Checks
|
|
echo ""
|
|
echo -e "${YELLOW}Prüfe Raspberry Pi spezifische Konfiguration...${NC}"
|
|
|
|
# Hostname Check
|
|
if echo "$CERT_INFO" | grep -q "m040tbaraspi001"; then
|
|
echo -e " ${GREEN}✅ Raspberry Pi Hostname (m040tbaraspi001)${NC}"
|
|
else
|
|
echo -e " ${RED}❌ Raspberry Pi Hostname fehlt${NC}"
|
|
fi
|
|
|
|
# Localhost Check
|
|
if echo "$CERT_INFO" | grep -q "localhost"; then
|
|
echo -e " ${GREEN}✅ Localhost Support${NC}"
|
|
else
|
|
echo -e " ${RED}❌ Localhost Support fehlt${NC}"
|
|
fi
|
|
|
|
# Intranet Domain Check
|
|
if echo "$CERT_INFO" | grep -q "de040.corpintra.net"; then
|
|
echo -e " ${GREEN}✅ Intranet Domain Support${NC}"
|
|
else
|
|
echo -e " ${YELLOW}⚠️ Intranet Domain möglicherweise nicht verfügbar${NC}"
|
|
fi
|
|
|
|
# Zertifikat-Details anzeigen
|
|
echo ""
|
|
echo -e "${BLUE}📋 Zertifikat-Details:${NC}"
|
|
openssl x509 -in "$CERT_PATH" -noout -subject -dates
|
|
|
|
# Systemd Service Integration
|
|
echo ""
|
|
echo -e "${YELLOW}🔄 Integriere mit MYP Services...${NC}"
|
|
|
|
# Prüfe ob MYP App Service existiert
|
|
if systemctl list-units --type=service | grep -q "myp-app"; then
|
|
echo -e "${BLUE}🔄 Starte MYP App Service neu...${NC}"
|
|
systemctl restart myp-app.service
|
|
echo -e "${GREEN}✅ MYP App Service neu gestartet${NC}"
|
|
fi
|
|
|
|
# Prüfe ob MYP Kiosk Service existiert
|
|
if systemctl list-units --type=service | grep -q "myp-kiosk"; then
|
|
echo -e "${BLUE}🔄 Starte MYP Kiosk Service neu...${NC}"
|
|
systemctl restart myp-kiosk.service
|
|
echo -e "${GREEN}✅ MYP Kiosk Service neu gestartet${NC}"
|
|
fi
|
|
|
|
# Abschlussbericht
|
|
echo ""
|
|
if [ "$all_passed" = true ]; then
|
|
echo -e "${GREEN}=========================================================${NC}"
|
|
echo -e "${GREEN}🎉 SSL-FIX ERFOLGREICH ABGESCHLOSSEN!${NC}"
|
|
echo -e "${GREEN}=========================================================${NC}"
|
|
else
|
|
echo -e "${YELLOW}=========================================================${NC}"
|
|
echo -e "${YELLOW}⚠️ SSL-FIX ABGESCHLOSSEN (mit Warnungen)${NC}"
|
|
echo -e "${YELLOW}=========================================================${NC}"
|
|
fi
|
|
|
|
echo ""
|
|
echo -e "${CYAN}📊 ERGEBNIS:${NC}"
|
|
echo -e " 📄 Zertifikat: $CERT_PATH"
|
|
echo -e " 🔑 Private Key: $KEY_PATH"
|
|
echo -e " 📅 Gültig bis: $(date -d '+365 days' '+%Y-%m-%d')"
|
|
echo ""
|
|
|
|
echo -e "${CYAN}🌐 NÄCHSTE SCHRITTE:${NC}"
|
|
echo -e "${BLUE}1. Browser-Cache auf CLIENT-SYSTEM leeren:${NC}"
|
|
echo -e " • Chrome/Edge: Strg+Shift+Del → 'Gesamte Zeit' → alle Optionen"
|
|
echo -e " • Firefox: Strg+Shift+Del → 'Alles' auswählen"
|
|
echo ""
|
|
echo -e "${BLUE}2. Zugriff testen:${NC}"
|
|
echo -e " • Lokal: https://localhost:5000"
|
|
echo -e " • Intranet: https://m040tbaraspi001.de040.corpintra.net"
|
|
echo ""
|
|
echo -e "${BLUE}3. Bei SSL-Warnung im Browser:${NC}"
|
|
echo -e " • 'Erweitert' → 'Weiter zu [hostname] (unsicher)'"
|
|
echo ""
|
|
echo -e "${GREEN}💡 Der Fehler ERR_SSL_KEY_USAGE_INCOMPATIBLE sollte behoben sein!${NC}"
|
|
echo ""
|
|
|
|
# System-Info für Debugging
|
|
echo -e "${BLUE}🔍 System-Informationen:${NC}"
|
|
echo -e " 📟 Hostname: $(hostname)"
|
|
echo -e " 🌐 IP-Adressen: $(hostname -I | tr ' ' '\n' | head -3 | tr '\n' ' ')"
|
|
echo -e " 🐧 OS: $(cat /etc/os-release | grep PRETTY_NAME | cut -d'"' -f2)"
|
|
echo -e " 🔐 OpenSSL: $(openssl version)"
|
|
echo ""
|
|
|
|
# Firewall-Check
|
|
if command -v ufw &> /dev/null; then
|
|
echo -e "${YELLOW}🔥 Prüfe Firewall (UFW)...${NC}"
|
|
ufw_status=$(ufw status | grep "Status:")
|
|
if echo "$ufw_status" | grep -q "active"; then
|
|
echo -e " 🔥 UFW aktiv - prüfe HTTPS Port 443..."
|
|
if ufw status | grep -q "443"; then
|
|
echo -e " ${GREEN}✅ Port 443 (HTTPS) ist geöffnet${NC}"
|
|
else
|
|
echo -e " ${YELLOW}⚠️ Port 443 (HTTPS) möglicherweise blockiert${NC}"
|
|
echo -e " 💡 Öffne mit: sudo ufw allow 443"
|
|
fi
|
|
else
|
|
echo -e " ${GREEN}✅ UFW inaktiv - keine Firewall-Blockierung${NC}"
|
|
fi
|
|
fi
|
|
|
|
echo -e "${GREEN}🏁 SSL-Fix für Raspberry Pi abgeschlossen!${NC}" |