[zorp-hu] 3.0.8 + https

[Janos Lajos]

On Thu, Nov 24, 2005 at 01:42:26PM +0100, Kosa Attila wrote:
> On Wed, Nov 23, 2005 at 01:04:11PM +0100, Kosa Attila wrote:
> > Kernel 2.4.31, Sarge, 3.0.8 portolva Sarge-ra. Mukodni latszik
> > egyelore. De a https reszenel elakadtam. Pontosabban a sajat
> > generalasu certificate-ekkel van problema. A 2.1.8-as verzioban
> > ez a policy mukodott:
> > 
> > class IntraHttps(PsslProxy):
> >        class EmbeddedHttp(HttpProxy):
> >                def config(self):
> >                        HttpProxy.config(self)
> >                        self.transparent_mode = TRUE
> > 
> >        def config(self):
> >                self.server_need_ssl = TRUE
> >                self.server_verify_type = SSL_VERIFY_REQUIRED_TRUSTED
> >                self.server_ca_directory = '/etc/zorp/ca.crt'
> >                self.client_need_ssl = TRUE
> >                self.client_cert = '/etc/zorp/fw.crt'
> >                self.client_key = '/etc/zorp/fw.key'
> >                self.client_verify_type = SSL_VERIFY_NONE
> >                self.stack_proxy = self.EmbeddedHttp
> >                self.server_verify_depth = 2
szia,

alap kerdes, de ugye a ca directoryban megvannak a hash symlinkek?

valami ilyesmire gondolok:

ssl/ca/certs/netlock_class-b_cacert.pem
ssl/ca/certs/5a5372fc.0 -> netlock_class-b_cacert.pem

mert a hash filenevre harap az ssl konyvtar

hash-t igy tudsz kepezni pl.:
openssl x509 -noout -hash -in netlock_class-b_cacert.pem

-- 
lajjan