geedge-jira/md/OMPUB-897.md

TSG版本为2211和2212的intercept功能证书替换存在问题

ID	Creation Date	Assignee	Status
OMPUB-897	2023-04-12T14:52:36.000+0800	冯伟浩	已关闭

---

在TSG版本为22.11和22.12环境中进行测试

{color:#de350b}{color:#172b4d}22.11环境:{color}192.168.44.228{color}

{color:#de350b}{color:#172b4d}22.12环境:{color}192.168.44.29{color}

动作都是intercept,Source选择本机IP,Application选择SSL

Filter中选择SNI,FQDN的值为*.badssl.com

For trusted servers 配置文件保持不变

For untrusted servers 配置文件在Untrusted和Trusted Default进行切换

Decryption Profile 选择新建的配置文件，开启Certificate Checks四个按钮，Fail Action选择Pass-through；Dynamic Bypass全部关闭；Protocol Version全部开启   测试结果: {color:#de350b}22.11环境{color}，For untrusted servers选择Untrusted和Trusted Default配置文件后进行访问，证书都是{color:#de350b}信任证书{color} {color:#de350b}22.12环境{color}，For untrusted servers选择Untrusted和Trusted Default配置文件后进行访问，证书都是{color:#de350b}非信任证书{color}   {color:#172b4d}按照预期结果的话应该是For untrusted servers选择Untrusted配置文件后进行访问，会提示非信任证书并显示非信任证书{color} {color:#172b4d}For untrusted servers选择Trusted Default配置文件后进行访问，会显示信任证书{color} {color:#172b4d}请查看附件中的截图，并协助确认两个环境是否都存在问题？{color}gitlab commented on 2023-04-13T16:53:00.654+0800:

[冯伟浩|https://git.mesalab.cn/fengweihao] mentioned this issue in [a commit|d9e0d744cf] of [TSG / tsg-os-buildimage|https://git.mesalab.cn/tsg/tsg-os-buildimage] on branch [update-certsorte-to-v3.0.1|https://git.mesalab.cn/tsg/tsg-os-buildimage/-/tree/update-certsorte-to-v3.0.1]:{quote}更新certstore到v3.0.1, 版本修改: OMPUB-897 修复本地缓存获取非可信证书key值错误问题{quote}

---

gitlab commented on 2023-04-13T16:53:13.079+0800:

[冯伟浩|https://git.mesalab.cn/fengweihao] mentioned this issue in [a merge request|https://git.mesalab.cn/tsg/tsg-os-buildimage/-/merge_requests/1226] of [TSG / tsg-os-buildimage|https://git.mesalab.cn/tsg/tsg-os-buildimage] on branch [update-certsorte-to-v3.0.1|https://git.mesalab.cn/tsg/tsg-os-buildimage/-/tree/update-certsorte-to-v3.0.1]:{quote}更新certstore到v3.0.1, 版本修改: OMPUB-897 修复本地缓存获取非可信证书key值错误问题{quote}

---

fengweihao commented on 2023-04-13T17:03:34.796+0800:

用如下方法规避此问题：

停止本地Redis服务

systemctl stop cert-redis.service

重启certstore服务

systemctl restart certstore

---

gitlab commented on 2023-04-13T19:54:34.582+0800:

[冯伟浩|https://git.mesalab.cn/fengweihao] mentioned this issue in [a commit|cfef8e3275] of [TSG / tsg-os-buildimage|https://git.mesalab.cn/tsg/tsg-os-buildimage] on branch [update-certsorte-to-v3.0.1|https://git.mesalab.cn/tsg/tsg-os-buildimage/-/tree/update-certsorte-to-v3.0.1]:{quote}更新certstore到v3.0.1, 版本修改: OMPUB-897 修复本地缓存获取非可信证书key值错误问题{quote}

---

Attachments

Attachment: 屏幕截图(10).png

Attachment: 屏幕截图(11).png

Attachment: 屏幕截图(12).png

Attachment: 屏幕截图(13).png

Attachment: 屏幕截图(14).png

Attachment: 屏幕截图(15).png

Attachment: 屏幕截图(4).png

Attachment: 屏幕截图(5).png

Attachment: 屏幕截图(6).png

Attachment: 屏幕截图(7).png

Attachment: 屏幕截图(8).png

Attachment: 屏幕截图(9).png