Moze li neko da mi kaze sta ovde nije u redu? Sve certifikate sam osvezio i na Google mi ne prijavljuje nikakvu gresku u certifikatima kada ga posetim preko openssl ali kada ovaj sajt posetim dobijam gresku:
Ako idem direktno na sajt https://www.bollywoodtv.ro preko Chrome u uglu postoji dugme na koje kliknem i prikazuje da je konnekcija sigurna i da je certifikat validan, pa o cemu se onda radi ne razumem? Ili na primer ako posetim google nema greske sa mojim certifikatima, radi i openssl i curl ali nije mi jasno zasto preko Chrome prijavljuje validan certifikat? Ovo je ok na Google kad idem:
U cemu je problem zna li neko? Sta znaci ono "verify error:num=21:unable to verify the first certificate" ?? Koji je to first certifikat? Ciji je to certifikat? Validnost certifikata na https://www.bollywoodtv.ro preko Chrome mozete videti da je validan, u cemu je problem ne razumem. Ono sto ja hocu ustvri jeste pristup RTMP serveru za Mooz Dance preko rtmp.digitalbroadcast.ro ciji je cerifikat www.bollywoodtv.ro istu gresku prijavljuje pa sam probao da pristupim www.bollywoodtv.ro ali isti problem. Da je do certifikata prijavila bi mi se greska i na Google? Uopste mi nije jasno o cemu se radi.
Code:
openssl s_client -showcerts -servername www.bollywoodtv.ro -connect www.bollywoodtv.ro:443
CONNECTED(00000003)
depth=0 CN = www.bollywoodtv.ro
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = www.bollywoodtv.ro
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
0 s:/CN=www.bollywoodtv.ro
i:/C=US/O=Let's Encrypt/CN=R10
-----BEGIN CERTIFICATE-----
MIIFHjCCBAagAwIBAgISA6O2BbBP0aQEhTAsRrQOPtGMMA0GCSqGSIb3DQEBCwUA
MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD
EwNSMTAwHhcNMjQwNjA3MTgzNDUwWhcNMjQwOTA1MTgzNDQ5WjAdMRswGQYDVQQD
ExJ3d3cuYm9sbHl3b29kdHYucm8wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQC8aKb8GbBP51aAeZ1PynTpF9LKxj+NcNqPArwRP2Z86SvFBFlrZ/6boI70
UXD2kPFGqaAcOp/lDfFPHOw75ugJOuPKbk40QXNVEyQU/NHtYwWP6hP269+RlSq7
IsrxswsJU1Vn90jonX//Ua7t60UkMtXa717cj6o1+PdIlnoRKubJ38tnYsCTUXyv
vrK7E4zjFFxJ8AD7bWNpCsKUULxY86IWJXbZeSXlP8XaiOuj+N0c6M7yqct0Xuso
7a/2rByC30BUCTItKbgee2y+SFlOpJjwftNM6v8xKmRIFQaWKkutwpXthsp77RBl
AtmCqCvW93/0K3TpE4Y6KZg3Tbx1AgMBAAGjggJAMIICPDAOBgNVHQ8BAf8EBAMC
BaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAw
HQYDVR0OBBYEFHqzLYoswY7GAPK7flTG9/8bbJg9MB8GA1UdIwQYMBaAFLu8w0el
5LypxsOkcgwQjaI14cjoMFcGCCsGAQUFBwEBBEswSTAiBggrBgEFBQcwAYYWaHR0
cDovL3IxMC5vLmxlbmNyLm9yZzAjBggrBgEFBQcwAoYXaHR0cDovL3IxMC5pLmxl
bmNyLm9yZy8wRwYDVR0RBEAwPoIOYm9sbHl3b29kdHYucm+CGHJ0bXAuZGlnaXRh
bGJyb2FkY2FzdC5yb4ISd3d3LmJvbGx5d29vZHR2LnJvMBMGA1UdIAQMMAowCAYG
Z4EMAQIBMIIBBAYKKwYBBAHWeQIEAgSB9QSB8gDwAHUAPxdLT9ciR1iUHWUchL4N
Eu2QN38fhWrrwb8ohez4ZG4AAAGP9DJXhQAABAMARjBEAiA1uWWfoKp6V6i3Ud69
EsDsh31od/KR4/4wPbX9m709UAIgFC9CgCw+u/u2vXNo2guUjSVYNS3jq3EC7cHo
FPcVmx4AdwDuzdBk1dsazsVct520zROiModGfLzs3sNRSFlGcR+1mwAAAY/0MleO
AAAEAwBIMEYCIQDOPwR2bRtAN2znzB72F6w28+PV3iINIK4bj7SBQnXx4AIhAPbf
2QecJRls74RJ6sACeR+jKTfexeNE/K7pURQew3wiMA0GCSqGSIb3DQEBCwUAA4IB
AQDN4LrUo/Gk64cbq/VvzWpS4b+wX9/nJ0qrunvjW/PoHNJxwOhe3qvH8sa7R8Dc
BKrH2+BVZJlJ/r+/16hck1AtK/IrkjTJl44yOgirpoF2+w6PYsJTBFWQcNwNp1Jb
VWPX44WKn/4ZkM/jyZ4bdoSQpB/WSYvmN1EUC3hFAhOks8EFxpy3aM9nkx1zHjgB
FJnJRHiiTuOuwReeGsF5UlfCjWlXmLI/MSAm687Y/+ReiZSTYsGM/qAy8s4A6yj1
92gcVo6g4BjJxK/tEicjc2bJ92UEDfTFPAAIDe3Q6OLDOjnTWhV/QBt//rMlpy7+
hbipZJedBySxXSXfvNenw4KB
-----END CERTIFICATE-----
1 s:/C=US/O=Let's Encrypt/CN=R3
i:/C=US/O=Internet Security Research Group/CN=ISRG Root X1
-----BEGIN CERTIFICATE-----
MIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAw
WhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
RW5jcnlwdDELMAkGA1UEAxMCUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQC7AhUozPaglNMPEuyNVZLD+ILxmaZ6QoinXSaqtSu5xUyxr45r+XXIo9cP
R5QUVTVXjJ6oojkZ9YI8QqlObvU7wy7bjcCwXPNZOOftz2nwWgsbvsCUJCWH+jdx
sxPnHKzhm+/b5DtFUkWWqcFTzjTIUu61ru2P3mBw4qVUq7ZtDpelQDRrK9O8Zutm
NHz6a4uPVymZ+DAXXbpyb/uBxa3Shlg9F8fnCbvxK/eG3MHacV3URuPMrSXBiLxg
Z3Vms/EY96Jc5lP/Ooi2R6X/ExjqmAl3P51T+c8B5fWmcBcUr2Ok/5mzk53cU6cG
/kiFHaFpriV1uxPMUgP17VGhi9sVAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMC
AYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYB
Af8CAQAwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB8GA1UdIwQYMBaA
FHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw
AoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRw
Oi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQB
gt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFyk5HPqP3hUSFvNVneLKYY611TR6W
PTNlclQtgaDqw+34IL9fzLdwALduO/ZelN7kIJ+m74uyA+eitRY8kc607TkC53wl
ikfmZW4/RvTZ8M6UK+5UzhK8jCdLuMGYL6KvzXGRSgi3yLgjewQtCPkIVz6D2QQz
CkcheAmCJ8MqyJu5zlzyZMjAvnnAT45tRAxekrsu94sQ4egdRCnbWSDtY7kh+BIm
lJNXoB1lBMEKIq4QDUOXoRgffuDghje1WrG9ML+Hbisq/yFOGwXD9RiX8F6sw6W4
avAuvDszue5L3sz85K+EC4Y/wFVDNvZo4TYXao6Z0f+lQKc0t8DQYzk1OXVu8rp2
yJMC6alLbBfODALZvYH7n7do1AZls4I9d1P4jnkDrQoxB3UqQ9hVl3LEKQ73xF1O
yK5GhDDX8oVfGKF5u+decIsH4YaTw7mP3GFxJSqv3+0lUFJoi5Lc5da149p90Ids
hCExroL1+7mryIkXPeFM5TgO9r0rvZaBFOvV2z0gp35Z0+L4WPlbuEjN/lxPFin+
HlUjr8gRsI3qfJOQFy/9rKIJR0Y/8Omwt/8oTWgy1mdeHmmjk7j1nYsvC9JSQ6Zv
MldlTTKB3zhThV1+XWYp6rjd5JW1zbVWEkLNxE7GJThEUG3szgBVGP7pSWTUTsqX
nLRbwHOoq7hHwg==
-----END CERTIFICATE-----
---
Server certificate
subject=/CN=www.bollywoodtv.ro
issuer=/C=US/O=Let's Encrypt/CN=R10
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 3329 bytes and written 329 bytes
Verification error: unable to verify the first certificate
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID: 0FEFB1A23140C8B79BBAF727ED6A0B8A6E173108A294C02ED54A765A3BEA1154
Session-ID-ctx:
Master-Key: 5D6A34D08DB9AAEC47AD2470C24EBEB32C6C41CF55A886CD5E656F8510759AEBC7D2B1CA3225D127960F58B78187343F
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 300 (seconds)
TLS session ticket:
0000 - a5 fd 85 46 cd 0c 3f f4-c9 29 0b fc e1 83 8f 82 ...F..?..)......
0010 - b2 d6 fc 53 a5 ff 9d 64-a1 bb c9 cd ec 21 0b 52 ...S...d.....!.R
0020 - b7 cd 67 15 b7 8a 48 4e-b3 2b 34 b6 79 84 d1 ee ..g...HN.+4.y...
0030 - 94 fa 31 77 ee 59 e7 55-56 7c 77 94 90 09 9c a1 ..1w.Y.UV|w.....
0040 - 9b 27 b4 3c 29 c9 b2 ba-6f bc 08 31 06 8e e8 e2 .'.<)...o..1....
0050 - 03 fd f6 85 68 ae e5 de-80 0d 97 74 f7 2a 0f b8 ....h......t.*..
0060 - 62 e7 9a cc 82 7e 8f 36-78 a3 c6 46 dd 76 d7 27 b....~.6x..F.v.'
0070 - a6 96 9c 03 d4 8b 3f cd-3f 62 35 93 71 b8 c8 76 ......?.?b5.q..v
0080 - a9 f9 1f 67 fc ea 20 5f-0b d1 c9 b6 f9 1f 71 12 ...g.. _......q.
0090 - 67 11 87 10 f2 fe 38 f4-09 b4 70 8d f0 bc 5a d0 g.....8...p...Z.
00a0 - fd c5 4d cb 21 db 9d 6b-47 58 6c 87 20 8d 7f 0b ..M.!..kGXl. ...
00b0 - 8b c7 89 19 3e 44 b6 bb-77 10 10 d5 23 42 6e d8 ....>D..w...#Bn.
00c0 - 94 db 0e 1e d4 8d c9 3b-c8 a5 4c 9c c2 39 cc 23 .......;..L..9.#
Start Time: 1720024306
Timeout : 7200 (sec)
Verify return code: 21 (unable to verify the first certificate)
Extended master secret: no
---
closedAko idem direktno na sajt https://www.bollywoodtv.ro preko Chrome u uglu postoji dugme na koje kliknem i prikazuje da je konnekcija sigurna i da je certifikat validan, pa o cemu se onda radi ne razumem? Ili na primer ako posetim google nema greske sa mojim certifikatima, radi i openssl i curl ali nije mi jasno zasto preko Chrome prijavljuje validan certifikat? Ovo je ok na Google kad idem:
Code:
openssl s_client -connect www.google.com:443
CONNECTED(00000003)
depth=2 C = US, O = Google Trust Services LLC, CN = GTS Root R1
verify return:1
depth=1 C = US, O = Google Trust Services, CN = WR2
verify return:1
depth=0 CN = www.google.com
verify return:1
---
Certificate chain
0 s:/CN=www.google.com
i:/C=US/O=Google Trust Services/CN=WR2
1 s:/C=US/O=Google Trust Services/CN=WR2
i:/C=US/O=Google Trust Services LLC/CN=GTS Root R1
2 s:/C=US/O=Google Trust Services LLC/CN=GTS Root R1
i:/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFIjCCBAqgAwIBAgIRAMxC0+JW7G9UEKcaPjzMboIwDQYJKoZIhvcNAQELBQAw
OzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFUdvb2dsZSBUcnVzdCBTZXJ2aWNlczEM
MAoGA1UEAxMDV1IyMB4XDTI0MDYxMzE2MzYxMFoXDTI0MDkwNTE2MzYwOVowGTEX
MBUGA1UEAxMOd3d3Lmdvb2dsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
ggEKAoIBAQDeRMq3kao5CsBxd1tvuY07+NoOWxyh2WL3Kmu/BvJAtjv1QO8Eies8
RG2xgrbcqThBVuC1nyKh838xOZynkEvjOMCqbY+OMWTygWXTtriA3UH+OyFWjdGV
NGNFsO1rh9Ot5jLFVVYqOLdqAbf5M4b3L263auNiythf3Jt8F2vvJH+Tx1XjJ8Ui
eGPHJB/J++x1a0ame9uPQCYjt2Z7mZO3iFaREQasUAzc4m5DmV1CQ1Ik27WJMBd8
dclNduQ/seguMB+ZI1yUqhjFkGA9F6G+k1ZOvk4jV1JWB063asGqa/8hof4tUC+8
mtF+2dsVKCYkH4Uirsvujne2RwhbRJgpAgMBAAGjggJBMIICPTAOBgNVHQ8BAf8E
BAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4E
FgQUYZSYxSupxUQpLD4CKYdIZf0rSQYwHwYDVR0jBBgwFoAU3hse7XkV1D43JMMh
u+w0OW1CsjAwWAYIKwYBBQUHAQEETDBKMCEGCCsGAQUFBzABhhVodHRwOi8vby5w
a2kuZ29vZy93cjIwJQYIKwYBBQUHMAKGGWh0dHA6Ly9pLnBraS5nb29nL3dyMi5j
cnQwGQYDVR0RBBIwEIIOd3d3Lmdvb2dsZS5jb20wEwYDVR0gBAwwCjAIBgZngQwB
AgEwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2MucGtpLmdvb2cvd3IyL29RNm55
cjhGMG0wLmNybDCCAQQGCisGAQQB1nkCBAIEgfUEgfIA8AB2AHb/iD8KtvuVUcJh
zPWHujS0pM27KdxoQgqf5mdMWjp0AAABkBKr36sAAAQDAEcwRQIgH0lZEGnPYkXq
ILCMmhSCpxngCdz+iVp/kZpclkuUzOUCIQC8JlOEG95BJbWDN6LcfeKoLX+0tTu3
ZerA0CmW4GOO6AB2ANq2v2s/tbYin5vCu1xr6HCRcWy7UYSFNL2kPTBI1/urAAAB
kBKr37UAAAQDAEcwRQIhANMA5i5nw0+xYV62uReNbwAnDDwnolPuu3LQI1IDvS84
AiAnM9R4oz8Vddj7LndKE0gmcxWY/0/+Y5JsxMaiQc32STANBgkqhkiG9w0BAQsF
AAOCAQEALkZUTUA6telA9MUX7uDzxBak/pxP6v4WR9HTFqI1+/bNBR1SIVEX9H18
JSxSJKWn8AyLuwIKWQW3cdOVHiR5eVAjt31zVu4p78P+yvYwBvAZqkYk2Efmi0dD
lGr4BAFODcscQckDZZJMzS3xU3CbGQVuvpvq/t+HlkbvQ5EQCEITBTyhy73Y8bnG
S+zTmbh+s1YMOwyAbntTSp95ie1wjsmXuG42ivMXYOYcjBOdJGZn3h11GIAtM7NI
qTxoe+USlTLr+LnWPIK1J3om85FMLI8sIZrH9TdqgGSlrReATO6WvEmfdNRFMPdl
AUn4I8WGiqD+Knahq3TfwJI1wc/9dw==
-----END CERTIFICATE-----
subject=/CN=www.google.com
issuer=/C=US/O=Google Trust Services/CN=WR2
---
No client certificate CA names sent
Peer signing digest: SHA256
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 4685 bytes and written 261 bytes
Verification: OK
---
New, TLSv1.2, Cipher is ECDHE-RSA-CHACHA20-POLY1305
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-CHACHA20-POLY1305
Session-ID: 1798D0F0C2782819A7D6250161BAF9D5EB8802B217A4EA42192B85D62C9B6FA9
Session-ID-ctx:
Master-Key: D17430D171C5C7A25B44C4A393DDACFC425E88B59139008C63097C288D5EF771F145EFE11FAE9447277F9C5B630A9CB2
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 100800 (seconds)
TLS session ticket:
0000 - 02 78 c2 f9 0f c2 a0 48-ba 4d de 4a 05 95 7d c3 .x.....H.M.J..}.
0010 - 87 06 80 46 b2 4c 06 44-3a 61 51 20 84 c3 65 ea ...F.L.D:aQ ..e.
0020 - 17 e6 ac 70 84 80 75 eb-e9 24 5b 9d 67 3b 0e 74 ...p..u..$[.g;.t
0030 - 76 d4 b4 7d c8 6b d9 16-ff 61 d1 17 65 62 69 69 v..}.k...a..ebii
0040 - de bc be ff 70 e4 10 e9-a4 d5 6b 3a d0 df 3a 03 ....p.....k:..:.
0050 - 7f ba e9 56 aa 72 56 f2-0d 3b 58 80 40 94 03 c5 ...V.rV..;X.@...
0060 - 43 ef b4 56 c5 3b db 54-f8 bb 71 0f ab 25 9a e6 C..V.;.T..q..%..
0070 - df 10 65 85 bf b6 00 f1-1f e7 b6 99 18 df 5c ed ..e...........\.
0080 - d0 a4 32 19 e6 de 52 f7-e3 bd 4a 87 97 29 73 ac ..2...R...J..)s.
0090 - 04 3d 8b 89 a3 3c 3b 04-78 23 0b 20 94 c1 1c 6b .=...<;.x#. ...k
00a0 - ce 67 d4 47 5a a5 9c e1-83 00 1d d0 c4 ee c6 25 .g.GZ..........%
00b0 - 1f b3 a3 49 46 28 a4 1d-06 a0 d5 22 f9 e3 79 40 ...IF(....."..y@
00c0 - 9a f1 38 1e f9 68 6b 7f-da cd 39 f8 58 72 b4 d2 ..8..hk...9.Xr..
00d0 - 87 63 5f 49 0c 73 5a d7-3e e1 46 52 41 c7 4e 92 .c_I.sZ.>.FRA.N.
00e0 - 6e 08 ca dd 49 n...I
Start Time: 1720022593
Timeout : 7200 (sec)
Verify return code: 0 (ok)
Extended master secret: yes
---
read:errno=0U cemu je problem zna li neko? Sta znaci ono "verify error:num=21:unable to verify the first certificate" ?? Koji je to first certifikat? Ciji je to certifikat? Validnost certifikata na https://www.bollywoodtv.ro preko Chrome mozete videti da je validan, u cemu je problem ne razumem. Ono sto ja hocu ustvri jeste pristup RTMP serveru za Mooz Dance preko rtmp.digitalbroadcast.ro ciji je cerifikat www.bollywoodtv.ro istu gresku prijavljuje pa sam probao da pristupim www.bollywoodtv.ro ali isti problem. Da je do certifikata prijavila bi mi se greska i na Google? Uopste mi nije jasno o cemu se radi.