Рутокен ЭЦП 2.0 + stunnel
OS = Ubuntu Server 22.04
token = Рутокен ЭЦП 2.0
openssl = OpenSSL 1.1.1f
stunnel = stunnel 5.56
Для настройки использовалась статья . Но с настройками openssl из статьи stunnel вообще не стартует. С настройками этой статьи stunnel стартует, процесс висит, но не работает.
Мои настройки такие:
openssl.cnf:
openssl_conf = openssl_def
*******
[openssl_def]
engines = engine_section
[engine_section]
rtengine = gost_section
pkcs11 = pkcs11_section
[gost_section]
engine_id = rtengine
dynamic_path = /usr/lib/x86_64-linux-gnu/librtengine.so
pkcs11_path = /usr/lib/librtpkcs11ecp.so
# rand_token = pkcs11:manufacturer=Aktiv%20Co.;model=Rutoken%20ECP;id=048883ad0cce9ce51ea7206c8f7d629a6bfdeb22
rand_token = pkcs11:model=Rutoken%20ECP?pin-value=12345678
default_algorithms = CIPHERS, DIGEST, PKEY, RAND
enable_rand = yes
[pkcs11_section]
engine_id = pkcs11
dynamic_path = /usr/lib/x86_64-linux-gnu/engines-1.1/pkcs11.so
MODULE_PATH = /usr/lib/librtpkcs11ecp.so
default_algorithms = CIPHERS, DIGEST, PKEY, RANDstunnel.conf:
; уровень логирования и путь до лог-файла
debug = 7
output = /home/tester/stunnel.log
pid = /home/tester/stunnel_cli_pid.pid
; устанавливаем протокол защиты TLSv1
sslVersion = TLSv1.1
; sslVersion = all
; подгружаем движок
engine = rtengine
; engine = pkcs11
[https]
engineId = rtengine
; engineId = pkcs11
client = yes
accept = 127.0.0.1:8000
connect = sit01.dom.test.gosuslugi.ru:10082
; путь до корневого сертификата
CAFile = /etc/stunnel/CA-SIT_2022.pem
checkHost = yes
; путь до сертификата клиента
; cert=pkcs11:model=Rutoken%20ECP?pin-value=12345678
; cert=pkcs11:id=0477dda5f69dfb917a512ff03460557567690ab7
cert = /home/tester/my_certs/rezonans_new_base64.cer
; путь до ключа на токене.
key=pkcs11:model=Rutoken%20ECP?pin-value=12345678
; key=pkcs11:id=0477dda5f69dfb917a512ff03460557567690ab7
options = NO_SSLv2
; устанавливаем верификацию
verify = 2stunnel.log:
2022.08.03 14:18:25 LOG7[ui]: Clients allowed=500
2022.08.03 14:18:25 LOG5[ui]: stunnel 5.56 on x86_64-pc-linux-gnu platform
2022.08.03 14:18:25 LOG5[ui]: Compiled with OpenSSL 1.1.1c 28 May 2019
2022.08.03 14:18:25 LOG5[ui]: Running with OpenSSL 1.1.1f 31 Mar 2020
2022.08.03 14:18:25 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP
2022.08.03 14:18:25 LOG7[ui]: errno: (*__errno_location ())
2022.08.03 14:18:25 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf
2022.08.03 14:18:25 LOG5[ui]: UTF-8 byte order mark not detected
2022.08.03 14:18:25 LOG7[ui]: Enabling support for engine "rtengine"
2022.08.03 14:18:25 LOG6[ui]: UI not supported by engine #1 (rtengine)
2022.08.03 14:18:25 LOG7[ui]: Initializing engine #1 (rtengine)
2022.08.03 14:18:25 LOG6[ui]: Engine #1 (rtengine) initialized
2022.08.03 14:18:25 LOG5[ui]: FIPS mode disabled
2022.08.03 14:18:25 LOG7[ui]: Compression disabled
2022.08.03 14:18:25 LOG7[ui]: No PRNG seeding was required
2022.08.03 14:18:25 LOG6[ui]: Initializing service [https]
2022.08.03 14:18:26 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK
2022.08.03 14:18:26 LOG7[ui]: TLSv1.3 ciphersuites: TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM>2022.08.03 14:18:26 LOG7[ui]: TLS options: 0x02100004 (+0x00000000, -0x00000000)
2022.08.03 14:18:26 LOG6[ui]: Client certificate engine (rtengine) not supported
2022.08.03 14:18:26 LOG6[ui]: Loading certificate from engine ID: /home/tester/my_certs/rezonans_new_base64.cer
2022.08.03 14:18:26 LOG3[ui]: ENGINE_ctrl_cmd: Peer suddenly disconnected
2022.08.03 14:18:26 LOG6[ui]: Initializing private key on engine ID: pkcs11:model=Rutoken%20ECP?pin-value=12345678
2022.08.03 14:18:28 LOG6[ui]: Private key initialized on engine ID: pkcs11:model=Rutoken%20ECP?pin-value=12345678
2022.08.03 14:18:28 LOG6[ui]: Loading certificate from file: /home/tester/my_certs/rezonans_new_base64.cer
2022.08.03 14:18:28 LOG6[ui]: Certificate loaded from file: /home/tester/my_certs/rezonans_new_base64.cer
2022.08.03 14:18:28 LOG7[ui]: Private key check succeeded
2022.08.03 14:18:28 LOG5[ui]: Configuration successful
2022.08.03 14:18:28 LOG7[ui]: Binding service [https]
2022.08.03 14:18:28 LOG7[ui]: Listening file descriptor created (FD=10)
2022.08.03 14:18:28 LOG7[ui]: Setting accept socket options (FD=10)
2022.08.03 14:18:28 LOG7[ui]: Option SO_REUSEADDR set on accept socket
2022.08.03 14:18:28 LOG6[ui]: Service [https] (FD=10) bound to 127.0.0.1:8000
2022.08.03 14:18:28 LOG7[main]: Created pid file /home/tester/stunnel_cli_pid.pid
2022.08.03 14:18:28 LOG7[cron]: Cron thread initialized
2022.08.03 14:18:28 LOG6[cron]: Executing cron jobs
2022.08.03 14:18:28 LOG6[cron]: Cron jobs completed in 0 seconds
2022.08.03 14:18:28 LOG7[cron]: Waiting 86400 seconds
2022.08.03 14:18:49 LOG7[main]: Found 1 ready file descriptor(s)
2022.08.03 14:18:49 LOG7[main]: FD=5 events=0x2001 revents=0x1
2022.08.03 14:18:49 LOG7[main]: FD=10 events=0x2001 revents=0x0
2022.08.03 14:18:49 LOG7[main]: Dispatching a signal from the signal pipe
2022.08.03 14:18:49 LOG7[main]: Processing SIGNAL_TERMINATE
2022.08.03 14:18:49 LOG5[main]: Terminated
2022.08.03 14:18:49 LOG7[main]: Leak detection table utilization: 13/997, 1.30%
2022.08.03 14:18:49 LOG7[main]: Removed pid file /home/tester/stunnel_cli_pid.pid
2022.08.03 14:18:49 LOG7[main]: Terminating the cron thread
2022.08.03 14:18:49 LOG5[main]: Terminating 1 service thread(s)
2022.08.03 14:18:49 LOG5[main]: Service threads terminated
2022.08.03 14:18:49 LOG7[main]: Deallocating section defaultsПодскажите, пожалуйста, в чём может быть проблема?
Если в stunnel.conf вызвать движок pkcs11, а так же параметр cert сделать:
pkcs11:id=0477dda5f69dfb917a512ff03460557567690ab7
Тогда при попытке запуска stunnel вывод будет таким:
Specified object not found
Specified object not found
Specified object not found
PKCS11_get_private_key returned NULL
[ ] Clients allowed=500
[.] stunnel 5.56 on x86_64-pc-linux-gnu platform
[.] Compiled with OpenSSL 1.1.1c 28 May 2019
[.] Running with OpenSSL 1.1.1f 31 Mar 2020
[.] Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP
[ ] errno: (*__errno_location ())
[.] Reading configuration from file /etc/stunnel/stunnel.conf
[.] UTF-8 byte order mark not detected
[ ] Enabling support for engine "pkcs11"
[.] UI set for engine #1 (pkcs11)
[ ] Initializing engine #1 (pkcs11)
[ ] Engine #1 (pkcs11) initialized
[.] FIPS mode disabled
[ ] Compression disabled
[ ] No PRNG seeding was required
[ ] Initializing service [https]
[ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK
[ ] TLSv1.3 ciphersuites: TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256
[ ] TLS options: 0x02100004 (+0x00000000, -0x00000000)
[ ] Client certificate engine (pkcs11) not supported
[ ] Loading certificate from engine ID: pkcs11:id=0477dda5f69dfb917a512ff03460557567690ab7
[!] ENGINE_ctrl_cmd: eng_back.c:593: error:82066065:pkcs11 engine:ctx_ctrl_load_cert:object not found
[ ] Initializing private key on engine ID: pkcs11:model=Rutoken%20ECP?pin-value=12345678
[!] error queue: ../crypto/engine/eng_pkey.c:77: error:26096080:engine routines:ENGINE_load_private_key:failed loading private key
[!] ENGINE_load_private_key: eng_back.c:858: error:82067065:pkcs11 engine:ctx_load_privkey:object not found
[ ] Loading certificate from file: pkcs11:id=0477dda5f69dfb917a512ff03460557567690ab7
[!] error queue: ../ssl/ssl_rsa.c:615: error:140DC002:SSL routines:use_certificate_chain_file:system lib
[!] error queue: ../crypto/bio/bss_file.c:290: error:20074002:BIO routines:file_ctrl:system lib
[!] SSL_CTX_use_certificate_chain_file: ../crypto/bio/bss_file.c:288: error:02001002:system library:fopen:No such file or directory
[!] Service [https]: Failed to initialize TLS context
[ ] Deallocating section defaults