Disable certificate verification on Ubuntu-CodePudding

I have one very old legacy project, its web API, and really I need to call it (it hosts on Windows Server 2012). This API require .p12 premade client certificates include in request to it, and i have one.

It works only with https and it have strange certificate.

If i debug my .net 6 project (calls with RestSharp) on Windows 10 - it's OK, but on Ubuntu 22.04 LTS I have issues.

Adding TLSv1.0 or TLSv1.1 or TLSv1.2 support in /etc/ssl/openssl.cnf don't works.

Curl -k or --insecure don't works.

root@nginx:/home/xxx# curl -vvv  https://192.168.201.111:44301/api/
*   Trying 192.168.201.111:44301...
* Connected to 192.168.201.111 (192.168.201.111) port 44301 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.0 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (OUT), TLS header, Unknown (21):
* TLSv1.3 (OUT), TLS alert, protocol version (582):
* error:0A000102:SSL routines::unsupported protocol
* Closing connection 0
curl: (35) error:0A000102:SSL routines::unsupported protocol

And else:

root@nginx:/home/xxx# openssl s_client -connect 192.168.201.111:44301
CONNECTED(00000003)
40A77EF2787F0000:error:0A000102:SSL routines:ssl_choose_client_version:unsupported protocol:../ssl/statem/statem_lib.c:1952:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 58 bytes and written 300 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)

Please help me disable this cert validation.

UPD

In C# I do something like this to configure RestClient (on windows it works fine, but on ubuntu it fails):

ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls; 
ServicePointManager.ServerCertificateValidationCallback = (s, ce, ca, p) => true;
FileInfo certFile = new (certFileName);
if (certFile.Exists is false) throw new FileNotFoundException("Certificate file not found");
X509Certificate2Collection certificates = new X509Certificate2Collection();
certificates.Import(certFile.FullName, certPassword, X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.PersistKeySet);
ServicePointManager.ServerCertificateValidationCallback = (_, _, _, _) => true;

var options = new RestClientOptions(baseUrl)
{
    FollowRedirects = true,
    ClientCertificates = certificates,
    RemoteCertificateValidationCallback = (sender, certificate, chain, sslPolicyErrors) => true
};
Client = new RestClient(options);

UPD2

root@nginx:/home/xxx# openssl s_client -tls1 -cipher 'DEFAULT:@SECLEVEL=1'  -connect 192.168.201.111:44301
CONNECTED(00000003)
Can't use SSL_get_servername
depth=1 CN = ORGANIZATION
verify error:num=19:self-signed certificate in certificate chain
verify return:1
depth=1 CN = ORGANIZATION
verify return:1
depth=0 CN = OFFICE1
verify return:1
405744F5247F0000:error:0A0C0103:SSL routines:tls_process_key_exchange:internal error:../ssl/statem/statem_clnt.c:2248:
---
Certificate chain
 0 s:CN = OFFICE1
   i:CN = ORGANIZATION
   a:PKEY: rsaEncryption, 1024 (bit); sigalg: RSA-SHA512
   v:NotBefore: Sep 26 12:10:32 2018 GMT; NotAfter: Sep 23 12:10:32 2028 GMT
 1 s:CN = ORGANIZATION
   i:CN = ORGANIZATION
   a:PKEY: rsaEncryption, 1024 (bit); sigalg: RSA-SHA1
   v:NotBefore: Sep 26 12:10:29 2018 GMT; NotAfter: Sep 23 12:10:29 2028 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
(i replace cert with *)
*************************************************
*************************************************
*************************************************
*************************************************
*************************************************
*************************************************
*************************************************
*************************************************
-----END CERTIFICATE-----
subject=CN = OFFICE1
issuer=CN = ORGANIZATION
---
No client certificate CA names sent
Server Temp Key: DH, 1024 bits
---
SSL handshake has read 1657 bytes and written 111 bytes
Verification error: self-signed certificate in certificate chain
---
New, (NONE), Cipher is (NONE)
Server public key is 1024 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1654443076
    Timeout   : 7200 (sec)
    Verify return code: 19 (self-signed certificate in certificate chain)
    Extended master secret: no
---

CodePudding user response：

... routines:ssl_choose_client_version:unsupported protocol: ...
...
Please help me disable this cert validation.

The error is not related to certificate validation but is about TLS protocol versions. One can enforce TLS 1.0 with

openssl s_client -tls1 -cipher 'DEFAULT:@SECLEVEL=1' ...

This API require .p12 premade client certificates include in request to it, and i have one.

You need to add the client certificate too:

openssl s_client -cert cert.p12 -inform p12 ...

verify error:num=19:self-signed certificate in certificate chain

You need to add the CA with

openssl s_client -CAfile ca.pem ...

The CA is not send by the server though so you have to ask whoever is responsible in order to get the CA.