SSL_ERROR_WEAK_SERVER_CERT_KEY - обходной путь?

Question

Мне нужно получить доступ к старому устройству через веб-интерфейс:

bash-4.2# curl -0 -v -k -u ADMIN:ADMIN https://10.130.1.1/redfish/v1
* About to connect() to 10.130.1.1 port 443 (#0)
*   Trying 10.130.1.1...
* Connected to 10.130.1.1 (10.130.1.1) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* skipping SSL peer certificate verification
* NSS error -12156 (SSL_ERROR_WEAK_SERVER_CERT_KEY)
* The server certificate included a public key that was too weak.
* Closing connection 0
curl: (35) The server certificate included a public key that was too weak.
bash-4.2# curl -v -k -u ADMIN:ADMIN https://10.130.1.1/redfish/v1
* About to connect() to 10.130.1.1 port 443 (#0)
*   Trying 10.130.1.1...
* Connected to 10.130.1.1 (10.130.1.1) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* skipping SSL peer certificate verification
* NSS error -12156 (SSL_ERROR_WEAK_SERVER_CERT_KEY)
* The server certificate included a public key that was too weak.
* Closing connection 0
curl: (35) The server certificate included a public key that was too weak.

Запустив его через openssl, я вижу:

...
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (512 bit)
...

Нет способа, которым я могу изменить то, что исходит от сервера - так, есть ли способ заставить curl просто продолжать с ним?

Answer 1

попробуйте изменить следующее в openssl.cnf

[system_default_sect]
CipherString = DEFAULT@SECLEVEL=0

, посмотрите, поможет ли это.