Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Download ICP-Brasil certificates and make a bundle
#!/bin/bash
HTTPADDR=http://acraiz.icpbrasil.gov.br/credenciadas/CertificadosAC-ICP-Brasil/ACcompactado.zip
DEST=/etc/ssl/certs/icp-brasil
mkdir -p ${DEST}
cd ${DEST}
rm -f *.crt
rm -f *.zip
wget "$HTTPADDR"
unzip *.zip
for fn in $(file *.crt|grep data|sed 's/: *data//')
do
mv $fn $fn.der
openssl x509 -inform der -in $fn.der -out $fn
done
#rm *.der
for f in $(ls *.crt); do
dos2unix $f > /dev/null
openssl x509 -text -in $f >> bundle.crt
done
#Ref: http://blog.gendoc.com.br/2012/03/instalando-os-certificados-ac-do-icp-brasil-para-e-cpf-e-e-cnpj/
#Ref: http://www.iti.gov.br/icp-brasil/certificados/188-atualizacao/4530-ac-raiz
<VirtualHost *:443>
(...)
SSLCACertificateFile /etc/ssl/certs/icp-brasil/bundle.crt
(...)
</VirtualHost>
@fabiomontefuscolo

This comment has been minimized.

Copy link

@fabiomontefuscolo fabiomontefuscolo commented Apr 14, 2021

file *.crt|grep data|sed 's/: *data//' que está na linha 15 não retorna resultados. Além disso, o bundle fica tão grande que o nginx exibe a mensagem abaixo nos logs

2021/04/14 10:43:30 [info] 481242#481242: *207 client SSL certificate verify error: (22:certificate chain too long) while reading client request headers, client: 45.167.183.179, server: diablo.montefuscolo.com.br, request: "GET /favicon.ico HTTP/1.1", host: "diablo.montefuscolo.com.br", referrer: "https://diablo.montefuscolo.com.br/"

Quais certificados fariam o Nginx aceitar um e-CNPJ A1 ?

@fabiomontefuscolo

This comment has been minimized.

Copy link

@fabiomontefuscolo fabiomontefuscolo commented Apr 14, 2021

Ok, desmontando meu eCNPJ eu identifiquei 3 certificados que estão no zip deste shell.

  • AC_Certisign_RFB_G5.crt
  • AC_Secretaria_da_Receita_Federal_do_Brasil_v4.crt
  • ICP-Brasilv5.crt

O trecho abaixo faz o Nginx funcionar direitinho

cat /etc/ssl/certs/icp-brasil/{AC_Certisign_RFB_G5.crt,AC_Secretaria_da_Receita_Federal_do_Brasil_v4.crt,ICP-Brasilv5.crt} > chain.pem

nas confs do nginx, tenho

    ssl_client_certificate /etc/nginx/client-certs/chain.pem;
    ssl_verify_client on;
    ssl_verify_depth 2;

Entendi que ssl_verify_depth vai fazer o Nginx verificar os certificados intermediarios no chain.pem, mas honestamente, ainda não li a documentação oficial. https://stackoverflow.com/questions/8431528/nginx-ssl-certificate-authentication-signed-by-intermediate-ca-chain

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment