公司 VPN 的新证书，现在 openconnect 不起作用

Question

因此，由于工作中的一次“升级”，我们获得了新的VPN证书。它是自签名的，并且不再有效。这是系统日志：

openconnect[6002]: Connected to xxx:443
openconnect[6002]: SSL negotiation with xxx
openconnect[6002]: Server certificate verify failed: signer not found
openconnect[6002]: Connected to HTTPS on xxx
openconnect[6002]: Got CONNECT response: HTTP/1.1 200 OK
openconnect[6002]: CSTP connected. DPD 300, Keepalive 30
NetworkManager[1273]: Set up DTLS failed; using SSL instead
openconnect[6002]: Connected as 192.168.0.160, using SSL
openconnect[6002]: SIOCSIFMTU: Operation not permitted
NetworkManager[1273]: <info>  [1537565026.6078] vpn-connection[0x55ab83c186c0,a0614dc2-f483-4dc9-87d4-7b9ac4169d31,"company",0]: VPN connection: (IP Config Get) reply received.
NetworkManager[1273]: <info>  [1537565026.6106] vpn-connection[0x55ab83c186c0,a0614dc2-f483-4dc9-87d4-7b9ac4169d31,"company",7:(vpn0)]: VPN connection: (IP4 Config Get) reply received
NetworkManager[1273]: <warn>  [1537565026.6107] vpn-connection[0x55ab83c186c0,a0614dc2-f483-4dc9-87d4-7b9ac4169d31,"company",7:(vpn0)]: invalid IP4 config received!
NetworkManager[1273]: <warn>  [1537565026.6107] vpn-connection[0x55ab83c186c0,a0614dc2-f483-4dc9-87d4-7b9ac4169d31,"company",7:(vpn0)]: VPN connection: did not receive valid IP config information
NetworkManager[1273]: <info>  [1537565026.6129] vpn-connection[0x55ab83c186c0,a0614dc2-f483-4dc9-87d4-7b9ac4169d31,"company",0]: VPN plugin: state changed: started (4)
NetworkManager[1273]: <info>  [1537565026.6133] vpn-connection[0x55ab83c186c0,a0614dc2-f483-4dc9-87d4-7b9ac4169d31,"company",0]: VPN plugin: state changed: stopping (5)
NetworkManager[1273]: <info>  [1537565026.6134] vpn-connection[0x55ab83c186c0,a0614dc2-f483-4dc9-87d4-7b9ac4169d31,"company",0]: VPN plugin: state changed: stopped (6)

我看到签名者未找到错误，但它超越了该错误，变为“收到无效的 IP4 配置！” 这是怎么回事？我该如何解决？

或者更好的是，告诉 openconnect 信任自签名证书。

Answer 1

有一种解决方法可以在连接时使用 --servercert 选项：

\n\n

在终端输入

\n\n

sudo openconnect --protocol=gp <hostaddress>\n

\n\n

并收到消息：

\n\n

Certificate from VPN server "serverhost" failed verification. \nReason:   signer not found To trust this server in future, perhaps\nadd this to your command line: --servercert pin-sha256:serverfingerprint \nEnter \'s\xc3\xac\' to accept, \'no\' to abort; anything else to view: \n

\n\n

然后最后在命令行选项中使用指纹：

\n\n

openconnect --servercert=sha1:26cfbcdefg... [usual arguments] \n

\n\n

或者

\n\n

openconnect --servercert=sha256:a8cfbcdedeadbeefdeadbeeffg... [usual arguments]\n

\n\n

来源https://github.com/dlenski/openconnect/issues/60

\n