Ubuntu 24.04 信任自訂 CA 憑證問題

五年前分享過如何在 Linux 信任自訂 CA 根憑證，隨著作業系統及軟體版本更新，試裝 Ubuntu 24.04 遇到新狀況。

憑證金鑰強度不足

這些年，對於憑證金鑰長度要求變高，新版 OpenSSL Security Level 預設值調高為 2，RSA 金鑰長度至少要 2048。原本可被接受的 RSA 1024 Intermediate CA 會得到 CA certificate key too weak 錯誤。

Security Level	RSA 最低強度概念
Level 0	幾乎不限制
Level 1	約 80-bit security
Level 2	約 112-bit security
Level 3	約 128-bit security
Level 4	約 192-bit security
Level 5	約 256-bit security

即便信任了憑證，curl 仍會噴錯：

$curl https://www.google.com
curl: (60) SSL certificate problem: CA certificate key too weak
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

若憑證一時無法換新，另個解決方向是調低 OpenSSL 門檻，恢復到 Security Level 1，修改方法是先用 openssl version -d 找到 OPENSSLDIR (如 /usr/lib/ssl) 下的 openssl.cnf，各版 Linux 的設計不同，Ubuntu 24.04 的修改方式如下：

1. 循 openssl_conf = openssl_init 找到 [openssl_init]
2. 加上 ssl_conf = ssl_sect
3. 在檔案最後補上一段

   [ssl_sect]
   system_default = system_default_sect
   
   [system_default_sect]
   MinProtocol = TLSv1.0
   CipherString = DEFAULT@SECLEVEL=1    
   

apt update 時憑證驗證失敗

即使信任過自訂 CA 根憑證也調成 SECLEVEL 1，apt update 時還是會出錯：

$sudo apt update 
Err:1 https://download.docker.com/linux/ubuntu noble InRelease
  Certificate verification failed: The certificate is NOT trusted. 
  The certificate chain uses insecure algorithm.  
  Could not handshake: Error in the certificate verification. 
https://download.docker.com/linux/ubuntu

解法是在 apt 指令加上參數不驗證 TLS 憑證：

$sudo apt -o "Acquire::https::Verify-Peer=false" update

docker pull 反應憑證無效

docker pull 下載時抱怨憑證序號是負值。GO 1.23 起 crypto/x509 依規範要求序號必須為正整數，原本有個過渡參數 GODEBUG=x509netativeserial=1 可當 Workaround，但 1.24+ 拿掉了。

$ docker run hello-world
Unable to find image 'hello-world:latest' locally
docker: Error response from daemon: failed to resolve reference "docker.io/library/hello-world:latest": 
failed to authorize: failed to fetch anonymous token: 
Get "https://auth.docker.io/token?scope=repository%3Alibrary%2Fhello-world%3Apull&service=registry.docker.io": 
tls: failed to parse certificate from server: x509: negative serial number

Run 'docker run --help' for more information

這題沒有簡單解法，要走多套一層 Proxy 之類的把戲，之後再分享。