• Openssl + GOST + Stunnel+int223.zakupk.gov.ru. Как настроить?

    @SurdLen
    Это когда ssh-соединение, то на сервер нужно добавлять только публичный ключ. А для самого соединения openssl нужны все ключи (приватный, публичный и сертификат). Проверять подключение можно так:
    openssl s_client -connect int223.zakupki.gov.ru:443 -engine gost -cipher GOST2012-GOST8912-GOST8912:GOST2001-GOST89-GOST89 -CAfile /etc/ssl/crypto/CA-SIT_2022.pem -cert /etc/ssl/crypto/bek.pem -key /etc/ssl/crypto/bek.key -state



    engine "gost" set.
    SSL_connect:before SSL initialization
    SSL_connect:SSLv3/TLS write client hello
    SSL_connect:SSLv3/TLS write client hello
    SSL_connect:SSLv3/TLS read server hello
    depth=2 emailAddress = dit@minsvyaz.ru, C = RU, ST = 77 \D0\9C\D0\BE\D1\81\D0\BA\D0\B2\D0\B0, L = \D0\B3. \D0\9C\D0\BE\D1\81\D0\BA\D0\B2\D0\B0, street
    = "\D1\83\D0\BB\D0\B8\D1\86\D0\B0 \D0\A2\D0\B2\D0\B5\D1\80\D1\81\D0\BA\D0\B0\D1\8F, \D0\B4\D0\BE\D0\BC 7", O = \D0\9C\D0\B8\D0\BD\D0\BA\D0\BE\D0\BC\D
    1\81\D0\B2\D1\8F\D0\B7\D1\8C \D0\A0\D0\BE\D1\81\D1\81\D0\B8\D0\B8, OGRN = 1047702026701, INN = 007710474375, CN = \D0\9C\D0\B8\D0\BD\D0\BA\D0\BE\D0\BC
    \D1\81\D0\B2\D1\8F\D0\B7\D1\8C \D0\A0\D0\BE\D1\81\D1\81\D0\B8\D0\B8
    ...
    CONNECTED(00000005)
    ...
    ---
    Server certificate
    -----BEGIN CERTIFICATE-----
    ...
    -----END CERTIFICATE-----
    subject=INN = 007710568760, OGRN = 1047797019830, street = \D0\91\D0\BE\D0\BB\D1\8C\D1\88\D0\BE\D0\B9 \D0\97\D0\BB\D0\B0\D1\82\D0\BE\D1\83\D1\81\D1\82\D0\B8\D0\BD\D1\81\D0\BA\D0\B8\D0\B9 \D0\BF\D0\B5\D1\80\D0\B5\D1\83\D0\BB\D0\BE\D0\BA \D0\B4\D0\BE\D0\BC 6 \D1\81\D1\82\D1\80.1, emailAddress = isfk@roskazna.ru, C = RU, ST = \D0\B3. \D0\9C\D0\BE\D1\81\D0\BA\D0\B2\D0\B0, L = \D0\B3. \D0\9C\D0\BE\D1\81\D0\BA\D0\B2\D0\B0, O = \D0\A4\D0\95\D0\94\D0\95\D0\A0\D0\90\D0\9B\D0\AC\D0\9D\D0\9E\D0\95 \D0\9A\D0\90\D0\97\D0\9D\D0\90\D0\A7\D0\95\D0\99\D0\A1\D0\A2\D0\92\D0\9E, OU = \D0\A3\D0\BF\D1\80\D0\B0\D0\B2\D0\BB\D0\B5\D0\BD\D0\B8\D0\B5 \D1\80\D0\B0\D0\B7\D0\B2\D0\B8\D1\82\D0\B8\D1\8F \D0\BA\D0\BE\D0\BD\D1\82\D1\80\D0\B0\D0\BA\D1\82\D0\BD\D0\BE\D0\B9 \D1\81\D0\B8\D1\81\D1\82\D0\B5\D0\BC\D1\8B, CN = \D0\A4\D0\95\D0\94\D0\95\D0\A0\D0\90\D0\9B\D0\AC\D0\9D\D0\9E\D0\95 \D0\9A\D0\90\D0\97\D0\9D\D0\90\D0\A7\D0\95\D0\99\D0\A1\D0\A2\D0\92\D0\9E

    issuer=emailAddress = uc_fk@roskazna.ru, ST = \D0\B3. \D0\9C\D0\BE\D1\81\D0\BA\D0\B2\D0\B0, INN = 007710568760, OGRN = 1047797019830, street = "\D0\91\D0\BE\D0\BB\D1\8C\D1\88\D0\BE\D0\B9 \D0\97\D0\BB\D0\B0\D1\82\D0\BE\D1\83\D1\81\D1\82\D0\B8\D0\BD\D1\81\D0\BA\D0\B8\D0\B9 \D0\BF\D0\B5\D1\80\D0\B5\D1\83\D0\BB\D0\BE\D0\BA, \D0\B4. 6, \D1\81\D1\82\D1\80\D0\BE\D0\B5\D0\BD\D0\B8\D0\B5 1", L = \D0\9C\D0\BE\D1\81\D0\BA\D0\B2\D0\B0, C = RU, O = \D0\A4\D0\B5\D0\B4\D0\B5\D1\80\D0\B0\D0\BB\D1\8C\D0\BD\D0\BE\D0\B5 \D0\BA\D0\B0\D0\B7\D0\BD\D0\B0\D1\87\D0\B5\D0\B9\D1\81\D1\82\D0\B2\D0\BE, CN = \D0\A4\D0\B5\D0\B4\D0\B5\D1\80\D0\B0\D0\BB\D1\8C\D0\BD\D0\BE\D0\B5 \D0\BA\D0\B0\D0\B7\D0\BD\D0\B0\D1\87\D0\B5\D0\B9\D1\81\D1\82\D0\B2\D0\BE

    ---
    ...
    ---
    New, TLSv1.0, Cipher is GOST2012-GOST8912-GOST8912
    Server public key is 256 bit
    Secure Renegotiation IS supported
    Compression: NONE
    Expansion: NONE
    No ALPN negotiated
    SSL-Session:
    Protocol : TLSv1.1
    Cipher : GOST2012-GOST8912-GOST8912
    Session-ID: 3080F61062E8D9511C2430DA24A3B5BA87A36FF8F67B8D342B1CF1CB6495C899
    Session-ID-ctx:
    Master-Key: BDF3D6FCF78CE21DCC1F1C5E710A3A3BA6563B9EC89814C9288E1FD0E99C873162230BC6C8680AF853EEF43D0C3D81D5
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - c5 32 e4 e7 6c fc f3 dc-08 58 22 5f f4 ab 32 1a .2..l....X"_..2.
    ...
    Timeout : 7200 (sec)
    Verify return code: ...