TLS qanday ishlaydi

export LC_ALL=C TZ=UTC

# 13-bo'limdagidek sinov sertifikat markazi va server sertifikati
openssl ecparam -name prime256v1 -genkey -noout -out ca.key 2>/dev/null
openssl req -x509 -new -key ca.key -sha256 -days 3650 \
  -subj "/C=UZ/O=Namuna Lab CA/CN=Namuna Ildiz CA" -out ca.crt 2>/dev/null

openssl ecparam -name prime256v1 -genkey -noout -out srv.key 2>/dev/null
openssl req -new -key srv.key \
  -subj "/C=UZ/O=Namuna/CN=xizmat.namuna.uz" -out srv.csr 2>/dev/null

cat > srv.ext <<'EXT'
subjectAltName=DNS:xizmat.namuna.uz
basicConstraints=critical,CA:FALSE
keyUsage=critical,digitalSignature
extendedKeyUsage=serverAuth
EXT

openssl x509 -req -in srv.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
  -days 90 -sha256 -extfile srv.ext -out srv.crt 2>/dev/null

# Mahalliy TLS serverini ishga tushiruvchi yordamchi
server() {
    openssl s_server -accept "$1" -cert srv.crt -key srv.key \
        ${2:-} -quiet -naccept 1 >/dev/null 2>&1 &
    sleep 0.7
}

server 14501

echo | openssl s_client -connect 127.0.0.1:14501 \
    -CAfile ca.crt -servername xizmat.namuna.uz \
    -verify_hostname xizmat.namuna.uz 2>/dev/null \
  | grep -E "^(Protocol|Verify return code)"

wait 2>/dev/null; true

server 14502

# CAfile ko'rsatilmagan - mijoz zanjirni qura olmaydi
echo | openssl s_client -connect 127.0.0.1:14502 2>/dev/null \
  | grep -E "^Verify return code"

wait 2>/dev/null; true

server 14503

# Sertifikat boshqa domen uchun
echo | openssl s_client -connect 127.0.0.1:14503 \
    -CAfile ca.crt -verify_hostname boshqa.namuna.uz 2>/dev/null \
  | grep -E "^Verify return code"

wait 2>/dev/null; true

server 14504

echo "--- standart (eng yangi):"
echo | openssl s_client -connect 127.0.0.1:14504 -CAfile ca.crt 2>/dev/null \
  | grep -E "^(Protocol|Cipher)"

wait 2>/dev/null; true

server 14505

echo "--- TLS 1.2 majburiy:"
echo | openssl s_client -connect 127.0.0.1:14505 -CAfile ca.crt -tls1_2 \
    2>/dev/null | grep -E "    (Protocol|Cipher)  *:"

wait 2>/dev/null; true

# Server 1.2 dan past versiyani qabul qilmaydi
openssl s_server -accept 14506 -cert srv.crt -key srv.key \
    -min_protocol TLSv1.2 -quiet -naccept 2 >/dev/null 2>&1 &
sleep 0.7

echo "--- TLS 1.0 bilan urinish:"
echo | openssl s_client -connect 127.0.0.1:14506 -CAfile ca.crt -tls1 2>&1 \
  | grep -oE "alert protocol version" | head -1

echo "--- standart bilan urinish:"
echo | openssl s_client -connect 127.0.0.1:14506 -CAfile ca.crt 2>/dev/null \
  | grep -E "^Protocol"

wait 2>/dev/null; true

server 14507

echo "--- SNI bilan:"
echo | openssl s_client -connect 127.0.0.1:14507 -CAfile ca.crt \
    -servername xizmat.namuna.uz 2>/dev/null \
  | grep -E "^(Protocol|Verify return code)"

wait 2>/dev/null; true

cat > mijoz.php <<'PHP'
<?php
declare(strict_types=1);

// TO'G'RI sozlama - ikkala tekshiruv ham yoqilgan
$togri = [
    'ssl' => [
        'verify_peer' => true,
        'verify_peer_name' => true,
        'cafile' => 'ca.crt',
        'peer_name' => 'xizmat.namuna.uz',
        'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT
                         | STREAM_CRYPTO_METHOD_TLSv1_3_CLIENT,
    ],
];

// XATO sozlama - hech qachon shunday yozmang
$xato = [
    'ssl' => ['verify_peer' => false, 'verify_peer_name' => false],
];

foreach (['togri' => $togri, 'xato' => $xato] as $nom => $sozlama) {
    $s = $sozlama['ssl'];
    printf("%-6s verify_peer=%-5s verify_peer_name=%-5s cafile=%s\n",
        $nom,
        var_export($s['verify_peer'], true),
        var_export($s['verify_peer_name'], true),
        $s['cafile'] ?? '(yoq)');
}

echo "\nPHP 5.6 dan boshlab verify_peer standart holda TRUE\n";
echo "Uni false qilish - autentifikatsiyani butunlay ochirish\n";
PHP

php mijoz.php

cat <<'CONF'
# nginx: barcha HTTP so'rovlarni HTTPS ga yo'naltirish
server {
    listen 80;
    server_name xizmat.namuna.uz;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    http2 on;
    server_name xizmat.namuna.uz;

    ssl_certificate     /etc/ssl/fullchain.pem;
    ssl_certificate_key /etc/ssl/srv.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;

    # HSTS - brauzerga "bu saytga faqat HTTPS bilan kel" deydi
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
}
CONF

printf "%-32s %s\n" "XATO" "OQIBATI"
printf "%-32s %s\n" "--------------------------------" "------------------------"
printf "%-32s %s\n" "fullchain emas, faqat sayt serti" "ba'zi mijozlarda xato"
printf "%-32s %s\n" "TLS 1.0/1.1 yoqilgan" "eskirgan shifrlar"
printf "%-32s %s\n" "HSTS yo'q" "SSL stripping mumkin"
printf "%-32s %s\n" "sertifikat qo'lda yangilanadi" "kutilmaganda muddati otadi"
printf "%-32s %s\n" "maxfiy kalit git da" "kalit sizib chiqadi"
printf "%-32s %s\n" "verify_peer => false" "MITM ga toliq ochiq"
printf "%-32s %s\n" "kalit huquqlari 644" "har kim oqiy oladi"