搭建Emby伪验证服务器

从搭建nas以来就是用emby来搭建影视媒体库，奈何premiere太贵，于是研究解锁方法

搭建认证服务器

1.建立一台nginx反向代理服务器，如果不在外网访问那么在内网任意一台设备上搭建即可

2.修改目标机器的hosts文件，将mb3admin.com指向反向代理服务器的ip

3.nginx新建一个反向代理，主机名字就是mb3admin.com，文件添加以下内容

location /admin/service/registration/validateDevice {
	    default_type application/json;
	  return 200 '{"cacheExpirationDays": 3650,"message": "Device Valid","resultCode": "GOOD"}';
	}
	location /admin/service/registration/validate {
	    default_type application/json;
	  return 200 '{"featId":"","registered":true,"expDate":"2099-01-01","key":""}';
	}
	location /admin/service/registration/getStatus {
	    default_type application/json;
	  return 200 '{"deviceStatus":"","planType":"Lifetime","subscriptions":{}}';
	}
	location /admin/service/appstore/register {
	    default_type application/json;
	  return 200 '{"featId": "","registered": true,"expDate": "2099-01-01","key": ""}';
	}
	location /emby/Plugins/SecurityInfo {
	    default_type application/json;
	  return 200 '{SupporterKey: "", IsMBSupporter: true}';
	}
    add_header Access-Control-Allow-Origin *;
    add_header Access-Control-Allow-Headers *;
    add_header Access-Control-Allow-Method *;
    add_header Access-Control-Allow-Credentials true;

此时使用的是http协议，先测试一遍

http://mb3admin.com/admin/service/registration/validateDevice

如果返回：

{"cacheExpirationDays": 3650,"message": "Device Valid","resultCode": "GOOD"}

则说明配置成功

配置证书

此处使用openssl来签发证书

1. 生成根证书的私钥

openssl genpkey -algorithm RSA -out root_private_key.pem -pkeyopt rsa_keygen_bits:2048

2. 创建根证书的CSR和自签名证书

openssl req -new -key root_private_key.pem -out root_csr.pem -subj "/C=US/ST=California/L=San Francisco/O=My Root CA/CN=mb3admin.com"

3. 创建扩展配置

vim v3_ca
#添加下面文本
[v3_ca]  
basicConstraints = CA:TRUE  
keyUsage = keyCertSign, cRLSign

4. 生成根证书

openssl x509 -req -days 3650 -in root_csr.pem -signkey root_private_key.pem -out root_certificate.pem -extensions v3_ca

5. 创建服务器证书的CSR

openssl req -new -key server_private_key.pem -out server_csr.pem -subj "/C=US/ST=California/L=San Francisco/O=My Company/CN=mb3admin.com"

6. 使用根证书签发服务器证书

vim openssl.cnf
#添加以下内容
[v3_req]  
keyUsage = digitalSignature, keyEncipherment  
extendedKeyUsage = serverAuth  
subjectAltName = @alt_names  

[alt_names]  
DNS.1 = mb3admin.com  
DNS.2 = *.mb3admin.com

7. 生成服务器证书

openssl x509 -req -in server_csr.pem -CA root_certificate.pem -CAkey root_private_key.pem -CAcreateserial -out server_certificate.pem -days 3650 -extensions v3_req -extfile openssl.cnf

8. 验证证书

# 验证根证书  
openssl x509 -in root_certificate.pem -text -noout  
  
# 验证服务器证书  
openssl x509 -in server_certificate.pem -text -noout

此时在nginx内指向server_certificate.pem和server_private_key.pem两个验证文件即可

服务端修改

1. 将证书追加至Emby服务器

cat xx/mb3admin.com.cert.pem >> /etc/ssl/certs/ca-certificates.crt

2. 修改HOSTS文件

软路由修改

如果家里网络由软路由接管，那么可以修改软路由的hosts文件使得网络内设备走软路由的DNS

Windows修改

1. 从服务器下载根证书进行安装

cp root_certificate.pem root_certificate.crt

2. 安装证书

将root_certificate.crt保存到本地，运行Win+R打开窗口输入certlm.msc

点击受信任的根证书颁发机构->证书

之后无脑下一步，完成后关闭浏览器重新访问如下链接：

https://mb3admin.com/admin/service/registration/validateDevice

可以看到https访问没问题，此时PC端修改完成

Android修改

下载vhosts
创建hosts文件并填入相应ip和域名，打开软件后将hosts文件添加到软件内并启动即可

IOS修改

下载Shadowrocket软件，在配置>default.conf>Hosts中添加host记录
将root_certificate.crt下载至ios，并信任配置文件，连接Shadowrocket即可