信任库是否需要子 ca 证书？
我正在尝试设置分层 PKI。 我是否可以创建仅包含根 ca 证书的信任库，这是否意味着我的应用程序信任由子 ca 证书签名的证书，而子 ca 证书又由根 ca 签名？
顺便说一句，您似乎必须提供整个证书链，包括根 ca 证书。 当然，如果根 ca 受信任，则不需要发送证书吗？ 我们只想检查下一个证书是否由它签名。
I'm trying to setup a hierarchical PKI. Can I create a truststore containing only the root ca certificate, and will that mean my application trusts certificates signed by a sub-ca certificate which is in turn signed by the root ca?
As an aside, it seems that you must provide an entire certificate chain, including the root ca certificate. Surely if the root ca is trusted, the certificate shouldn't need to be sent? We just want to check if the next certificate down is signed by it.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
信任存储应仅包含根 CA，而不包含中间 CA。
身份存储应包含私钥，每个私钥与其证书链相关联（根除外）。
很多很多应用程序都配置错误，当尝试识别自己的身份时（例如，服务器使用 SSL 进行自身身份验证），它们只发送自己的证书，而缺少中间体。 错误地将根作为链的一部分发送的情况较少，但这危害较小。 大多数证书路径构建器只会忽略它，并从受信任的密钥存储中找到根路径。
原问题中的假设是正确的。
The trust store should only contain the root CAs, not intermediates.
An identity store should contain private keys, each associated with its certificate chain, except for the root.
Many, many applications in the wild are misconfigured, and when trying to identify themselves (say, a server authenticating itself with SSL), they only send their own certificate, and are missing the intermediates. There are fewer that mistakenly send the root as part of the chain, but this is less harmful. Most certificate path builders will just ignore it, and find a path to a root from their trusted key store.
The suppositions in the original question are right on target.