客户端（Java、C++ 等）是否需要有效的数字证书才能成功建立 https 连接？
我计划实现一个小型独立程序，该程序将向服务器发出 https 请求。 这是否需要客户端中有效的 ssl 证书？ 在这种情况下 SSL 握手如何工作？ 没有SSL证书的客户端是否存在安全问题？
I am planning to implement a small standalone program that will make a https request to a server. Does that require a valid ssl certificate in the client? How does the SSL handshake work in that case? Are there any security issues in the client not have an SSL certificate?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
除了加密网络流量之外，HTTPS 通常还用于对服务器进行身份验证。 也就是说，为了向客户端提供有关谁拥有服务器等的令人放心的信息。为此，客户端需要检查服务器发布的证书中的信任链。 为了自动发生这种情况，客户端计算机应该安装一个证书，该证书描述颁发服务器证书的证书颁发机构。 通常，此类证书可在您的计算机上名为“受信任的根证书颁发机构”的商店中找到，并且大多数操作系统都已安装一组常见的 CA。
此外，许多 Web 服务器还提供一项功能，客户端可以通过提供客户端证书来向服务器验证自己的身份。 Web 服务器能够检查来自客户端的证书并将其映射到服务器上的一组权限。 对于正常工作的 HTTPS 会话来说，这种“客户端身份验证”并不是必需的，但它只是一个选项。
简而言之，您实际上在客户端上需要任何证书，但您可能想要拥有根CA证书以验证服务器的身份。 如果您没有该证书，则您将不可能信任该服务器（除非您有其他充分的理由这样做），但您仍然可以选择与其交换数据。
Apart from encrypting the network traffic, HTTPS is normally used to authenticate the server. That is, to give clients reassuring information about who owns the server, etc. For that to work, the client needs to inspect the trust chain in the certificate published by the server. For that to happen automatically, the client machine should have a certificate installed that describes a Certification Authority that issued the server's certificate. Normally such certificates are found on your machine in a store called "Trusted Root Certification Authorities" and most OS come with a set of common CAs already installed.
In addition, many web servers offer a feature where the client can authenticate itself to the server by supplying a client certificate. The web server is able to inspect the certificate coming from the client and map it onto a set of permissions on the server. This "client authentication" is not necessary for a working HTTPS session however, it's just an option.
In short, you don't actually need any certificate on the client, but you will probably want to have a root CA certificate in order to validate the server's identity. If you don't have that certificate it will be impossible for you to trust the server (unless you have another good reason to do so), but you might choose to exchange data with it anyway.
如果您希望了解有关 HTTPS 握手以及协商内容的更多信息，我强烈建议您查看 moserware 上这篇精彩的文章
http://www.moserware.com/2009/06/first-few-milliseconds-of-https.html
If you wish to learn more about the HTTPS handshake and what is negotiated, i fully recommend you look at this excellent write up at moserware
http://www.moserware.com/2009/06/first-few-milliseconds-of-https.html
仅当服务器需要客户端证书时才需要客户端证书。 客户端证书允许服务器对客户端进行身份验证，但这仅在服务器具有所有授权客户端的列表时才有用。 Web 服务器通常不会出现这种情况，因此它们很少需要客户端证书。
如果存在，客户端证书不会影响安全通道的建立。 （仅需要服务器的证书，并且将客户端证书添加到混合中不会改变该过程。）建立安全通道后，服务器将使用客户端的证书对客户端进行身份验证（通常通过比较客户端的公共证书）密钥或名称以及授权客户端列表）。
A client certificate is required only if the server requires one. A client certificate allows the server to authenticate the client, but this is only useful if the server has a list of all authorized clients. That's generally not the case with a web server, so it's quite rare for them to require client certificates.
When present, the client-side certificate does not affect establishment of the secure channel. (Only the server's certificate is required for that and adding a client certificate into the mix doesn't change the process.) Once a secure channel is established, the server will use the client's certificate the authenticate the client (generally by comparing the client's public key or name with a list of authorized clients).
您不需要证书来建立 HTTPS 连接，但如果您想知道您正在与谁通信，则需要证书。
You dont need a certificate to make a HTTPS connection, but you do need to if you want to know with whom you are communicating.