无法理解 SSL 证书链验证

发布于 2024-08-05 20:29:44 字数 842 浏览 4 评论 0原文

我的应用程序使用 SSL 与服务器安全通信，但在验证证书链时遇到问题。该链如下所示：

Entrust.net 安全服务器证书颁发机构 -> DigiCert 全球 CA -> *.ourdomain.com

我们正在使用从 Mozilla 提取的证书存储。它包含 Entrust.net 证书，但不包含 DigiCert Global CA 证书。

我的理解是，中间机构不必像根机构一样值得信任，但验证失败：

% openssl verify -CAfile mozilla-root-certs.crt ourdomain.com.crt
error 20 at 0 depth lookup:unable to get local issuer certificate

那么我是否需要明确信任DigiCert Global CA才能使验证通过？这似乎是错误的。但你告诉我！

编辑：我现在了解到证书文件需要预先可供 OpenSSL 使用。像这样的事情是有效的：

% openssl verify -CAfile mozilla-root-certs.crt -untrusted digicert.crt ourdomain.com.crt
ourdomain.com.crt: OK

这允许我提供 DigiCert CA 的副本，而无需明确地说“我信任它”，整个链仍然需要验证。

但像 Firefox 这样的浏览器肯定不会总是附带它所需的每个证书的副本。总会有新的 CA，重点是使用根证书的安全性来确保所有中间 CA 都是有效的。正确的？那么它是如何工作的呢？真的像看上去那么傻吗？

原文

My app uses SSL to communicate securely with a server and it's having trouble verifying the certificate chain. The chain looks like this:

Entrust.net Secure Server Certification Authority -> DigiCert Global CA -> *.ourdomain.com

We are using a certificate store pulled from Mozilla. It contains the Entrust.net certificate, but not the DigiCert Global CA one.

My understanding is that an intermediate authority doesn't have to be trusted as long as the root authority is, but the verification fails:

% openssl verify -CAfile mozilla-root-certs.crt ourdomain.com.crt
error 20 at 0 depth lookup:unable to get local issuer certificate

So do I need to explicitly trust the DigiCert Global CA in order for verification to pass? That seems wrong. But you tell me!

EDIT: I now understand that the certificate file needs to be available to OpenSSL up front. Something like this works:

% openssl verify -CAfile mozilla-root-certs.crt -untrusted digicert.crt ourdomain.com.crt
ourdomain.com.crt: OK

This allows me to provide a copy of the DigiCert CA without explicitly saying "I trust it", the whole chain still needs to be verified.

But surely browsers like Firefox won't always ship with a copy of every single certificate it'll ever need. There's always going to be new CAs and the point is to use the security of the root certificate to make sure all intermediate CAs are valid. Right? So how does this work? Is it really as silly as it looks?

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

怪我鬧 2024-08-12 20:29:45

中间证书以及您自己域的证书必须安装在您的 Web 服务器上。上周我也遇到了同样的问题... Firefox 似乎比其他浏览器对此更加挑剔。

回复收藏 0 原文

一曲琵琶半遮面シ 2024-08-12 20:29:45

这是验证来自 Web 服务器的证书的正确方法

客户端维护受信任的 CA 根证书列表
Web 服务器应返回以下服务器证书 - 必需的
中间证书 - 必需的根 CA 证书 - 不需要/可选

当客户端连接到服务器后，它从服务器获取服务器证书和中间证书。然后，客户端从服务器证书、中间证书到它信任的 CA ROOT 证书之一建立信任链。 ROOT 证书始终是自签名的 - 所以这就是链的终点。

这是使用 openssl 测试 Web 服务器证书的简单命令

openssl s_client -CAfile <root ca file> -quiet -showcerts -connect IP:PORT

在虚拟主机的情况下，在同一 IP:PORT 上提供多个证书，可以使用 -servername启用服务器名称指示 (SNI) ;。否则，将发送默认证书。

Here is correct way to verify a certficate coming from a web server

Client maintains a list of trusted CA ROOT certificates
Web Servers should return the following Server Certificate - Required
Intermediate Certificate(s) - Required ROOT CA Cert - Not required/Optional

When a client connected to a server, it gets the server certificate and intermediate certificate(s) from the server. The client then then builds a chain of trust from the server certificate, through the intermediate certificate(s) to one of the CA ROOT certificates it trusts. ROOT Certificates are always self-signed - so that is where the chain stops.

Here is a simple command to test a web server certificate using openssl

openssl s_client -CAfile <root ca file> -quiet -showcerts -connect IP:PORT

In the case of virtual hosting, where multiple certificates are served on the same IP:PORT, server name indication (SNI) can be enabled using -servername <FQDN>. Otherwise, the default certificate will be sent.

回复收藏 0 原文

~没有更多了~