关于：PKCS7、X509 和 DER
我是“密码学世界”的新手。我开始使用 OPENSSL。 我需要一些信息，基本上我确实有一些疑问。 我有一个 DER 格式的文件。我使用以下命令读取文件， “openssl x509 -inform DER -in filename.der -text”我得到了我应该做的。
我想知道以下内容：
PKCS7、DER 和 X509 之间有什么区别？ （我的理解是，DER是格式，X509是证书，PKCS7是标准）
我编写了一个测试文件，它接受DER文件并输出版本、序列号、主题、有效日期之前和有效日期之后，但我无法验证证书。以下是使用的 API。
int i = X509_verify(X509 *x509 , X509_get_pubkey(X509 *x509)); 但“i”值是“i”< 0（零）这就是我收到“签名验证问题”的原因。 如何克服这个问题？在我的测试文件中，我无法读取“签名算法”、“主题公钥信息”、“X509v3 扩展”和“-----开始证书-----”到“----” -END CERTIFICATE-----"
请提供一些信息。
提前致谢。 开放SID
I am novice to the "World of cryptography". I started working with OPENSSL.
I need some information and basically I do have some doubts.
I have a DER format file. I read the file using following command,
"openssl x509 -inform DER -in filename.der -text" I got what I supposed to be.
Following things I wanted to know:
What is the difference between PKCS7, DER and X509 ?
(My understanding is, DER is format, X509 is certificate, and PKCS7 is the standard)I wrote a test file which accepts the DER file and outputs the version, serial number, Subject, Validity date before and Validity date after, But I am unable to get certificate verified. Following is the API Used.
int i = X509_verify(X509 *x509 , X509_get_pubkey(X509 *x509));
But 'i' value is 'i' < 0(zero) This is why I am getting "Signature verification problems".
How to overcome this?In My test file I am unable to read the "Signature Algorithm", "Subject Public Key Info", "X509v3 extensions" and "-----BEGIN CERTIFICATE-----" to "-----END CERTIFICATE-----"
Please give some inputs.
Thanks in Advance.
openSid
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
PKCS#7 是 RSA Security 于 1993 年发布的加密标准，用于处理应用了加密的数据。它是如何安全打包数据的标准。 PKCS#7 引用 X.509 标准作为证书格式的来源。
X.509 是 1998 年发布的范围广泛的安全标准文档，其中包括证书文件格式。
X.509 指定证书应使用 ASN.1 标准的杰出编码规则（记录在 X.208 和现在的 X.608）标准进行编码，该标准于 1984 年首次发布。
因此，DER 说明了如何对某些字符串和数字进行编码源数据转换为二进制格式，
X.509 说明哪些数据需要进入数字证书，以及
PKCS#7 说明了如何使用该证书对消息进行数字签名。
隐私增强邮件 - OpenSSL 之前发布的某种工具 - 需要在电子邮件消息中传递 PKCS#7“包装”数据，这些数据当时在仅支持 7 位 ASCII 字符的系统上交换 - “PEM”创建了使用的标准Base64 对 PKCS#7 所需的 X.509 证书进行编码，并将 Base64 存储在 -----BEGIN ???----- -----END ???----- where ?? ？可以是 RSA 私钥、PSA 公钥、证书等。
PKCS#7 is a cryptography standard published by RSA Security in 1993 that deals with data that has cryptography applied to it. Its a standard for how to package data securely. PKCS#7 references the X.509 standard, as the source for certificate formatting.
X.509 is a wide ranging security standards document published in 1998 which includes amongst other things, certificate file formats.
X.509 specifies that certificates should be encoded using the Distinguished Encoding Rules of the ASN.1 (documented in the X.208 and now X.608) standard, first published in 1984.
So, DER says how to encode some strings and numeric source data into a binary format,
X.509 says which data needs to go into a digital certificate, and
PKCS#7 says how that certificate should be used, to digitally sign a message.
Privacy Enhanced Mail - some kind of tool released before OpenSSL - needed to pass PKCS#7 "wrapped" data around in email messages that at the time were exchanged on systems that only supported 7 bit ASCII characters - "PEM" created the standard of using Base64 to encoded the X.509 certificates required by PKCS#7, and storing the base64 inside -----BEGIN ???----- -----END ???----- where ??? can be a RSA PRIVATE KEY, PSA PUBLIC KEY, CERTIFICATE etc.
PKCS 组件是 PKCS#1、PKCS#5、PKCS#7、PKCS#8、PKCS#9、PKCS#10 和 PKCS#12，PKCS 标准是 RSA 实验室与全球安全系统开发商合作制定的规范，用于目的是加速公钥密码技术的部署。
用户可以向证书颁发机构请求证书，以便该用户将 PKCS#10 对象中的公钥发送给 CA。请求获得批准后，CA 会颁发封装在 PKCS#7 中的证书- 格式化对象。
PKCS#7 定义了应用了加密技术的数据的标准格式，PKCS#7 仅指定数据格式，而不指定任何特定算法的选择 (X509)
X.509 证书是包含有关证书信息的公钥所有者和发行人
PKCS Components are PKCS#1, PKCS#5, PKCS#7, PKCS#8, PKCS#9, PKCS#10, and PKCS#12, PKCS standards are specifications produced by RSA Laboratories in cooperation with secure-system developers worldwide for the purpose of accelerating the deployment of public-key cryptography.
A user can request a certificate from a Certificate Authority is for that user to send his or her public key in a PKCS#10 object to the CA.Once the request is approved, the CA issues a certificate that is wrapped in a PKCS#7-formatted object.
PKCS#7 defines a standard format for data that has had cryptography applied to it,PKCS#7 specifies only a data format, not the choice of any specific algorithms (X509)
X.509 certificate is a public key packaged with information about the certificate owner and issuer