自签名证书和证书颁发机构生成的证书有什么区别
我想知道自签名证书和证书颁发机构生成的证书之间的区别。
我可以轻松地为 xyz.com 域创建一个自签名证书，那么该证书与 CA 生成的证书有什么区别？
场景
假设网站 xyz.com 使用颁发给 xyz.com 的证书进行保护，并且拥有该证书的客户端可以访问该网站由网站发布。
我还可以为 xyz.com 创建一个自签名证书，那么我的服务器将如何处理这个假证书？
I want to know the difference between self signed and certificate generated by certification authority.
I can easily create a self signed certificate for domain xyz.com then what is the difference between this certificate and the one generated by CA?
Scenario
Suppose a site xyz.com is secured with a certificate issued to xyz.com and it can be accessed by the clients who have the certificate issued by the site.
I can also create a self signed for xyz.com then how will my server take care of this fake certificate?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
如果您的浏览器中已经安装了该 CA 的证书，那么当您的浏览器遇到声称由某个 CA 签名的证书时，它可以验证它确实是由该 CA 签名的。 CA 本身通常会在签署您的证书之前以某种方式验证您的身份。
您的自签名证书仅由您自己的 CA 签名。没有人验证该证书实际上属于它声称属于的人。您可以将自己的CA根证书安装到浏览器中。这样您就不会收到有关证书的那些烦人的警告消息。其他用户通常不会安装您自己的 CA 根证书，但仍会收到警告。
If the CA's certificate is already installed in your browser, then when your browser encounters a certificate that claims to be signed by a certain CA it can verify that it was indeed signed by that CA. The CA itself usually verifies your identity in some way or other before signing your certificate.
Your self-signed certificate is just signed by your own CA. No one verified that the certificate actually belongs to the person it claims to belong. You can install your own CA's root certificate into your browser. That way you won't get those annoying warning messages about the certificate. Other users usually won't have your own CA's root certificate installed and will still get the warning.
证书本身没有区别。重要的是 CA 充当可信第三方。也就是说，客户可能不知道您是谁，但如果他们信任 CA，并且 CA 为您提供担保，那么他们就可以信任您。重要的不是证书本身，而是 CA 提供的信任链。
There's no difference between the certificates themselves. The important part is that the CA acts as a trusted third party. I.e. the client may not know who you are, but if they trust the CA, and the CA vouches for you, then they can trust you. It is not as much the certificate itself, but the chain of trust the CA provides.
CA 还会对您的身份进行一些验证，以便在使用网站时增加额外的信心。自签名证书可能不会在客户端浏览器上获得完整的“挂锁”。
The CA also does some verification that you are who you say you are, so they add an extra level of confidence when using a site. Self signed cert may not also get a full 'padlock' on a client's browser.
为了完成其他答案，操作系统预装了来自 Microsoft 或其他受信任机构的一些根证书。如果您的证书是由其中之一签署的，则不会显示任何警告。如果证书由操作系统无法识别的 CA 签名，则会显示警告。
And to complete the other answers the operating system comes preinstalled with some root certificates from Microsoft or other trusted authorities. if your certificate is signed by one of those then no warning will be shown. if a certificate is signed by a CA that the OS does not recognize then it will display a warning.
自签名证书与 CA 颁发的证书之间的主要区别在于信任链。如果您签署自己的证书，那么当您或其他人使用它时，他们将必须特别信任您签署证书所用的服务器。执行此操作的方法是将证书添加到浏览器（即 Firefox 或适用于 MSIE 或 Chrome 的 Microsoft CAPI 存储）中的“受信任的 CA 根”列表中，或者添加到适用于 Java 应用程序的
cacerts文件中。否则，您的自签名证书将不会受到信任，并且您将收到“警告”或错误消息，具体取决于您在该环境（即 Java 或特定浏览器）中的安全设置的严格程度。对于由 CA 签名的证书，如果签署该证书的 CA 或该 CA 的可信根（签署该 CA 证书的根）已在您的相关信任库（即浏览器或Java 的
cacerts文件）。 Microsoft 和 Oracle（针对 Java）不断更新受信任的 CA 并为已被泄露或撤销的 CA 或授权机构管理 CRL（证书撤销列表）。通常，这些受信任的 CA 之一（如 verisign、entrust 等）会收取 $$ 的费用来签署和颁发证书，并且有效期越长，收取的费用就越多。
自签名的是免费的，并且可以发布很长一段时间（尽管不推荐）。
The main difference between a self-signed certificate and one issued by a CA is the trust chain. If you sign your own certificate then when you or others use it they will have to specifically trust the server you signed the certificate with. The way to do this is to add the certificate to your list of "trusted CA roots" in your browser (i.e. Firefox, or Microsoft's CAPI store for MSIE or Chrome), or your
cacertsfile for Java applications. Otherwise your self-signed certificate won't be trusted and you will get a "warning" or error message depending on how strict your security settings are in that environment (i.e. Java or your specific browser).With a certificate that is signed by a CA you won't get that warning if either the CA that signed the certificate, or the CA's trusted Root (the one that signed that CA's certificate), is already in your relevant truststore (i.e. browser or
cacertsfile for Java). Microsoft and Oracle (for Java) are constantly updating trusted CA's and managing CRLs (Certificate Revocation Lists), for CA's or authorities that have been compromised or revoked.Usually one of these trusted CAs (like verisign, entrust, etc.) charge $$ for signing and issuing certificates and the longer the validity period the more they charge.
A self-signed one is free and may be issued for a long period of time (though not recommended).