SSL 和证书
1）据我所知，仅要求客户端提供证书的情况下不可能建立SSL连接。知道为什么 SSL 不允许这样做吗？
2) 我假设 SSL 连接可以配置为：
- 仅要求服务器提供证书
- 要求服务器和客户端都提供其证书
3) 可能是一个愚蠢的问题，但是 SSL 如何“知道”哪一方是客户端并且哪一边是服务器？
4) 是否可以在不需要 SSL 请求任何证书的情况下建立 SSL 连接？
谢谢
1) As far as I know, it is not possible to establish a SSL connection where only the client is reuired to provide a certificate. Any idea why SSL doesn't allow this?
2) I assume SSL connection can be configured to either:
- require only server to provide a certificate
- require for both server and the client to provide their certificates
3) Probably a stupid question, but how does SSL "know" which side is a client and which side is a server?
4) Is it possible to establish a SSL connection without SSL requesting any certificates?
thank you
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
如果服务器未经身份验证，您实际上无法拥有私有通道 - 中间人很容易窃听并在两个合法方之间中继流量。如果您没有隐私或身份验证，为什么要使用 SSL？实际上存在“匿名”模式，其中公钥加密用于就加密密钥达成一致，但客户端或服务器都不提供证书；但是，我从未见过它们被使用过，可能是因为它们无法解决中间人窃听攻击。
是的，服务器提供证书。服务器可以向客户端请求证书。客户端可以使用证书进行响应，也可以忽略该请求。如果请求被忽略，服务器可以选择继续匿名客户端，或者终止连接。
客户端和服务器的角色是在 SSL 握手期间建立的。第一条消息称为
ClientHello。发送此消息的一方是客户端。通常，这将是发起 TCP 连接的一方，但并非必须如此（事实上，SSL 中没有任何内容需要 TCP 作为传输）。是的，正如我在 #1 中提到的，SSL 具有“匿名”模式，其中任何一方都无法安全地验证另一方。这将在未知各方之间提供一个私密的、防篡改的通道。但是，由于您不知道谁在通道的另一端，因此您不知道这是一个中间人，他同时进行了两次握手并拦截了您和您之间的所有流量您认为正在与之交谈的一方。为了阻止这种情况，您必须在 SSL 之上有一个身份验证协议，为了安全起见，该协议将不可避免地看起来很像经过身份验证的 SSL。
If the server is not authenticated, you really cannot have a private channel—it is too easy for a man-in-the-middle to eavesdrop, relaying traffic between the two legitimate parties. If you don't have privacy or authentication, why use SSL? There are actually "anonymous" modes where public-key cryptography is used to agree on an encryption key, but neither client or server present certificates; but, I've never seen them used, probably because they can't address the man-in-the-middle eavesdropping attack.
Yes, the server provides a certificate. The server can request a certificate from the client. The client can respond with a certificate, or ignore the request. If the request is ignored, the server can choose to continue with an anonymous client, or terminate the connection.
The roles of client and server are established during the SSL handshake. The first message is called
ClientHello. The party that sends this message is the client. Normally, this would be the party that initiated the TCP connection, but it doesn't have to be (in fact, there's nothing in SSL that requires TCP as transport).Yes, as I mentioned in #1, SSL has "anonymous" modes where neither party can securely authenticate the other. This would provide a private, tamper-proof channel between to unknown parties. However, since you don't know who's on the other end of the channel, you don't know that it's a man-in-the-middle, who has carried out two simultaneous handshakes and is intercepting all of the traffic between you and the party you thought you were talking to. To thwart this, you'd have to have an authentication protocol on top of SSL that, in order to be secure, would inevitably wind up looking a lot like authenticated SSL.
您好，
以下是对您问题的答复：
1) 据我所知，仅需要客户端提供证书的情况下不可能建立 SSL 连接。知道为什么 SSL 不允许这样做吗？
SSL 证书 将确保服务器上的网站安全，并且用户计算机和网站之间的数据传输将受到保护。它还取决于证书的类型。
2) 我假设 SSL 连接可以配置为：
仅需要服务器提供证书
要求服务器和客户端都提供证书
服务器确实是必要的。而且客户端还需要提供 CSR 才能获得特定网站的唯一 SSL 证书。
3）可能是一个愚蠢的问题，但是SSL如何“知道”哪一端是客户端，哪一端是服务器？
客户端和服务器的验证是在SSL连接期间完成的。当网站的访问者提供重要信息时，只要有 SSL 证书，它就是安全的，但这也取决于安装的证书类型。
4) 是否可以在不需要 SSL 请求任何证书的情况下建立 SSL 连接？
这取决于证书的类型（自动生成或来自证书颁发机构）。 SSL证书是唯一的，仅针对特定网站并根据客户给出的CSR颁发。
谨致问候，
www.networking4all.fr
Good day,
Here are the responses to your questions:
1) As far as I know, it is not possible to establish a SSL connection where only the client is reuired to provide a certificate. Any idea why SSL doesn't allow this?
The SSL certificate will secure the website located on the server and the transmission of data between the computer of the user and the website will be secured. It also depends on the type of the certificate.
2) I assume SSL connection can be configured to either:
require only server to provide a certificate
require for both server and the client to provide their certificates
The server is necessary indeed. But also the client needs to provide the CSR in order to have an unique SSL certificate to the specific website.
3) Probably a stupid question, but how does SSL "know" which side is a client and which side is a server?
The verifications of the client and the server are done during the SSL connection. When the visitor of the website gives vital information, as long as there is a SSL certificate, it is secured, but it also depends on the type of the certificate installed.
4) Is it possible to establish a SSL connection without SSL requesting any certificates?
It depends on the type of the certificate (auto-generated or from a Certificate Authority). The SSL certificate is unique and issued only for the specific website and according to the CSR given by the client.
Best regards,
www.networking4all.fr