红帽 - 接受自签名证书
有没有办法让 Red Hat Linux 机器信任自签名证书？
例如 wget https://example.com - 给出一个错误，表明证书不受信任，为“https://example.com”拥有自签名证书；使用 wget '--no-check-certificate' 可以覆盖证书检查。但我想让红帽隐式信任自签名证书 - 有没有办法做到这一点？
谢谢。
Is there a way I can get a Red Hat Linux box to trust a self-signed certificate?
e.g. wget https://example.com - gives an error that certificate is untrusted as 'https://example.com' has a self-signed certificate; with wget '--no-check-certificate' can over-ride checking of the certificate. But I would like to get the Red Hat to implicitly trust the self-signed certificate - is there a way to do this?
Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
这本身不是一个编码/编程问题，但我认为这个答案在编写软件时可能同样有效，所以我无论如何都会发布它。
在您正在使用的计算机系统或您正在编写的软件中默认信任自签名证书是一个糟糕的主意。如果您接受所有证书，那么中间人攻击就会变得微不足道。攻击者所需要做的就是向您提供自签名证书，并对流量进行解密和重新加密。
通常，对于这种情况，您需要创建自己的证书颁发机构，用它签署您的证书，并将其添加到
/etc/ca-certificates.conf或 Red Hat 使用的任何内容。如果您正在编写自己的软件，我还会跟踪给定主机提供的旧证书，这样如果它已更改，我就会收到警告，因为我怀疑完全信任全局 CA 是否明智。
我认为以下是最佳实践：
That's not a coding/programming question per se, but I figure this answer might be equally valid when writing software, so I'll post it anyway.
Trusting self-signed certificates by default in a computer system you're using or software that you're writing is a terrible idea. If you accept all certificates it would make a man in the middle attack trivial. All the attacker needs to do is to present a self-signed certificate to you and decrypt and re-encrypt the traffic.
Usually for such situations you need to create your own certificate authority, sign your certificates with it, and add it to
/etc/ca-certificates.confor whatever Red Hat uses.If you were writing software of your own, I'd also keep track of the old certificates that a given host provided, so that I'm warned if it had changed because I have my doubts that fully trusting global CAs is wise.
I'd say the following are best practice: