PEM 文件格式在哪里指定？
我需要解析 .PEM 文件。
我知道 RFC 1421-24 中定义了“增强隐私的电子邮件”标准。但他们似乎没有提到我在 OpenSSL .pem 文件中找到的一些文本（例如“关键属性”、“开始证书”等......） 这是 OpenSSL 特定的格式吗？
I need to parse .PEM files.
I know that the standard for "Privacy-enhanced Electronic Mail" is defined in RFCs 1421-24. But they don't seem to mention some text I find inside OpenSSL .pem files (eg. "Key Attributes", "BEGIN CERTIFICATE", etc...)
Is this an OpenSSL-specific format?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
很长一段时间以来，关于信息加密交换的 PEM 格式都没有正式规范。 PEM 是文本编码，但实际编码的内容取决于上下文。 2015 年 4 月，IETF 批准了 RFC 7468，最终记录各种实现如何使用 PEM 文本编码交换数据。以下列表直接取自 RFC，描述了用于以下场景的 PEM 格式：
互联网中的公钥信息结构 X.509 公钥
基础设施证书和证书吊销列表 (CRL)
简介[RFC5280]。
非对称密钥包 [RFC5958]中的非对称密钥，并加密
同一文档中的私钥信息语法。
授权配置文件[RFC5755]。
根据此 RFC，对于上述场景，您可以预期以下标签位于 BEGIN 页眉和 END 页脚内。 RFC 的图 4 有更多详细信息，包括相应的 ASN.1 类型。
但这并不是故事的全部。 RFC 是通过查看现有实现并记录它们所做的事情来编写的。 RFC并不是首先编写的，也不是根据现有的一些权威文档编写的。因此，如果您最终想要与某些实现进行互操作，您可能必须查看实现的源代码以找出它们支持的内容。
例如，OpenSSL 在 crypto/pem/ 中定义这些 BEGIN 和 END 标记pem.h。以下是头文件的摘录，其中包含它们支持的所有 BEGIN 和 END 标签。
这些标签是一个开始，但您仍然需要研究实现如何对标签之间的数据进行编码。所有事情都没有一个正确答案。
For quite a long time, there was no formal specification of the PEM format with regards to cryptographic exchange of information. PEM is the textual encoding, but what is actually being encoded depends on the context. In April 2015, the IETF approved RFC 7468, which finally documents how various implementations exchange data using PEM textual encoding. The following list, taken directly from the RFC, describes the PEM format used for the following scenarios:
Public Key Info structures in the Internet X.509 Public Key
Infrastructure Certificate and Certificate Revocation List (CRL)
Profile [RFC5280].
Asymmetric Key in Asymmetric Key Package [RFC5958], and Encrypted
Private-Key Information Syntax in the same documents.
Profile for Authorization [RFC5755].
According to this RFC, for the above scenarios you can expect the following labels to be within the BEGIN header and END footer. Figure 4 of the RFC has more detail, including corresponding ASN.1 types.
That's not the full story, though. The RFC was written by looking at existing implementations and documenting what they did. The RFC wasn't written first, nor was it written based on some existing authoritative documentation. So if you end up in a situation where you want to inter-operate with some implementation, you may have to look into the implementation's source code to figure out what they support.
For example, OpenSSL defines these BEGIN and END markers in crypto/pem/pem.h. Here is an excerpt from the header file with all the BEGIN and END labels that they support.
These labels are a start, but you still have to look into how the implementation encodes the data between the labels. There's not one correct answer for everything.
更新了2015年的答案：由于用户已经回答了两次，在版主@royhowie删除答案之前：现在有定义 PEM 标头的 RFC 7468。下面的引用只是一小部分，你应该阅读实际的规范，它在互联网上的停留时间可能比 StackOverflow 长得多。
然而，@royhowie 删除了所有指向 RFC 的“仅链接”答案，除非它有一些文本。所以这里有一些文字：
Updated answer for 2015: As users have already answered twice, before moderator @royhowie deleted the answers: there is now RFC 7468 which defines the PEM headers. The following quote is only a small part, and you should read the actual spec, which will likely stay on the internet for far longer than StackOverflow will.
However @royhowie deletes every answer that points to the RFC as 'link only' unless it has some text. So here is some text:
让您开始：据我所知，如果有一个部分是人类可读的（有文字和东西），这意味着操作人员可以知道相关的认证是什么、到期日期等，以便快速进行手动验证。所以你可以忽略它。
您需要解析 BEGIN-END 块之间的内容。
在里面，您将找到一个 Base64 编码的实体，您需要将其解码为字节。这些字节代表 DER 编码的证书/密钥/等。我不确定您可以使用哪些好的库来解析 DER 数据。
作为了解每个块内数据的测试，您可以将 BEGIN-END 块之间的内容粘贴到此站点，该站点在 JavaScript 中进行 ASN.1 解码：
http://lapo.it/asn1js/
虽然我不会将任何生产环境私钥粘贴到任何站点（尽管这似乎只是一个 JavaScript）。
Base64：http://en.wikipedia.org/wiki/Base64
DER：http://en.wikipedia.org/wiki/Distinguished_Encoding_Rules
ASN.1：http://en.wikipedia.org/wiki/Abstract_Syntax_Notation_One
To get you started: As far as I know, if there's a part that's human-readable (has words and stuff), that's meant for human operators to know what the certification in question is, expiry dates, etc, for a quick manual verification. So you can ignore that.
You'll want to parse what's between the BEGIN-END blocks.
Inside, you'll find a Base64 encoded entity that you need to Base64 decode into bytes. These bytes represent a DER encoded certificate/key/etc. I'm not sure what good libraries you could use for parsing the DER data.
As a test to understand what data is inside each block, you can paste what's between the BEGIN-END blocks to this site which does ASN.1 decoding in JavaScript:
http://lapo.it/asn1js/
Although I wouldn't go pasting any production environment private keys to any site (although that seems to be just a javascript).
Base64: http://en.wikipedia.org/wiki/Base64
DER: http://en.wikipedia.org/wiki/Distinguished_Encoding_Rules
ASN.1: http://en.wikipedia.org/wiki/Abstract_Syntax_Notation_One
我发现了一个关于此问题的旧线程。封装边界似乎没有“官方”标准格式，确定这一点的最佳方法是根据在
BEGIN语句中找到的众所周知的关键字猜测内容。正如 indiv 的回答，有关关键字的完整列表，请参阅 OpenSSL crypto/pem/pem.h 头文件。
I found an old thread regarding this issue. It looks like there is no "official" standard format for the encapsulation boundaries and the best way to determine this is by guessing the contents based on well-known keywords you find in the
BEGINstatement.As answered by indiv, for the full list of the keywords, refer to the OpenSSL crypto/pem/pem.h header file.
我不确定它是否特定于 OpenSSL，但 PEM 加密格式可能就是您正在寻找的。
I am unsure if it's specific to OpenSSL, but the documentation for PEM Encryption Format may be what you're looking for.
没有一处地方。这取决于标准。您甚至可以创建自己的封装边界并在自己的软件中使用它们。
正如 @indiv 所说，OpenSSL 在
/crypto/pem/pem.h 有人要求 PKIX 工作组提供一份像您在 2006 年要求的那样的列表。工作组拒绝了。请参阅 PEM 文件格式 rfc 草案请求。
There is no one place. It depends on the standard. You can even make up your own encapsulation boundaries and use them in your own software.
As @indiv stated, OpenSSL has a fairly comprehensive list at
<openssl dir>/crypto/pem/pem.h.Someone asked the PKIX Working Group to provide a list like you are asking for back in 2006. The working group declined. See PEM file format rfc draft request.