签名工具吊销问题？
我有两个二进制文件，其中一个是在第一个二进制文件约 4 天后构建的，并使用相同的证书（相同的序列号，由 Thawte 颁发）进行签名，但是，当我检查证书时，其中一个出现错误消息 吊销状态：吊销功能无法检查吊销，因为吊销服务器离线。，第二个效果很好。是否有可能吊销服务器在签名时处于离线状态，从而导致此问题？我不确定是否还有其他方法可以让一个证书拥有不同的吊销服务器。
我可能想到的另一个想法是，第二个证书是在证书到期前几天（<一个月）签署的。可能是这样吗？
I've got two binaries, one builded ~4 days after first, and signed with the same certificate (same Serial number, issued by Thawte), but, when I'm checking the certificate, on one there is error message Revocation Status : The revocation function was unable to check revocation because the revocation server was offline., the second works well. Is it possible, that the revocation server was offline at the time of signing, and that causes this problem? I'm not sure if there is other way how one certificate could have different revocation servers.
Another think I may think of is, that the second one was signed few days (< month) before certificate's expiration. Could this be the case?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
证书是什么格式的？如果您可以输入合适的格式，则可以使用“openssl”命令行unix工具来调查证书。 Openssl 也适用于 Windows。
这是一个示例运行：
这是输出：
特别要注意这些：
这些是 CRL（针对此特定证书），您可以使用常规浏览器访问它们以查看问题所在！注意：某些证书使用 OCSP 进行吊销，因此请在输出中查找 OCSP 和 CRL。
What format is the certificate in? If you can get into a suitable format, you can use the "openssl" command line unix tool to investigate the certificate. Openssl works on windows, too.
Here's a sample run:
And here's the output:
In particular, notice these:
Those are the CRL's (for this particular certificate), and you can visit them with a regular browser to see what the problem is! Note: some certificates use OCSP for revocation instead, so look for OCSP and CRL in the output.
首先，您应该在此处查看有关如何验证签名二进制文件的 MSDN 文档。错误响应将提供更多信息。
这个博主有一个解决方法，如果您如果您自己的密钥的撤销服务器出现问题，您将知道它是否已被撤销:)。此外，由于该密钥现在已过期，因此配置此设置可能不是什么大问题。
如果您发布详细的错误代码，我可以再看一下，但这现在应该对您有用。
First off you should check the MSDN documentation about how to validate signed binaries here. The error responce will be much more informative.
This blogger has a workaround, and if your having issues with the revokation server for your own keys, you will know if it's been revoked :). Also, as this key is expired now it may not be a big deal to configure this setting.
If you post the detailed error codes I can look at it a bit more but this should work for you for now.
证书签名不依赖于证书吊销检查，仅依赖于验证。这听起来像是您在验证证书时出现了临时网络故障。这个问题可以重复吗？
Certificate signing is not dependent on checking for certificate revocation, only verification is. This sounds like there was a temporary network glitch when you were verifying the certificates. Is this problem repeatable?