HTTPS 和证书
HTTPS 如何接受证书？
How does HTTPS work with respect to accepting a certificate?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
HTTPS 如何接受证书？
How does HTTPS work with respect to accepting a certificate?
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
接受 或继续使用网站，即表示您同意使用 Cookies 和您的相关数据。
发布评论
评论（2）
非常简单地讲一个小故事：
证书用于SSL 握手。服务器传递给客户端的证书由 签名 /en.wikipedia.org/wiki/Certificate_authority" rel="noreferrer">证书颁发机构 (CA)，如 VeriSign，特定于服务器。 SSL 握手过程中会进行各种检查。要了解的重要事项之一是证书的通用名称属性必须与服务器的主机/DNS 名称匹配。
客户端拥有 CA 的公共证书（密钥） 的副本，因此可以使用它（计算为例如 SHA1）来查看服务器的证书是否仍然可以。
Very sipmly put with a little story:
Certificates are used in the SSL handshake. The certificate that the server hands to the client is signed by a Certificate Authority (CA) like VeriSign and is specific to the server. There are various checks that happens in the SSL handshake. One of the important ones to know about is the Common Name attribute of the certificate must match the host / DNS name of the server.
The client has a copy of the CA's public certificate (key) and can thus use it (calculate with SHA1 for example) to see if the server's certificate is still ok.
首先我们需要区分服务器端和客户端证书。
大多数情况下仅使用服务器端证书。它用于让客户端通过验证服务器的证书来验证客户端所连接的服务器的真实性（验证过程将在下面介绍）。这样做应该可以防止中间人 (MITM) 攻击。
当我们需要将对服务器的访问限制为仅某些用户组时，可以使用客户端证书。为此，客户端使用证书对自身进行身份验证。由于用户集通常是有限的（根据某些标准，它在现实生活中可能非常大），因此验证过程通常与服务器证书验证过程有点不同。
接下来，关于验证本身。
在客户端验证服务器证书时，客户端执行以下步骤：
当服务器验证客户端的证书时，上述过程通常会被简化，因为同一个系统是 CA 和验证其访问的服务器。在这种情况下，证书可以直接与允许的证书列表匹配，或者上述大多数步骤可能是不必要的。
First of all we need to distinguish server-side and client-side certificates.
In most cases only the server-side certificate is used. It is used to let the client verify the authenticity of the server that the client has connected to by validating the server's certificate (validation procedure will be described below). Doing this should prevent man-in-the-middle (MITM) attack.
Client-side certificate is used when we need to restrict access to the server to only some set of users. To do this the client authenticates itself with the certificate. As the set of users is usually limited (by some criteria, it can be quite large in real life), validation procedure is often a bit different from the server cert validation procedure.
Next, about validation itself.
When validating the server's certificate on the client, the client takes the following steps:
When the server validates client's certificate, the above procedure is usually simplified because the same system is a CA and a server access to which is verified. In this case certificates can be either matched directly to the list of allowed certificates or most of the above steps can be unnecessary.