PKI 更新 SSL 证书的最佳实践
在无需用户交互的情况下更新客户端 SSL 证书的最佳实践是什么？
更具体地说：
我有一台带有 SSL 私钥/公共 x.509 证书的服务器。 所有客户端都将通过 SSL 与该服务器通信。 为了建立 SSL 连接，所有客户端都需要将服务器的公共证书导入到其受信任位置（信任库）。
在（客户端）安装时获取服务器的证书不是问题，因为安装程序可以（通过 SSL）联系服务器并获取服务器的公钥（或公司的根证书）。之后，安装程序可以向用户显示证书以进行视觉验证，这足够安全。
服务器证书（或公司CA）过期后会发生什么？
或者如果不小心更改了服务器证书会发生什么情况？
使用新服务器 SSL 证书 (CA)（自动）更新所有客户端的最佳实践是什么？请记住，安装后客户端是后台进程，并且不可能进行可视化用户交互。
当然，最简单的方法是由基础设施管理员手动更新所有客户端。
我想知道是否有一些已知的良好做法可以自动更新客户端的证书而无需用户干预？
What are the best practices for updating client-side SSL certificates without user interaction?
To be more specific:
I have a server with SSL private key/public x.509 certificate.
All clients will communicate with this server through SSL.
In order to establish SSL connection all clients need to import the server's public certificate to their trusted locations (truststore).
Getting the server's certificate at (client) install time is not a problem because the installer can contact the server (by SSL) and get the server's public key (or the company's Root Certificate). After that the installer can show the certificate to the user for visual validation and this is secure enough.
What will happen after the server certificate (or the company CA) expires?
Or what will happen if the server certificate is accidentally changed?
What are the best practices to (automatically) update all clients with the new server SSL certificate (CA)? Having in mind that after installation the clients are background processes and the is not visual user interaction possible.
Of course the easiest way is to manually update all clients by the infrastructure administrator.
I'm wondering if there are some known good practices to automatically update the client's certificates without user intervention?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
理想情况下，您的服务器证书应由具有较长生命周期（10 到 20 年）的受信任根 CA 证书颁发和签名。仅根 CA 证书将安装在客户端上。
服务器证书本身，即使您每年更新它，也不需要传播给客户端，因为根对其进行了签名并且受到信任。
如果您使用自签名证书，这就是从证书管理角度来看它们通常不受欢迎的原因。当它们过期或更改时，您需要每个人都进行更新 - 否则您将收到浏览器安全警告。
Ideally, your server certificates should be issued and signed by a trusted root CA certificate with a long lifetime (10 to 20 years). Just the root CA certificate would be installed on the client end.
The server certificate itself, even if you update it every year, would not need to be propogated to clients since the root signed it and is trusted.
If you're using self-signed certificates, this is why they are generally frowned upon from a certificate management perspective. When they expire or change, you need everyone to update - otherwise you'll get browser security warnings.