分布式 PKI 证书处理 - 使其用户友好
我有一台服务器和 N 个客户端安装在不同的主机上。每个主机都有在安装过程中生成的自签名证书。此时客户端身份验证已打开。这意味着在按照如下所述正确导入这些证书之前，它们无法相互通信。
现在，服务器需要导入所有客户端的证书。这台服务器上的所有客户端也是如此。这部分在安装过程中对用户来说确实不友好，因为客户端或服务器可以随时彼此独立安装。 在客户端和服务器之间导入证书而无需用户执行某种带外手动步骤的更好方法是什么？
PS：我使用的PKI工具只能在本地计算机上导入/导出证书。假设我目前无法更改此工具。
I have a Server and N number of clients installed on different hosts. Each host has its self-signed certificate generated during install. The client authentication is turned ON at this point. Which means they can't communicate to each other until these certs are properly imported as described below.
Now, the server needs to import all the clients' certificates. So do all the clients from this single server. This part is really not user friendly to do it during install as either client or the server can be installed independent of each other any time.
What is the better way to import certs between clients and server without the user having to perform some kind of out-of-band manual steps?
PS: The PKI tool I am using can only import/export certificates on a local machine only. Assume I can't change this tool at this time.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
总的来说，这是 PKI 的问题之一。以自动化方式安全地分发证书是一件痛苦的事情。
在 Active Directory 域环境中，您已经拥有 Kerberos 信任。因此，您可以使用组策略自动安全地分发证书。不知道这是否适用于您，因为您没有提供有关您的环境/操作系统等的信息。
In general, this is one of the problems with PKI. It is a pain to securely distribute certificates in an automated fashion.
In an Active Directory domain environment you already have a Kerberos trust in place. Therefore you can use group policy to securely distribute certficates automatically. Don't know if that would apply to you because you haven't given information about your environment/OS etc.