是否可以自动选择正确的客户端证书？
我已经使用 SSL 客户端证书配置了 Apache httpd 网站，以便只有在 Web 浏览器中安装了正确证书的用户才能访问该网站。
如果仅安装了一个客户端证书，Web 浏览器将自动选择它（这不是默认设置，但可以在设置对话框中的某处进行配置）。但是，如果用户安装了多个证书，Web 浏览器会显示一份证书列表，用户必须选择正确的证书才能继续。
问题是：有没有办法配置httpd发送提示，以便网络浏览器可以自动选择所需的证书？
I have configured an Apache httpd website with SSL client side certificates so that only users who have installed the correct certificate in their web browsers can access the website.
If there is only one client side certificate installed the web browser will automatically select it (it is not the default, but it can be configured somewhere in the settings dialog). But if a user has more than one certificate installed, the web browser presents a list of certificates and the user has to pick the right one to continue.
The question is: Is there a way to configure httpd to send a hint so that the web browser can automatically select the required certificate?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
SSL (TLS) 协议仅允许服务器对客户端证书指定两个约束：
您可以使用 "openssl s_client" 查看您的 Apache 服务器信任哪个 CA 来获取客户端证书。我不知道如何配置 Apache 来更改该列表（抱歉），但我打赌有办法。因此，如果您可以将列表限制为（例如）您自己组织的 CA，那么您就已尽一切努力允许 Web 浏览器自动选择客户端证书。
正如尤金所说，浏览器是否真的这样做取决于特定的浏览器。
The SSL (TLS) protocol only allows the server to specify two constraints on the client certificate:
You can use "openssl s_client" to see which CAs your Apache server trusts for client certs. I do not know how to configure Apache to change that list (sorry), but I bet there is a way. So if you can limit the list to (say) your own organization's CA alone, then you will have done all you can to allow a Web browser to select the client cert automatically.
As Eugene said, whether the browser actually does so is up to the particular browser.
我想说，由于选择证书是客户端任务，因此没有明确的方法强制客户端使用服务器端的这个或那个证书。
I'd say that as selection of the certificate is a client-side task, there's no definite way to force the client use this or that certificate from the server side.
除了 @Nemo 和 @Eugene 所说的之外，默认情况下，Apache Httpd 将发送从其
SSLCACertificateFile或SSLCACertificatePath配置指令获取的 CA 列表。但是，您可以使用
SSLCADNRequestFile或SSLCADNRequestPath指令强制它在certificate_authorities中发送不同的列表，并将它们指向另一组证书。仅使用这些证书的主题 DN（并在列表中发送）。如果您想强制使用某些名称，您甚至可以使用您想要的任何名称对这些证书进行自签名。我已经尝试过这个（与SSLVerifyClient option_no_ca结合使用，您可以让客户端发送服务器实际上没有的 CA 证书的证书。（这不一定有用，但它可以工作） .)In addition to what @Nemo and @Eugene said, by default, Apache Httpd will send the list of CAs it gets from its
SSLCACertificateFileorSSLCACertificatePathconfiguration directives.However, you can force it to send a different list in
certificate_authoritiesusing theSSLCADNRequestFileorSSLCADNRequestPathdirectives and pointing them to another set of certificates. Only the Subject DN of these certificates is used (and send in the list). If you want to force certain names, you can even self-sign these certificates with whichever name you want. I've tried this (in conjunction withSSLVerifyClient optional_no_ca, and you can get clients to send certificates for CA certificates that the server doesn't actually have. (This isn't necessarily useful, but it works.)