证书是否为 SSL 连接/状态“点”？如果我在 OpenSSL 中加载新证书来更改？
我正在构建一个应用程序，使用户能够连接到同一服务器。重要的是确保每个用户都有自己的证书/私钥用于加密，而不是应用程序/设备使用自己的证书/私钥。
现在我从 OpenSSL 网站文档中知道，他们的 OpenSSL 内部证书存储可以保存 RSA 密码的一对证书/密钥。我的问题是这样的：
假设我有一个名为 ssl1 的 SSL 结构，它是我从 SSL_CTX 创建的，其中我没有设置要在 SSL_CTX 中使用的证书/密钥（因此不会继承证书/密钥） 。然后，我继续为与某个用户关联的 ssl1 设置证书/密钥。然后假设我有另一个从同一个 SSL_CTX 创建的名为 ssl2 的 SSL 结构。然后，我继续为与第一个用户不同的用户关联的 ssl2 设置证书/密钥。
如果此时我在 ssl1 上调用 SSL_connect() API，它会使用我为 ssl2 设置的证书/密钥吗？我问，因为商店说它只保存一个证书/密钥对，并且我最后加载了 ssl2 的证书/密钥，因此我认为它会覆盖我首先为 ssl1 加载的证书/密钥强>。
感谢您阅读我的帖子。我感谢您提供的任何帮助/智慧/指示。
I am building an application that will enable users to connect to the same server. Rather than the application/device using its own certificate/private key, it is important to ensure that each user has their own certificate/private key to use for encryption.
Now I know, from the OpenSSL website documents, that their internal certificate store of OpenSSL can hold one certificate/key pair for the RSA cipher. My question is this:
Presume I have a SSL struct named ssl1 that I created from my SSL_CTX where I didn't set the certificate/key to use in the SSL_CTX (thus not inheriting the certificate/key). I then go on to set the certificate/key for ssl1 that is associated with some user. Then suppose I have another SSL struct named ssl2 created from the same SSL_CTX. I then go on to set the certificate/key for ssl2 that is associated with a different user than the first one.
If at this point I call the SSL_connect() API on ssl1 will it use the certificate/key I set for ssl2? I ask since the store says it only holds one cert/key pair and I loaded the cert/key for ssl2 last, thus I presume it would overwrite the one I loaded first for ssl1.
Thanks for reading my post. I appreciate any help/wisdom/pointers you can provide.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
据我了解，SSL_CTX 充当 SSL 对象的模板。因此，当您创建新的 SSL 对象时，它会继承创建它的 SSL_CTX 的属性/属性。 此处清楚地提到了这一点，
因此对于您的问题，ssl1< /strong> 和 ssl2 对象将使用自己的证书/密钥。
As far as I understand the SSL_CTX acts as template for SSL objects. So when you create new SSL object it inherits the properties/attributes of the SSL_CTX from which it is created. This is clearly mentioned here
So for your question, both ssl1 and ssl2 objects will use their own certificate/key.
首先，我对您要求的实施细节感到困惑。其次，我无法想到不同的密钥会有用的情况，除非您尝试通过用户的证书对用户进行身份验证——您显然没有这样做（用户需要不同的加密，而不是身份验证。
我相信什么您真正想要做的是使用提供完美前向保密的设置来建立连接。也就是说，您想要使用的 TLS 密码均具有以 TLS_DHE_ 开头的名称。这些密码使用 Diffie-Hellman 密钥交换，从而使服务器密钥的作用基本上是服务器对用户的身份验证。
First, I'm confused about the implementation details you're asking for. Second, I can't think of a circumstance in which different keys would be useful unless you're trying to authenticate your users by their certificates -- which you're apparently not doing (users needing different encryption, not authentication.
I believe what you really want to do is establish your connections using settings that provide for Perfect Forward Secrecy. To do that, you want to use TLS ciphers all have names that start with TLS_DHE_. Those use Diffie-Hellman key exchanges, thus making the role of the server's key basically one of authentication of the server to users.