我可以在不同的 HTTPS 服务器上使用自签名 X.509 证书吗？
我已在 server1 上使用 Selssl7.exe 创建了 SSL 证书，但使用 Cn 作为 Server2 并将证书托管在 server2 上。从 linux firefox 浏览时，我开始收到证书错误：
此证书无效，该证书不受信任并且是自签名的，该证书仅对 server1 有效
但是当我从 Windows IE 浏览 URL 时，我只是收到常规错误，指出它不受信任，我可以轻松地将其添加到例外中。
我们可以在不同的服务器上使用 server1 上生成的自签名证书吗？
I have created my SSL certificate using Selssl7.exe on server1 but used Cn as Server2 and hosted the certificate on server2. I started to get a certificate error when browsing from linux firefox saying:
This certificate is invalid, the certificate is not trusted and is self signed, the certificate is only valid for server1
But when I browse the URL from Windows IE I just get the regular error saying that it's not trusted and I can easily add it to exceptions.
Can we use self-signed certificates generated on server1 on a different servers?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
你可以，你也可以，但这样做几乎会破坏真实性的每一个方面。
自签名证书通常会出现问题，因为其他用户不会提前知道该证书。因此他们的浏览器尽职尽责地发出警告。这就是为什么您必须为可识别的 TLS 证书付费 - 它们由 CA 颁发，其证书包含在您浏览器的默认信任存储中。 CA 必须付费才能“成为俱乐部的一部分”，但除此之外，任何人都可以创建证书。这只是默认设置被识别的问题。
但是，通过在不同的服务器上重复使用为专用服务器颁发的证书，您会打开另一个漏洞。 TLS 证书的主题专有名称必须与部署它们的服务器的主机名相匹配。这是 TLS 规范强制要求的，因为这是使用 TLS 时防止中间人攻击的唯一有效措施。打开与服务器的 TLS 连接后，您的代码将检查您连接的主机名是否与发送的服务器证书的主题 DN 匹配。只有这样，您才能确保与正确的服务器通信。
因此，总而言之，如果您在不同的主机上重复使用服务器证书，则会严重影响 TLS 的安全性。当然，这仍然是可能的，但如果您将安全性削弱到这种程度，那么您最好首先使用纯 HTTP。
You can and you may but you are pretty much undermining each and every aspect of authenticity by doing so.
A self-signed certificate is generally a problem because other users will not know this certificate in advance. So their browser dutifully issues a warning. That's why you have to pay for TLS certificates that will be recognized - they are issued by CAs whose certificates are contained in the default trust store of your browser. CAs had to pay to "be part of the club", but otherwise, anyone can create certificates. It's just the matter of being recognized by default settings.
But you open another hole by reusing a certificate that was issued for a dedicated server on a different server. TLS certificates' subject distinguished names must match the host name of the server they are deployed on. This is mandated by the TLS spec because this is the only effective measure to prevent man-in-the-middle attacks when using TLS. After you open a TLS connection to a server, your code will check whether the host name that you are connected to matches the subject DN of the server's certificate that was sent. Only if it does you can be sure to be talking to the right server.
So, in conclusion, if you reuse a server certificate on a different host, then you are severely impacting the security of TLS. It's still possible, sure, but if you cripple security to this extent, then you are probably better off using plain HTTP in the first place.