在 Apache 中无需 SSL 的服务器之间发送加密数据
我有几个独立的 PHP 应用程序在几台服务器上运行。所有服务器都没有 SSL，但我可以使用 PHP 包装器来支持 SSL。我想确保服务器之间发送的所有数据都是安全且经过签名的。我是否需要生成证书，或者每次发送内容时创建公钥/私钥就足够了吗？这种方法安全吗？
I have several independent PHP applications running on few servers. None of the servers have SSL, but I'm able to use PHP wraper for SSL. I would like to ensure all data sent between servers is safe and signed. Do I need to generate an certificate or is it enough to create public/private key everytime I send something? Is this aproach safe?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
不要每次都生成公钥/私钥。您如何检查谁拥有私钥的控制权？证书的要点是能够将身份绑定到公钥：检查您是否信任该证书以及您是否愿意与其所引用的身份进行通信是确保通信安全的必要组成部分。
据我了解，服务器之间的通信不涉及用户交互本身。如果您控制所有服务器，您可以向它们提供证书，可以是自签名 X.509 证书（如果您可以为所有各方安装所有证书：实际上仅适用于少数服务器）或您自己的 CA（如果您有 OpenSSL，查看
CA.pl，其中有一个手册页）。然后，您可以使用 S/MIME 对交换的内容进行签名和加密（PHP 中有可用的函数）。
（您也可以使用 PGP 来实现相同的目标，但使用 PGP 密钥/证书。）
Don't generate a public/private key every time. How would you be able to check who has control over the private key? The point of certificates is to be able to bind an identity to a public key: checking you trust the certificate and that you're willing to communicate with the identity it refers to is a necessary component to secure the communication.
From what I understand, the communication between the servers doesn't involve user interaction itself. If you control all the servers, you could give them certificates, either self-signed X.509 certificates (if you can install them all for all parties: only applicable for small numbers in practice) or your own CA (if you have OpenSSL, look into
CA.pl, which has a man-page).You could then sign an encrypt the content you exchange using S/MIME (there are functions available in PHP for this).
(You might also be able to achieve the same goal using PGP, using PGP keys/certificates instead.)
如果两台机器都有 mcrypt，那么您可能可以在一端加密要在 PHP 中通过线路发送的文本，并在另一端解密，但当然，这里遇到的大问题将是密钥分发。您要么必须使用正确的密钥预先配置每台计算机，并希望没有人注意到您每次都使用相同的密钥（这很糟糕），要么您必须想出某种方式来分发您的密钥。当您发送数据时，将密钥发送给接收机器，而密钥不会被窥探。 （这很复杂）。
你也提到了签名，这也是一个棘手的问题。
虽然理论上可以使用适当的扩展（例如 mcrypt）在 PHP 中实现所有这些，但老实说，我怀疑是否值得付出努力去做正确的事情，这将是相当大的，您也只是在重新发明轮子。
SSL 已经实现了您需要的所有功能，并且是公认的行业标准，如果可能的话，我强烈建议您安装它。
If both machines have mcrypt then you could probably encrypt the text you want to send over the wire in PHP at one end and decrypt it at the other, but of course the big issue you have here is going to be key distribution. You'd either have to pre-configure each machine with the correct key and hope nobody notices you're using the same key every time (which is bad), or you'll have to come up with some kind of way of distributing your key to the receiving machine when you send data without the key being snooped. (which is complicated).
You also mentioned signing, which is also a tricky issue.
Whilst it would in theory be possible to implement all this in PHP using an appropriate extension such as mcrypt, I honestly doubt it would be worth the effort of doing it right, which would be considerable, You'd also just be reinventing the wheel.
SSL implements all the stuff you need already and is the accepted industry standard, if at all possible I'd strongly recommend you install it.
在我的一个小项目中，我使用 Blowfish 加密进行一些数据传输，使用大多数服务器上可用的 mcrypt 扩展：
解密的方式相同，只需使用 mcrypt_decrypt 即可。这是共享密钥，而不是公钥/私钥系统。
In a little project of mine I use Blowfish encryption for some data transfer, using the mcrypt extension that's available on most servers:
Decrypting goes the same way, just use mcrypt_decrypt. This is a shared key, not a public/private key system.