CA 签名 SSL 证书的安全优势
这只是关于自签名证书和 CA 证书之间争论的一般性问题...
我了解 CA 证书的好处，因为大多数浏览器都会避免生成警告，但是 CA 证书如何有利于实际安全呢？我经常听说最大的威胁是中间人攻击，虽然我了解使用自签名证书的这种威胁，但我不明白 CA 证书如何防止这种情况。我知道 CA 执行自己的安全算法，难道不能在自签名证书上使用相同的算法吗？
我想我只是对围绕 CA 证书需求的大企业有点恼火，但除了他们执行的这些所谓的额外安全检查之外，似乎找不到任何不同之处。从安全角度来看，CA 是否可以提供自签名证书无法提供的功能？
This is just a general question regarding the debate between self-signed certificates and CA certificates...
I understand the benefits for a CA certificate due to the avoided warnings generated in most browsers, but how does a CA certificate benefit actual security? I commonly hear the biggest threat is man-in-the-middle attacks, and while I understand this threat using a self-signed certificate, I don't understand how a CA certificate prevents this. I know CAs perform their own security algorithms couldn't the same algorithms be used on self-signed certificates?
I guess I'm just a little irritated by the big business revolving around the need for CA certificates but can't seem to find anything different about them other then these supposed additional security checks they perform. Is there anything a CA can provide from a security point-of-view that self-signed certificates cannot?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
欺骗。如果对方伪造了自签名证书，你没有办法检查这一点。为了检查您是否收到了有效的证书而不是伪造的证书，您需要第三方检查，该第三方检查不能轻易被欺骗。这是通过客户端软件携带根 CA 证书（和一些中间证书）列表（Windows 为您提供此类证书，主要浏览器也执行相同操作）并使用这些 CA 证书验证您从服务器收到的证书来完成的。 。对于自签名证书，此类验证是不可能的。
当然，您可以在客户端应用程序中携带自签名证书（这是一些开发人员所做的，特别是对于内部应用程序），但这不适用于浏览器。
Spoofing. If the other party fakes a self-signed certificate, you have no way to check this. In order to check that you have received the valid certificate and not a forged one, you need third-party check which can not be easily spoofed. This is done by carrying the list of root CA certificates (and some intermediate certificates) with your client-side software (Windows includes such certificates for you and major browsers do the same) and verifying the certificate you receive from the server using those CA certificates. With self-signed certificates such verification is not possible.
Of course, you can carry the self-signed certificate with your client application (and this is what some developers do, especially for in-house applications) but this doesn't work with browsers.
区别不在于算法，而在于人们是否信任证书颁发机构。
证书的目的是验证您是否正在与您打算与之建立连接的人建立连接。
如果我对你说“我是合适的服务器，请相信我”，你可能会选择不相信我（毕竟，你不认识我）。
如果我对你说“我是正确的服务器，并且我有证书来证明这一点”，你可以说“好吧，谁给了你这个证书？”如果我的回答是“来自拐角处的乔”，你仍然可以选择不相信我。
但如果我说“我有一个证书，你可以与你信任的第三方确认”，你可能会认为这是一个很好的身份证明。
您如何确认它就是标准的全部内容（例如，如 RFC 5280 中所述）。但这只是技术细节。您可以对源自 VeriSign 的证书和您自己生成的证书使用完全相同的算法。
真正的问题是关于信任：您是否信任为您提供“身份证明”的人。我们足够信任 VeriSign，允许每个浏览器接受他们提供的任何身份证明。我们应该信任生成自己的自签名证书的个人吗？在某些情况下，我们可能会这样做（在这种情况下，您可以在浏览器中手动安装他们的证书），但一般情况下不会这样做。
The difference isn't in the algorithm, it's in whether people trust the certificate authority or not.
The point of a certificate is to verify that you are making the connection with whoever it is that you intend to make the connection with.
If I say to you "I'm the right server, trust me on this", you may choose not to believe me (after all, you don't know me).
If I say to you "I'm the right server, and I have a certificate to prove it", you could say "ok, and who gave you this certificate?" If my reply is "Joe from around the corner", you may still choose not to believe me.
But if I say "I have a certificate, and you can confirm it with a third party that you trust", you may decide that this is a good proof of identity.
How you confirm it is what the standard is all about (e.g. as described in RFC 5280). But that's just technicalities. You could use the exact same algorithm for a certificate that originated from VeriSign and for a certificate you generate yourself.
The real question is about trust: do you trust whoever is giving you the "proof of identity". We trust VeriSign enough to allow any proof of identity from them to be accepted by every browser. Should we trust individuals that generate their own self-signed certificates? We might do in some cases (in which case you can install their certificates in your browser manually), but not as a general rule.