TLS安全通信 - 证书验证
我需要一些信息来验证服务器证书。 我希望第一步执行基于日期的验证。 准确地说，我正在研究由 CA 签名的服务器证书是否过期的可能性。 如果 CA 有效期于 2022 年 12 月到期，我是否仍可以让其签署本应于 2023 年 4 月到期的服务器证书？ 换句话说，如果我的服务器证书有一定的到期日期，我是否可以假设签署它的 CA 也具有等于或大于服务器证书的有效性？ 如果不是，我应该对 CA 或 CA 链进行单独的日期验证吗？
提前致谢。
I need some information for validating a server certificate.
Am looking to perform date based validation as the first step.
To be precise, am looking at the possibility of expiry of a server certificate that is signed by a CA.
If the CA validity expires on December 2022, can I still get it to sign my server certificate that is supposed to expire only in April 2023?
In other words, if my server certificate has a certain expiry date, can I assume that the CA that signed it also has validity equal to or greater than the server certificate?
If not, should I do a separate date validation for the CA or chain of CAs?
Thanks in advance.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
从技术上讲，是的。但是，大多数CA实施限制了已发行的证书有效性，以与CA证书寿命相交。
作为一个很好的做法，您应该验证链中的所有证书。但是，我建议不要写自己的验证。大多数框架都提供功能齐全的证书验证引擎。日期验证不是唯一需要验证的唯一其他检查，还有许多其他检查可以按照 RFC5280§6。使用框架提供的API来验证证书并依靠其结果。
technically, yes. However most CA implementations restrict issued certificates validity to intersect the CA certificate lifetime.
as a good practice, you should validate all certificates in the chain. However, I would recommend to NOT write your own validation. Most frameworks provide fully-featured certificate validation engines. Date validation is not the only thing that requires validation, there are many other checks to perform as specified in RFC 5280 §6. Use framework-provided APIs to validate the certificate and rely on their results.