没有证书授权的MTL
我正在尝试实施场景要求客户端识别自身（双向TLS），该 https://github.com/hakky54/mutual-tls-tls-ssl#require-th-ch-require-the-clerient-the-clreient-the-client-the-client-client-to-client-to-to--client-to-to--client-to--client-to-to--to--client-to-to--to--client-to--to--to-识别自己的两条路。
使用
现在，我想通过curl而不是Java Rest客户端来向API服务器进行请求。
我发现，也许是 https://stackoverflow.com/a/58920225/1743843 带有命令：命令
curl --key client.key --cert client.crt --cacert bundle.pem -X GET -v https://x.x.x.x:xxxx/folder/endpoint
：选项- CACERT需要传递。但是，我想做要求客户识别自己（双向TLS）不是基于信任证书授权的两种方式。 问题是，我是否可以通过选项- CERT服务器证书而不是CA证书或其他选项。
我想在没有自签名证书的情况下做。
I am trying to implement the scenario Require the client to identify itself (two-way TLS) that is described on https://github.com/Hakky54/mutual-tls-ssl#require-the-client-to-identify-itself-two-way-tls.
The API server is created with https://quarkus.io/ along with a keystore and a truststore. The keystore contains the certificate plus the private key and the truststore contains the client certificate for the client identification.
Now, I would like to do the request to the API server via curl instead java rest client.
I have found, maybe the solution on https://stackoverflow.com/a/58920225/1743843 with the command:
curl --key client.key --cert client.crt --cacert bundle.pem -X GET -v https://x.x.x.x:xxxx/folder/endpoint
the option --cacert need to be passed. However, I would like to do Require the client to identify itself (two-way TLS) not Two way TLS based on trusting the Certificate Authority.
The question is, can I pass anyway on the option --cert the server certificate instead CA certificate or there is another option.
I would like to do without self signed certificate.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
是的，您可以传递
- CERT选项，但是您需要提供基本64编码的私有键对文件。在该教程中，密钥库文件被用作jks，您首先需要将其转换为curl所理解的内容，在这种情况下为PEM文件。您需要做的是：将密钥库转换为p12文件
将p12文件转换为PEM文件
运行curl命令使用PEM文件，
这些步骤也可以在此处找到：< a href =“ https://gist.github.com/hakky54/049299f0874fd4b8702570257c6458e0dcbd” rel =“ nofollow noreferrer”
Yes, you can pass the
--certoption, however you need to provide Base64 encoded privatekey pair file. In that tutorial keystore files are used asjkswhich you first need to convert to something what curl will understand and in this case a pem file. What you need to do is:Convert keystore to p12 file
Convert p12 file to pem file
Run curl command with pem files
These steps can also be found here: GitHub Gist - Curl with Java KeyStore