我正在尝试使用OpenSSL验证证书文件。您能解释一下为什么s_client
连接成功,但是verify
具有相同证书链的文件失败吗?如何验证文件?
注意我自己编译了OpenSSL 1.0.1k,它不应该使用任何特定于发行版的配置。我CAfile
为两个命令都提供了相同的内容。
$ openssl s_client -CAfile /etc/pki/tls/certs/ca-bundle.crt -connect www.google.com:443
WARNING: can't open config file: /usr/local/ssl/openssl.cnf
CONNECTED(00000003)
depth=3 C = US, O = Equifax, OU = Equifax Secure Certificate Authority
verify return:1
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify return:1
depth=1 C = US, O = Google Inc, CN = Google Internet Authority G2
verify return:1
depth=0 C = US, ST = California, L = Mountain View, O = Google Inc, CN = www.google.com
verify return:1
---
Certificate chain
0 s:/C=US/ST=California/L=Mountain View/O=Google Inc/CN=www.google.com
i:/C=US/O=Google Inc/CN=Google Internet Authority G2
1 s:/C=US/O=Google Inc/CN=Google Internet Authority G2
i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
---
...
Verify return code: 0 (ok)
---
如果使用-showcerts
参数运行它,它将输出从服务器发送的所有三个证书。我将它们串联成文件google.pem
。但是该链条无法验证。看:
$ openssl verify -CAfile /etc/pki/tls/certs/ca-bundle.crt google.pem
WARNING: can't open config file: /usr/local/ssl/openssl.cnf
google.pem: C = US, ST = California, L = Mountain View, O = Google Inc, CN = www.google.com
error 20 at 0 depth lookup:unable to get local issuer certificate
应用https://stackoverflow.com/a/27606964/1823988建议的修补程序无济于事。
我找到了。openssl verify
不希望证书文件包含其链。链需要与-untrusted
参数一起传递。它可用于同一文件,但仍然可以通过在中找到受信任的根来确定信任-CAfile
。
openssl verify -CAfile /etc/pki/tls/certs/ca-bundle.crt -untrusted google.pem google.pem
本文收集自互联网,转载请注明来源。
如有侵权,请联系[email protected] 删除。
我来说两句