我寫了一個小測試程序來創建自定義的自簽名 CA 證書#1創建由該 CA 頒發的服務器證書#2 - 根證書#1創建帶有證書#2 的服務器創建一個 RootCA 指向證書#1 的客戶端客戶端嘗試連接到服務器并收到錯誤：獲取 "https://localhost:2000": x509: certificate signed by unknown authority（可能是因為 "x509: Ed25519 驗證失敗" 同時嘗試驗證候選權威證書 "test-ca"）我知道有很多這樣的例子。我以為我跟他們很近，但我在這里。我在這里只展示最相關的結構，但程序的全文可以在這里找到： ... templateCA := &x509.Certificate{ Subject: pkix.Name{ CommonName: "test-ca", Organization: []string{"test ca"}, Country: []string{"USA"}, Province: []string{"NY"}, Locality: []string{"New York City"}, }, SerialNumber: serialNumber, NotBefore: time.Now(), NotAfter: time.Now().AddDate(0, 0, 1), BasicConstraintsValid: true, IsCA: true, SubjectKeyId: caSubjectKeyID[:], DNSNames: []string{"test-ca"}, KeyUsage: x509.KeyUsageCertSign }我錯過了什么或做錯了什么？
2 回答
紅顏莎娜
TA貢獻1842條經驗 獲得超13個贊
您可以使用私鑰解密數據并加密散列數據以創建數字簽名。
您可以使用公鑰加密數據并解密數字簽名來驗證它。
您需要在這里做的是使用一個密鑰對（公鑰/私鑰）生成 CA 證書，并使用該證書 + 相同的密鑰對為您的服務器生成一個或多個證書。
如果您想使用瀏覽器/curl 作為客戶端，則需要在根密鑰庫中添加 CA 證書。
明月笑刀無情
TA貢獻1828條經驗 獲得超4個贊
我從上面粘貼了更正的代碼片段。希望有一天，他們可以幫助某人。
...
templateCA := &x509.Certificate{
Subject: pkix.Name{
CommonName: "test-ca",
Organization: []string{"test ca"},
Country: []string{"USA"},
Province: []string{"NY"},
Locality: []string{"New York City"},
},
SerialNumber: serialNumber,
NotBefore: time.Now(),
NotAfter: time.Now().AddDate(0, 0, 1),
BasicConstraintsValid: true,
IsCA: true,
KeyUsage: x509.KeyUsageCertSign
DNSNames: []string{"test-ca"},
}
...
certBytes, _ := x509.CreateCertificate(rand.Reader, templateCA, templateCA, privKeyCA.Public(), privKeyCA)
...
templateServer := &x509.Certificate{
Subject: pkix.Name{
CommonName: "localhost",
Organization: []string{"Server"},
Country: []string{"USA"},
Province: []string{"NY"},
Locality: []string{"New York City"},
},
SerialNumber: serialNumber,
NotBefore: time.Now(),
NotAfter: time.Now().AddDate(0, 0, 1),
BasicConstraintsValid: true,
KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
DNSNames: []string{"localhost"},
}
...
certBytes, _ = x509.CreateCertificate(rand.Reader, templateServer, caCert, privKeyServer.Public(), privKeyCA)
...
var (
tlsMinVersion = uint16(tls.VersionTLS12)
tlsMaxVersion = uint16(tls.VersionTLS13)
cipherSuites = []uint16{
tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
}
curvePreferences = []tls.CurveID{
tls.X25519,
tls.CurveP256,
tls.CurveP384,
tls.CurveP521,
}
)
...
tlsServerConfig := &tls.Config{
Certificates: []tls.Certificate{*tlsSrvCert},
MinVersion: tlsMinVersion,
MaxVersion: tlsMaxVersion,
CurvePreferences: curvePreferences,
CipherSuites: cipherSuites,
PreferServerCipherSuites: true,
}
...
tlsClientConfig := &tls.Config{
ServerName: "localhost",
RootCAs: x509.NewCertPool(),
MinVersion: tlsMinVersion,
MaxVersion: tlsMaxVersion,
CurvePreferences: curvePreferences,
CipherSuites: cipherSuites,
PreferServerCipherSuites: true,
}
tlsClientConfig.RootCAs.AddCert(caCert)
- 2 回答
- 0 關注
- 145 瀏覽
添加回答
舉報
0/150
提交
取消