Question

重要提示：以下问题验证证书的方法不正确，会导致误报和误报。请参阅我的答案，了解正确的方法。

我正在测试我编写的工具来测试我们环境中的所有证书，而且我遇到了一个OpenSSL似乎无法识别特定GoDaddy的问题根证书。

错误文字：

$ openssl verify -CAfile bundle.txt cert.txt
cert.txt: C = US, ST = Arizona, L = Scottsdale, O = "GoDaddy.com, Inc.", CN = Go Daddy Root Certificate Authority - G2
error 2 at 2 depth lookup:unable to get issuer certificate

但该证书绝对是/etc/pki/tls/certs/ca-bundle.crt和ca-bundle.trusted.crt。我已手动验证x509v3扩展程序中的颁发者和主题密钥是否与受信任的捆绑包中的KeyID D2:C4:B0:D2:91:D4:4C:11:71:B3:61:CB:3D:A1:FE:DD:A8:6A:D4:E3匹配。

我错过了什么吗？

证书详情：

Certificate:
    Issuer:  C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., OU=http://certs.godaddy.com/repository/, CN=Go Daddy Secure Certificate Authority - G2
    X509v3 Subject Key Identifier:
        28:3C:0E:1A:82:3E:7F:22:A6:DD:22:8C:45:78:BF:F6:40:47:4F:8A
    X509v3 Authority Key Identifier:
        keyid:40:C2:BD:27:8E:CC:34:83:30:A2:33:D7:FB:6C:B3:F0:B4:2C:80:CE

Bundle1:
    Subject: C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., OU=http://certs.godaddy.com/repository/, CN=Go Daddy Secure Certificate Authority - G2
    Issuer:  C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go Daddy Root Certificate Authority - G2
    X509v3 Subject Key Identifier:
        40:C2:BD:27:8E:CC:34:83:30:A2:33:D7:FB:6C:B3:F0:B4:2C:80:CE
    X509v3 Authority Key Identifier:
        keyid:3A:9A:85:07:10:67:28:B6:EF:F6:BD:05:41:6E:20:C1:94:DA:0F:DE

Bundle2:
    Subject: C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go Daddy Root Certificate Authority - G2
    Issuer:  C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority
    X509v3 Subject Key Identifier:
        3A:9A:85:07:10:67:28:B6:EF:F6:BD:05:41:6E:20:C1:94:DA:0F:DE
    X509v3 Authority Key Identifier:
        keyid:D2:C4:B0:D2:91:D4:4C:11:71:B3:61:CB:3D:A1:FE:DD:A8:6A:D4:E3

Trusted:
    Subject: C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority
    X509v3 Subject Key Identifier:
        D2:C4:B0:D2:91:D4:4C:11:71:B3:61:CB:3D:A1:FE:DD:A8:6A:D4:E3
    X509v3 Authority Key Identifier:
        keyid:D2:C4:B0:D2:91:D4:4C:11:71:B3:61:CB:3D:A1:FE:DD:A8:6A:D4:E3
        DirName:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority
        serial:00

修改

要添加到正在播放的WTFery，使用openssl s_client打开与相关服务器的连接会显示证书正常验证。

$ openssl s_client -servername www.foo.com -connect www.foo.com:443
Certificate chain
 0 s:/OU=Domain Control Validated/CN=*.foo.com
   i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2
 1 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2
   i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./CN=Go Daddy Root Certificate Authority - G2
 2 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./CN=Go Daddy Root Certificate Authority - G2
   i:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority
...yadda yadda yadda...
Verify return code: 0 (ok)

Answer 1

openssl verify标志的命名可能有点违反直觉，我发现的任何文档都没有解决这个问题。当x539触及时，我错误地使用了-CAfile选项，另外我错过了-untrusted选项来指定中间证书。

我发现大多数证书通过验证的原因是大多数CA已经开始在CA捆绑包中包含根证书，而-CAfile选项基本上定义了应该构成该证书的可信部分的内容。 chain，包括根证书。在这种情况下，中间包不包含我的初始不正确的验证方法失败的根。

现在我误以为-untrusted暗示了“永远不会使用这些证书！”，但更倾向于指定一系列不受信任的证书，这些证书可以回到“受信任”的根目录。 -CAfile捆绑。

因此，使用其中间证书[s]和受信任的根捆绑包验证证书的正确方式是：

openssl verify -CAfile /etc/pki/tls/certs/ca-bundle.crt -untrusted bundle.crt certificate.crt

Answer 2

如果指定-CAfile openssl只检查给定文件中的发行者，在您的情况下可能只包含中间证书。

OpenSSL验证失败，无法找到根证书

修改

2 个答案: