Question

我使用以下代码与自己的CA签署CSR：

<?php
require_once("vendor/autoload.php");

$privKey = new \phpseclib\Crypt\RSA();
$privKey->setHash('sha512');
$keypair = $privKey->createKey(4096);
$privKey->loadKey($keypair['privatekey']);
$pubKey = new \phpseclib\Crypt\RSA();
$pubKey->loadKey($keypair['publickey']);
$pubKey->setPublicKey();

$subject = new \phpseclib\File\X509();
$subject->setPrivateKey($privKey);
$subject->setPublicKey($pubKey);
$subject->setDNProp("id-at-organizationName", "??");
$subject->setDNProp("id-at-organizationalUnitName", "?");
$subject->setDNProp("id-at-commonName", "127.0.0.1");
$subject->setDNProp("id-at-localityName", "?");
$subject->setDNProp("id-at-stateOrProvinceName", "?");
$subject->setDNProp("id-at-countryName", "??");
$subject->setDNProp("emailAddress", "?");
$subject->loadCSR($subject->saveCSR($subject->signCSR('sha512WithRSAEncryption')));
$subject->setExtension('id-ce-basicConstraints', array('cA'=>FALSE));
$subject->setExtension('netscape-cert-type', ['SSLServer']);
$subject->setExtension('id-ce-keyUsage', ['digitalSignature', 'keyEncipherment'], TRUE);
$subject->setExtension('id-ce-extKeyUsage', ['id-kp-serverAuth', 'id-kp-OCSPSigning'], TRUE);
$strCSR = $subject->saveCSR($subject->signCSR('sha512WithRSAEncryption'));
file_put_contents("a.csr", $strCSR);

$cakey = new \phpseclib\Crypt\RSA();
$cakey->setPassword(file_get_contents("private/passphrase.txt"));
$cakey->loadKey(file_get_contents("private/cakey.pem"));
$ca = new \phpseclib\File\X509();
$ca->loadX509(file_get_contents("cacert.pem"));
$ca->setPrivateKey($cakey);
$x509 = new \phpseclib\File\X509();
$x509->makeCA();
@$x509->setEndDate(new \DateTime("2018-08-08 08:08:08", new \DateTimeZone(@date_default_timezone_get())));
$x509->setSerialNumber(999, 10);
$sign_result = $x509->sign($ca, $subject, $subject->currentCert['signatureAlgorithm']['algorithm']);
$cert = $x509->saveX509($sign_result);
file_put_contents("a.crt", $cert);

但是，签名证书似乎有这样的问题：https://i.stack.imgur.com/F4p5I.png

有人可以告诉我我在做什么错吗？

我的环境信息：

PHP 7.2.0
phpseclib 2.0
Windows 7

编辑： 我用openssl来验证它，看起来好像丢失了一些东西第二个“签名算法” ...

Certificate:
    Data:
        ***********
    Signature Algorithm: sha512WithRSAEncryption
        ***************
        X509v3 extensions:
            ***********
    Signature Algorithm: sha512WithRSAEncryption
        **(something is missing here, there's nothing after this point)**

编辑：我的openssl.cnf

default_bits            = 4096
default_md              = sha512
dir         = "."
[ca]
default_ca      = CA_default
[CA_default]
serial          = $dir/serial.txt
database        = $dir/index.txt
new_certs_dir       = $dir/newcerts
certificate     = $dir/cacert.pem
private_key     = $dir/private/cakey.pem
default_days        = 3650
preserve        = no
email_in_dn     = no
nameopt         = default_ca
certopt         = default_ca
policy          = policy_match
default_crl_days = 365
[policy_match]
countryName     = optional
stateOrProvinceName = optional
organizationName    = optional
organizationalUnitName  = optional
commonName      = supplied
emailAddress        = supplied
[req]
string_mask     = nombstr
distinguished_name  = req_distinguished_name
req_extensions      = v3_req
[req_distinguished_name]
............
[v3_ca]
basicConstraints    = CA:TRUE
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid:always,issuer:always
keyUsage                = critical, cRLSign, digitalSignature, keyCertSign
[v3_req]
........

Answer 1

问题是您的CA证书尚未安装。这不是phpseclib问题，也不是编程问题。确实，这个问题最好放在superuser.com上。

也就是说，我能够重现您的问题。

这就是我点击生成的证书后得到的结果。

未安装CA证书：

我执行了以下步骤：

单击“安装证书...”以获取CA证书
点击“下一步”
选择“将所有证书放入以下存储区”
点击“浏览...”
选择“受信任的根证书颁发机构”
点击“确定”
点击“下一步”
点击“完成”
点击“是”
点击“确定”

在这之后我得到的是：

phpseclib生成的证书完整性无法保证/损坏

1 个答案: