带有自签名证书的TLS [英] TLS with selfsigned certificate

问题描述

我正在尝试使用自签名服务器证书来建立TLS连接.

I'm trying to establish a TLS connection with the use of a self signed server certificate.

我使用以下示例代码生成了证书: http://golang.org /src/pkg/crypto/tls/generate_cert.go

I generated the certificate with this example code: http://golang.org/src/pkg/crypto/tls/generate_cert.go

我相关的客户代码如下:

My relevant client code looks like that:

// server cert is self signed -> server_cert == ca_cert
CA_Pool := x509.NewCertPool()
severCert, err := ioutil.ReadFile("./cert.pem")
if err != nil {
    log.Fatal("Could not load server certificate!")
}
CA_Pool.AppendCertsFromPEM(severCert)

config := tls.Config{RootCAs: CA_Pool}

conn, err := tls.Dial("tcp", "127.0.0.1:8000", &config)
if err != nil {
    log.Fatalf("client: dial: %s", err)
}

以及类似的相关服务器代码:

And the relevant server code like that:

cert, err := tls.LoadX509KeyPair("./cert.pem", "./key.pem")
config := tls.Config{Certificates: []tls.Certificate{cert}}
listener, err := tls.Listen("tcp", "127.0.0.1:8000", &config)

for {
    conn, err := listener.Accept()
    if err != nil {
        log.Printf("server: accept: %s", err)
        break
    }
    log.Printf("server: accepted from %s", conn.RemoteAddr())
    go handleConnection(conn)
}

因为服务器证书是自签名的，所以对服务器和客户端CA_Pool使用相同的证书，但这似乎不起作用，因为我总是会收到此错误:

Because the server certificate is self signed is use the same certificate for the server and the clients CA_Pool however this does not seem to work since i always get this error:

client: dial: x509: certificate signed by unknown authority 
(possibly because of "x509: invalid signature: parent certificate
cannot sign this kind of certificate" while trying to verify 
candidate authority certificate "serial:0")

我怎么了?

推荐答案

它最终与内置在x509中的go一起使用.CreateCertificate， 问题是我没有设置IsCA:true标志， 我只设置了x509.KeyUsageCertSign ，它可以创建自签名证书，但是在验证证书链时崩溃了.

It finally worked with the go built in x509.CreateCertificate, the problem was that I did not set the IsCA:true flag, I only set the x509.KeyUsageCertSign which made creating the self signed certificate work, but crashed while verifying the cert chain.

这篇关于带有自签名证书的TLS的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！