我试图了解 SSL 连接上下文中客户端和服务器之间的关系。我的理解是否正确,即同一证书颁发机构(我 - 在下面的示例中)签署服务器和客户端证书使得它们可以进行通信。因此,服务器仅在客户端使用由与服务器证书相同的 CA 签名的客户端证书进行身份验证时才接受通信,这对于 SSL 连接的思想至关重要?
(下面的脚本直接来自http://blog.nategood.com/client-side-certificate-authentication-in-ngi)
# Create the CA Key and Certificate for signing Client Certs
openssl genrsa -des3 -out ca.key 4096
openssl req -new -x509 -days 365 -key ca.key -out ca.crt
# Create the Server Key, CSR, and Certificate
openssl genrsa -des3 -out server.key 1024
openssl req -new -key server.key -out server.csr
# We're self signing our own server cert here. This is a no-no in production.
openssl x509 -req -days 365 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server.crt
# Create the Client Key and CSR
openssl genrsa -des3 -out client.key 1024
openssl req -new -key client.key -out client.csr
# Sign the client certificate with our CA cert. Unlike signing our own server cert, this is what we want to do.
openssl x509 -req -days 365 -in client.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out client.crt
server {
listen 443;
ssl on;
server_name example.com;
ssl_certificate /etc/nginx/certs/server.crt;
ssl_certificate_key /etc/nginx/certs/server.key;
ssl_client_certificate /etc/nginx/certs/ca.crt;
ssl_verify_client on;
最佳答案
简短的回答是否定的。这是两个不同的方面。 这里:
ssl_certificate /etc/nginx/certs/server.crt;
ssl_certificate_key /etc/nginx/certs/server.key;
您正在配置客户端需要信任的服务器证书。
这里:
ssl_client_certificate /etc/nginx/certs/ca.crt;
您配置证书颁发机构来验证客户的证书。
关于ssl - 服务器和客户端证书必须由 SSL 中的同一 CA 签名,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/53267866/