ssl - 如何验证服务器的自签名证书

Question

我正在尝试验证本地根 CA 颁发的自签名证书。我的应用程序也有相同的根 CA。我正在使用代理服务来访问服务器。代理服务的基本作用是简单地将请求重定向到服务器。下面是我尝试使用它的代码

package main

import (
    "net/http"
    "crypto/tls"
    "log"
    "crypto/x509"
    "flag"
)

const localCertFile = `-----BEGIN CERTIFICATE-----
MIIDwzCCAqugAwIBAgIJAI6nmnGw6bGbMA0GCSqGSIb3DQEBCwUAMIGgMQswCQYD
VQQGEwJVUzETMBEGA1UECAwKTmV3IEplcnNleTEWMBQGA1UEBwwNQmFza2luZyBS
aWRnZTESMBAGA1UECgwJQXZheWEgSW5jMQwwCgYDVQQLDANHQ1MxIDAeBgNVBAMM
F2Nsb3VkLXRydXN0Y2EuYXZheWEuY29tMSAwHgYJKoZIhvcNAQkBFhFzdXBwb3J0
QGF2YXlhLmNvbTAeFw0xODA1MjUxMDE2MjNaFw0yODA1MjIxMDE2MjNaMIGgMQsw
CQYDVQQGEwJVUzETMBEGA1UECAwKTmV3IEplcnNleTEWMBQGA1UEBwwNQmFza2lu
ZyBSaWRnZTESMBAGA1UECgwJQXZheWEgSW5jMQwwCgYDVQQLDANHQ1MxIDAeBgNV
BAMMF2Nsb3VkLXRydXN0Y2EuYXZheWEuY29tMSAwHgYJKoZIhvcNAQkBFhFzdXBw
b3J0QGF2YXlhLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKJp
sdLWk3S9MefVajUSaEZf4pjo58Z6t3vqvxNaJ1oDBDRuBJZzHv4Grs7SfQFnzRRH
ivZTa6vNHJCaDMds5qztf6BhpyEwwdQdtCCQgiaAIV1HuLA1dnR4iAT2jUH4Pvxt
/BDj60j2YDFfV5j6Fh20lH5sKpkVEftPZ8PClEhqJ286h+U3i96WnTR54FIu6DKU
4RQjp3Cu2an/824HjNSLy5Tgr5N3RrosOJ4cZga9663p0DuIfpkQUvf+uPPafKUO
Ct90QwFpEDrX7jYB1VIy9by4OI/UvZjijCJ4Q/5Xl+SKZLD1gs5/QXSccOSyayEk
7/941MbGqwKjZXcszC8CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAihQiDedCG3un
V0TWmo9e4gHkoMfMgeKOEtNLiIFejZjMILyiY9/bv/vemp27WR1tbKz/Mo/zcJbU
oxDyHrEszp4ZYAwK2vFRT1T2r3rIGgUf4XyPSu8fEYLnPeCdm3BFpCrC4jIsaxJ3
BJYvmFUSCLw1IjcgCrBp4lpMRKySjCPpZiisldDBKrJrulNwx7g1I1CYxLn2jkIu
b/uL0SOJPDMriS3UZ0eqByBJTZ57rkVAeW6VUbwXxIBXQX1aC2PIT2n1svywHgY2
HlK5YUaCPPL3C1MiL2Qn9ZIQwcW/eY758polgOQIo6iys9MkG7sdYlpP61V5tZud
6FqDS2taqA==
-----END CERTIFICATE-----`

func main() {
    insecure := flag.Bool("insecure-ssl", false, "Accept/Ignore all server SSL certificates")
    flag.Parse()

    rootCA, _ := x509.SystemCertPool()
    if rootCA == nil {
        rootCA = x509.NewCertPool()
    }
    /*cert, err := ioutil.ReadFile(localCertFile)

    if err != nil {
        log.Fatalf("Failed to append %q to RootCAs: %v", localCertFile, err)
    }*/

    if ok := rootCA.AppendCertsFromPEM([]byte(localCertFile)); !ok {
        log.Println("No certs appended, using system certs only")
    }

    config := &tls.Config{
        InsecureSkipVerify: *insecure,
        RootCAs: rootCA,
        //ServerName: "trust.170918167.comsubjectKeyIdentifier   = hash",
    }

    tr := &http.Transport{TLSClientConfig: config}
    client := &http.Client{Transport: tr}

    req, _ := http.NewRequest(http.MethodGet, "https://cmm-register.default.svc.cluster.local:7070/MediaManager/ws/sysconfig", nil)
    resp, err := client.Do(req)
    if err != nil {
        log.Fatal(err)
    }

    log.Println(resp)




    //Error when ServerName is diabled
            //Get https://service:7070/sysconfig: x509: certificate is valid for trust.170918167.comsubjectKeyIdentifier   = hash, not service
            //When ServerName is set
            //Get https://service:7070/sysconfig: x509: certificate signed by unknown authority (possibly
            //because of "x509: invalid signature: parent certificate cannot sign this kind of certificate" while trying to verify candidate authority certificate "cloud-trustca.test.com")
}

那么如何解决这个问题，因为我需要使用同一个 CA 验证服务器证书。当我尝试使用 openssl 验证服务器证书时，它使用相同的根 ca 得到了正确验证。

目前我使用的是 Go v1.9。

Answer 1

我发现您发布的 ca 证书存在一些问题，但如果没有从它颁发的服务器证书也很难诊断。上面的 SAN 名称需要与您的客户端正在访问的主机名相匹配，但看起来它们可能不会。

查看该证书上的标志(使用 this site 有效)，看起来 ca 证书没有设置 CA 位，因此不会成为任何子证书的有效颁发者。您需要一个启用了该扩展的根证书，然后您可以从中生成有效的证书。