- android - RelativeLayout 背景可绘制重叠内容
- android - 如何链接 cpufeatures lib 以获取 native android 库?
- java - OnItemClickListener 不起作用,但 OnLongItemClickListener 在自定义 ListView 中起作用
- java - Android 文件转字符串
<分区>
我按照以下说明在 Win7 Pro 32 位上安装了 openSSL openssl-1.0.2e-i386-win32:Installing OpenSSL in Windows 8.1 .
我用这个测试了它:
C:\Programs\OpenSSL-Win32\bin>openssl version
OpenSSL 1.0.2e 3 Dec 2015
我收到一条错误消息,提示 Verify return code: 20 (unable to get local issuer certificate)
。
C:\Programs\OpenSSL-Win32\bin>openssl s_client -connect www.openssl.org:443
CONNECTED(00000180)
depth=1 C = BE, O = GlobalSign nv-sa, CN = GlobalSign Domain Validation CA - SHA256 - G2
verify error:num=20:unable to get local issuer certificate
---
Certificate chain
0 s:/OU=Domain Control Validated/CN=*.openssl.org
i:/C=BE/O=GlobalSign nv-sa/CN=GlobalSign Domain Validation CA - SHA256 - G2
1 s:/C=BE/O=GlobalSign nv-sa/CN=GlobalSign Domain Validation CA - SHA256 - G2
i:/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIE9TCCA92gAwIBAgISESHQqr5sLPE1xTXWmA7ABqljMA0GCSqGSIb3DQEBCwUA
MGAxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMTYwNAYD
VQQDEy1HbG9iYWxTaWduIERvbWFpbiBWYWxpZGF0aW9uIENBIC0gU0hBMjU2IC0g
RzIwHhcNMTQxMDA5MjAyOTAwWhcNMTcxMTEyMTcxNDA1WjA7MSEwHwYDVQQLExhE
b21haW4gQ29udHJvbCBWYWxpZGF0ZWQxFjAUBgNVBAMMDSoub3BlbnNzbC5vcmcw
ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCkfg71ZYW6VtWDbDEmAfDw
CAKVJ260FAP6gANjS8eO+0drZe6MexIA5htR/sYhG8PIsJnKBuxiQ9KwMbRwLxBU
HcuBACT3MNif1DsFWuNCMFsTDPrfJzLOgoPo+4lQ0QYARwMJhxelA0P9rcTwBACY
6QRZgfAJ5iezz69GJkmrDGZIUoAR+PFF7xR/rzFaBMH7gbok0UJRKFPxO5fyiSfc
ZvSmMV/AZcUGVmxE9HLBQ6QCTbAdGAdVlHHxFPVb9Of9Ze/KJg8VIwFl5Hw+RQCj
+OjtBPkSwNQ9r0Bwc2c7uRnRpojERHxlo7Tn8uJ+LYcCkWcaVc8+JbjF78F8E417
AgMBAAGjggHMMIIByDAOBgNVHQ8BAf8EBAMCBaAwSQYDVR0gBEIwQDA+BgZngQwB
AgEwNDAyBggrBgEFBQcCARYmaHR0cHM6Ly93d3cuZ2xvYmFsc2lnbi5jb20vcmVw
b3NpdG9yeS8wJQYDVR0RBB4wHIINKi5vcGVuc3NsLm9yZ4ILb3BlbnNzbC5vcmcw
CQYDVR0TBAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwQwYDVR0f
BDwwOjA4oDagNIYyaHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9nc2RvbWFp
bnZhbHNoYTJnMi5jcmwwgZQGCCsGAQUFBwEBBIGHMIGEMEcGCCsGAQUFBzAChjto
dHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24uY29tL2NhY2VydC9nc2RvbWFpbnZhbHNo
YTJnMnIxLmNydDA5BggrBgEFBQcwAYYtaHR0cDovL29jc3AyLmdsb2JhbHNpZ24u
Y29tL2dzZG9tYWludmFsc2hhMmcyMB0GA1UdDgQWBBQPVUooul4mMU0KrqGTBtQ6
ZtRofjAfBgNVHSMEGDAWgBTqTnzUgC3lFYGGJoyCbcCYpM+XDzANBgkqhkiG9w0B
AQsFAAOCAQEAiJDoinZmR2M9Zlap1DM9WOHgwIMot154eNPZyf27rYxv9kekdTAp
9fesfBScMzq9NCyzy8rtWxMCPyhpCXh9iibkC3Yon+sj/gZSrNNh2nfeKhuroBxi
alaGRjg1WHNKx4Wc5dGm+chJCZFWOk1NzB8JZQQcSNt3IFyDWSScEGXwiVe1VbUa
tYIohSiWzvFMEfj7YoXt6tihYqEJG42jBg7MhaUtI4rUSDC5LB20Zhv0OG5CRORj
Wg8Iz2SUXkH8F1RJo+kMbCC/DFeII/ZTrF+B7qRVvLkctlLcukylqvsE1vibozQb
0A8/RZkfkqobqnkLnYeLUSCWNx/AHm8L5w==
-----END CERTIFICATE-----
subject=/OU=Domain Control Validated/CN=*.openssl.org
issuer=/C=BE/O=GlobalSign nv-sa/CN=GlobalSign Domain Validation CA - SHA256 - G2
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 3094 bytes and written 443 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID: 2FD38B8D2C8B19A1147EF4EAE05ADCD4EEA173A4AC5DB099EC2068B8C410C447
Session-ID-ctx:
Master-Key: DC29698D8DF1353C367B59E1A5C2ECFF701F008CB0AF065E2645F549DF3C6C2181C75EEB23528B552BD7974F6607EAC4
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 300 (seconds)
TLS session ticket:
0000 - 34 17 31 4f 0b 41 66 b3-72 19 aa 32 4c ab dd 2b 4.1O.Af.r..2L..+
0010 - 75 d5 2a 39 5a 83 49 09-8b fb 9a 19 a6 8e d5 cc u.*9Z.I.........
0020 - 92 b6 99 2e e3 4e 7a 48-80 bc a9 ef 76 42 ac 80 .....NzH....vB..
0030 - df 8c e2 4c 26 7a 1c 01-0f e1 6e 58 84 77 55 0c ...L&z....nX.wU.
0040 - b3 ce 21 ed 87 04 03 79-04 99 4d 4a 72 ac db 99 ..!....y..MJr...
0050 - f6 d0 e2 06 f5 6c 27 f2-5b f2 5d 2a b7 be b8 cf .....l'.[.]*....
0060 - ec 05 18 e8 a2 ed a8 5a-8a 53 50 0f 60 dc ce 35 .......Z.SP.`..5
0070 - c8 f6 ec 49 eb 42 46 0a-b8 82 33 28 10 63 d0 9f ...I.BF...3(.c..
0080 - e3 a7 00 db 23 ed c2 1a-46 06 63 58 91 88 b6 e1 ....#...F.cX....
0090 - a2 30 93 22 31 1c b6 43-a9 a7 5e 06 bf ad 0a 99 .0."1..C..^.....
00a0 - 84 ef 63 3f f5 eb 18 bc-88 f4 04 2f d2 4a bf 2c ..c?......./.J.,
00b0 - 62 ad 3e 4f 44 84 7b 87-b0 96 9e d0 19 ed 26 5d b.>OD.{.......&]
Start Time: 1451515804
Timeout : 300 (sec)
Verify return code: 20 (unable to get local issuer certificate)
---
read:errno=0
听起来我的机器上没有证书,所以我去下载了证书: https://support.globalsign.com/customer/portal/articles/1464460-domainssl-intermediate-certificates
我选择了 SHA-256 Orders(默认)我收到一条消息说:“此证书已作为证书颁发机构安装”
所以我用这个进行了测试:
C:\Programs\OpenSSL-Win32\bin>openssl s_client -CAfile GlobalSign Domain Validation CA - SHA256 - G2
unknown option Domain
usage: s_client args
-host host - use -connect instead
-port port - use -connect instead
-connect host:port - who to connect to (default is localhost:4433)
-verify_host host - check peer certificate matches "host"
-verify_email email - check peer certificate matches "email"
-verify_ip ipaddr - check peer certificate matches "ipaddr"
-verify arg - turn on peer certificate verification
-verify_return_error - return verification errors
-cert arg - certificate file to use, PEM format assumed
-certform arg - certificate format (PEM or DER) PEM default
-key arg - Private key file to use, in cert file if
not specified but cert file is.
-keyform arg - key format (PEM or DER) PEM default
-pass arg - private key file pass phrase source
-CApath arg - PEM format directory of CA's
-CAfile arg - PEM format file of CA's
-no_alt_chains - only ever use the first certificate chain found
-reconnect - Drop and re-make the connection with the same Session-ID
-pause - sleep(1) after each read(2) and write(2) system call
-prexit - print session information even on connection failure
-showcerts - show all certificates in the chain
-debug - extra output
-msg - Show protocol messages
-nbio_test - more ssl protocol testing
-state - print the 'ssl' states
-nbio - Run with non-blocking IO
-crlf - convert LF from terminal into CRLF
-quiet - no s_client output
-ign_eof - ignore input eof (default when -quiet)
-no_ign_eof - don't ignore input eof
-psk_identity arg - PSK identity
-psk arg - PSK in hex (without 0x)
-srpuser user - SRP authentification for 'user'
-srppass arg - password for 'user'
-srp_lateuser - SRP username into second ClientHello message
-srp_moregroups - Tolerate other than the known g N values.
-srp_strength int - minimal length in bits for N (default 1024).
-ssl2 - just use SSLv2
-ssl3 - just use SSLv3
-tls1_2 - just use TLSv1.2
-tls1_1 - just use TLSv1.1
-tls1 - just use TLSv1
-dtls1 - just use DTLSv1
-fallback_scsv - send TLS_FALLBACK_SCSV
-mtu - set the link layer MTU
-no_tls1_2/-no_tls1_1/-no_tls1/-no_ssl3/-no_ssl2 - turn off that protocol
-bugs - Switch on all SSL implementation bug workarounds
-serverpref - Use server's cipher preferences (only SSLv2)
-cipher - preferred cipher to use, use the 'openssl ciphers'
command to see what is available
-starttls prot - use the STARTTLS command before starting TLS
for those protocols that support it, where
'prot' defines which one to assume. Currently,
only "smtp", "pop3", "imap", "ftp" and "xmpp"
are supported.
-engine id - Initialise and use the specified engine
-rand file;file;...
-sess_out arg - file to write SSL session to
-sess_in arg - file to read SSL session from
-servername host - Set TLS extension servername in ClientHello
-tlsextdebug - hex dump of all TLS extensions received
-status - request certificate status from server
-no_ticket - disable use of RFC4507bis session tickets
-serverinfo types - send empty ClientHello extensions (comma-separated numbers)
-curves arg - Elliptic curves to advertise (colon-separated list)
-sigalgs arg - Signature algorithms to support (colon-separated list)
-client_sigalgs arg - Signature algorithms to support for client
certificate authentication (colon-separated list)
-nextprotoneg arg - enable NPN extension, considering named protocols supported (comma-separated list)
-alpn arg - enable ALPN extension, considering named protocols supported (comma-separated list)
-legacy_renegotiation - enable use of legacy renegotiation (dangerous)
-use_srtp profiles - Offer SRTP key management with a colon-separated profile list
-keymatexport label - Export keying material using label
-keymatexportlen len - Export len bytes of keying material (default 20)
我做错了什么?
谢谢。
如果我使用open ssl命令 sudo openssl genrsa -out privkey.pem 2048 要生成rsa key ,它仅生成1个文件。这是私钥。我如何获得公钥。 最佳答案 回答
三个不同版本的 openssl 正在同时更新 openssl.org : 0.98, 1.0.0, 1.0.1?它们之间有什么区别,我该如何选择要使用的版本? 最佳答案 https://en.wiki
我有以下命令用于 OpenSSL 生成私钥和公钥: openssl genrsa –aes-128-cbc –out priv.pem –passout pass:[privateKeyPass] 2
我正在尝试使用对应的 gcc (arm-none-eabi-5_4-2016q2) 为 cortex m3 机器交叉编译 openssl。机器应该有能力做 TCP 请求,我们希望在一天结束时做 HTT
我正在尝试使用 openssl dsa 实现,但我对以下细节感到非常困惑: 命令 openssl dsa .... 的选项“-text”:输出中的十六进制数字,我是否正确地假设这些是字节,因此它们是按
我正在尝试制作一个假 CA 并用它签署一个证书以与 stunnel 一起使用(这似乎只是调用 OpenSSL 例程,因此您可能不需要了解该程序来提供帮助:)。然而,stunnel 一直拒绝我的证书,说
不幸的是,Perl 在尝试安装 OpenSSL 的手册页(例如 OpenSSL_1_0_1g)时不知何故遇到了错误。因为我不需要它们 - 我只想使用 OpenSSL 作为 C 库,我想我可以通过完全跳
OpenSSL 中的 BIO 对到底是什么?它的用途是什么?我已经检查过 OpenSSL 文档,但任何细节都很少。 最佳答案 OpenSSL 中的 BIO 类似于文件句柄。您可以使用一对它们来安全地相
openssl ca 和 openssl x509 命令有什么区别?我正在使用它来创建和签署我的 root-ca、intermed-ca 和客户端证书,但是 openssl ca 命令不会在证书上注册
如何(如果有的话)为 OpenSSL 定义一个单一的可信证书文件在 Windows(Win-7,OpenSSL 1.0.1c)上使用 SSL_CERT_FILE 环境变量? 各种研究促使我下载了 Mo
我有一个自签名证书,其中显示了列出的基本约束,但从中生成的签名请求不显示这些属性,例如 [v3_req]。我怎样才能让它可见?我正在使用 openssl 生成证书。 场景: 我使用以下方法创建自签名证
这个问题在这里已经有了答案: Check if a connection is TLSv1 vs SSLv3 (SSL_CIPHER_description/SSL_CIPHER_get_name)
是否有更简单的方法来确定在构建 openssl 期间指定的选项,例如当时是否定义了 OPENSSL_NO_SRTP? 我只能从以下方面获得有限的信息: openssl 版本 -a 命令。但是,如果我只
我们正在与 AWS Nitro 合作,仅提供 3 小时的证书。 我们正在寻找一种可以跳过验证中的过期部分并仍然确认证书链有效的方法。 最佳答案 根据 openssl-verify 文档
嗨,我如何在 Easyphp 中启用 openssl,因为我收到错误消息无法发送。Mailer 错误:缺少扩展:opensslTime:使用 phpmailer 时。谢谢 最佳答案 在您的 php.i
我正在尝试以编程方式读取 OpenSSL 警报消息,但无法找到执行此操作的方法。 OpenSSL API 提供如下功能: const char *SSL_alert_type_string(int v
我跑了openssl speed在我的 Ubuntu 计算机上。一些结果: Doing md4 for 3s on 16 size blocks: 9063888 md4's in 3.00s Doi
我编译了带有cryptodev支持(即硬件加速)的OpenSSL,但不幸的是默认引擎仍然是软件。 time openssl speed -evp aes-128-cbc -engine cryptod
我需要从 RedHat Linux 服务器连接到 Microsoft Dynamics CRM 服务器。地址是xxx.api.crm4.dynamics.com。服务器接受 TLSv1 但不接受 1.
关闭。这个问题不满足Stack Overflow guidelines .它目前不接受答案。 想改善这个问题吗?更新问题,使其成为 on-topic对于堆栈溢出。 上个月关闭。 Improve thi
我是一名优秀的程序员,十分优秀!