ssl - 使用 AAACertificateServices 证书的域示例

Question

如何找到根证书为 AAACertificateServices 的域?请注意，这是 Comodo 证书。
为 dependent server whose certificate will change soon 做准备，看来我的客户确实有这个证书。但是，我想通过向已经使用 AAACertificateServices 的域发送请求来验证我的客户端现在是否可以工作。

Answer 1

你可以在 crt.sh 上四处寻找一些。 ，虽然它确实需要一些挖掘。
https://crt.sh/?Identity=%25&iCAID=840&exclude=expired将为您提供由您的问题中提到的证书颁发的未过期证书的列表。通过点击、搜索并向下走几个兔子洞，您将能够找到它，例如，kicassl.com目前正在出示这样的证书。openssl s_client -showcerts -connect www.kicassl:443 的示例(删节)输出:

Certificate chain
 0 s:serialNumber = 1108141568, jurisdictionC = KR, businessCategory = Private Organization, C = KR, ST = Gyeonggi-Do, L = Seongnam-si, street = "242, Pangyo-ro, Bundang-gu", O = Korea Information Certificate Authority Inc., OU = "Hosted by Korea Information Certificate Authority, Inc.", OU = COMODO EV SSL, CN = www.kicassl.com
   i:C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Extended Validation Secure Server CA
-----BEGIN CERTIFICATE-----
MIIHyDCCBrCgAwIBAgIQVg8zhfgL...
-----END CERTIFICATE-----
 1 s:C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Extended Validation Secure Server CA
   i:C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority
-----BEGIN CERTIFICATE-----
MIIGNDCCBBygAwIBAgIQKE45wUs4...
-----END CERTIFICATE-----
 2 s:C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority
   i:C = GB, ST = Greater Manchester, L = Salford, O = Comodo CA Limited, CN = AAA Certificate Services
-----BEGIN CERTIFICATE-----
MIIFgTCCBGmgAwIBAgIQOXJEOvki...
-----END CERTIFICATE-----
 3 s:C = GB, ST = Greater Manchester, L = Salford, O = Comodo CA Limited, CN = AAA Certificate Services
   i:C = GB, ST = Greater Manchester, L = Salford, O = Comodo CA Limited, CN = AAA Certificate Services
-----BEGIN CERTIFICATE-----
MIIEMjCCAxqgAwIBAgIBATANBgk...
-----END CERTIFICATE-----

链中的最后一个证书就是您要查找的证书。