驗證證書冗餘中間體

Question

我有一位客戶希望對他們的證書進行非常嚴格的驗證。

我建議他們使用「openssl verify」，但看起來這不像「s_client」那麼嚴格。例如： 可以說我有一箇中間體鏈A，B，C（其中A是網站，C指向根，B是中間鏈），但接下來是一些根本不連接的中間體滲透證書。可以稱之爲X - 並且證書現在包含A，B，X，C。

s_client在此驗證不會失敗。 我也檢查了一些在線服務 - 大多數不會失敗。例如digicert將失敗 - 說明鏈條已損壞。

我試圖尋找一個openssl驗證標誌，我甚至試圖運行s_server，然後驗證與s_client無濟於事。

有沒有辦法對此進行驗證？

Answer 1

使用gnutls包中的'certtool'而不是openssl。

良好鏈：

$ cat A B C | certtool -e 
Certificate[0]: <subject for A> 
    Issued by: <subject for B> 
    Verifying against certificate[1]. 
    Verification output: Verified. 

Certificate[1]: <subject for B> 
    Issued by: <subject for C> 
    Verifying against certificate[2]. 
    Verification output: Verified. 

Certificate[2]: <subject for C> 
    Issued by: <subject for C> 
    Verification output: Verified. 

Chain verification output: Verified. 

壞鏈：

$ cat A B X C | certtool -e 
Certificate[0]: <subject for A> 
    Issued by: <subject for B> 
    Verifying against certificate[1]. 
    Verification output: Verified. 

Certificate[1]: <subject for B> 
    Issued by: <subject for C> 
    Verifying against certificate[2]. 
Error: Issuer's name: <subject for X> 
certtool: issuer name does not match the next certificate