2015-10-06 37 views
0

我正在嘗試執行TBSCertificate的指紋以簽名並將其插入到x509證書中。我找不到任何工具或庫讓我可以單獨執行。如何計算並在X509證書中插入簽名

我可以創建一個x509證書,並像openssl或許多庫一樣執行簽名,但它將直接包含在證書中,我需要在包含它之前修改簽名。

你認識誰嗎?

+0

刪除了「編輯」部分 - 更改由SO – potame

+0

跟蹤操作系統?編程語言?你提供的信息是不夠的。 – Crypt32

+0

我正在研究Linux(Arch更具體)並使用python,但如果我可以設法使用python,但使用另一個不會成爲問題。順便說一句,我試圖用pyasn1來做我所問的,但最終的結果並不是預期的結果。 (如果你願意,我可以提供python代碼) –

回答

0

我終於設法使用Python的pyasn1庫。

萬一有人需要它的未來,在這裏你必須在pyasn1郵件的對話談論它:

https://sourceforge.net/p/pyasn1/mailman/message/34523982/

和我個人的解決方案:

from M2Crypto import X509, EC, EVP 
from hashlib import sha256 
from pyasn1_modules.rfc2314 import Signature 
from pyasn1_modules.rfc2459 import Certificate 
from pyasn1.codec.der import encoder, decoder 

csr = "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNyakNDQVpZQ0FRQXdEUVlKS29aSWh2Y05BUUVMQlFBd2dZWXhDekFKQmdOVkJBWVRBa05VTVJJd0VBWUQKVlFRSURBbENZWEpqWld4dmJtRXhFekFSQmdOVkJBY01Da0psYkd4aGRHVnljbUV4RVRBUEJnTlZCQW9NQ0ZCaAplVk5sYm5ObE1Rd3dDZ1lEVlFRTERBTkJRMEV4RERBS0JnTlZCQU1NQTBGRFFURWZNQjBHQ1NxR1NJYjNEUUVKCkFSWVFZV05oUUdSbGFXTXVkV0ZpTG1OaGREQWVGdzB4TlRFd01EZ3dPVFF4TURKYUZ3MHhOakV3TURjd09UUXgKTURKYU1JR0FNUXN3Q1FZRFZRUUdFd0pEVkRFU01CQUdBMVVFQ0F3SlFtRnlZMlZzYjI1aE1STXdFUVlEVlFRSApEQXBDWld4c1lYUmxjbkpoTVF3d0NnWURWUVFLREFOVlFVSXhEVEFMQmdOVkJBc01CRVJGU1VNeEt6QXBCZ05WCkJBTU1JbTF0VjFGVlFsbFpWMVJ2V2xwTmNIYzBjR0ZXVG5NeVRXNXZTbE5oUlZkUmVua3dWakFRQmdjcWhrak8KUFFJQkJnVXJnUVFBQ2dOQ0FBUjVJTWU2aDJwUlpwM201b25VcWloeGwyNkFIQjhMR01WZCtMWUNFTUl4V2U1ZQpySVJmcDA5bHNPUjB3L1B3T3N0bzRXSWFYOXFPSnBTb2JwZFlYRnJaTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCCkFRQXdHZVl3bkM5MmErR1g3VXE4N1k5Z3hXdFVKUWZiUlRwbXdCV1NPdmNlS3Z2Ky9zV3o5VFRqSGRKbElqVnYKbkQ5RHY5aHVlQUVONkE3Sm43SE80ZDhwelJ2d3pQSU5peXN4TUlzaWsxbldpTTRieTBLSDh4bE5SZEFoc3ZZTApVQ3hLSXVGMm1sUytJRGVtMUQyZE96L3ZFZlcrZVE4NVhsSVRycExpMFZlY3d5NnhwejNMN2R2SEdTOFJ1aVlyCkxkS1J3VnVGYmI4QmRHdVJ3dHgwNCtEeGJFKzlUb3hHSmFiM1VaV1loV3ByekcyS2owV0pORW44UlBwWXJjb2sKY3lBSTh4OFh0TDUrZUs5aklpV1NlcHIzcU9Zc3V6V2NqZ2VIeUdCUHNqN1lRQ2ZuWVFTbHBJMzJHRnZ5YWRmTApmRmZXSExxZE9nQmVET2JwenlaVDlyazkKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo==" 

cert = X509.load_cert_string(b64decode(csr)) 
ca_pkey = EVP.load_key(ACA_KEY) 

asn1_cert = decoder.decode(cert.as_der(), asn1Spec=Certificate())[0] 
tbs = asn1_cert.getComponentByName("tbsCertificate") 

tbs_der = encoder.encode(tbs) 

digest = sha256() 
digest.update(tbs_der) 
signature = ca_pkey.get_rsa().sign(digest.digest(), "sha256") 

# Take the raw signature and turn it into a BitString representations (special thanks to Alex <[email protected]>) 
bin_signature = Signature("'%s'H" % ''.join("%02X" % ord(c) for c in signature)) 

asn1_cert.setComponentByName("signatureValue", bin_signature) 

# Check that both certificates matches 
cert.sign(ca_pkey, md='sha256') 
print cert.as_text() 

print encoder.encode(asn1_cert) == cert.as_der() 

最初的企業社會責任是BER中的base64編碼X509證書。

重要的是強調csr已經包含適當的簽名算法。