使用QT爲SSL創建自定義根證書存儲的問題？

Question

我正在使用QWebView和 在Qt中開發我的自定義瀏覽器我試圖從mozilla項目中取得我自己的可信證書的根證書存儲區。

我已經使用QSslSocket :: setDefaultCaCertificates（）來覆蓋默認證書。 但我無法加載https://www.gmail.com，其中在Mozilla中的作品。

我已將所有必需的gmail根證書設置到我的商店。

任何人都可以指導我嗎？

Answer 1

您無法連接的原因是因爲連接到www.gmail.com時向您展示的SSL證書是針對其他域 - www.google.com發佈的。這與根CA證書存儲無關，因爲不需要根CA證書來將證書的Subject CN字段與嘗試連接的主機進行比較。你可以通過調用
void QNetworkReply::ignoreSslErrors() [virtual slot]
忽略了這一點，其他SSL錯誤爲了避免這種錯誤，您可以直接連接到https://mail.google.com這是當你嘗試連接到https://www.gmail.com

下面你將被重定向域是一個工作示例它會向您顯示確切的SSL錯誤和QNAM級別錯誤。線B1或線B2必須同時處於活動狀態。如果您想查看默認（系統）根CA證書存儲會發生什麼情況，您可以評論第A行。這個代碼使用了兩個證書; CA的序列號爲30:00:00:02的證書應放置在名爲ThawteSGCCA.crt的文件中，CA的證書的序列號爲70:BA:E4:1D:10:D9:29:34:B6:38:CA:7B:03:CC:BA:BF應放在名爲BuiltinObjectToken-VerisignClass3PublicPrimaryCertificationAuthority.crt的文件中。

#include <QtGui/QApplication> 
#include <QtCore/QDebug> 
#include <QtCore/QList> 
#include <QtNetwork/QNetworkAccessManager> 
#include <QtNetwork/QNetworkRequest> 
#include <QtNetwork/QNetworkReply> 
#include <QtNetwork/QSslConfiguration> 
#include <QtNetwork/QSslSocket> 
#include <QtNetwork/QSslError> 
#include <QtWebKit/QWebFrame> 
#include <QtWebKit/QWebPage> 



class Handler : public QObject{ 
    Q_OBJECT 

public slots: 

    void slotLoadFinished(bool ok) { 
     if (ok) { 
      qDebug() << "Page size: " << static_cast<QWebPage*>(sender())->mainFrame()->toHtml().size(); 
     } 
    } 

    void slotFinished(QNetworkReply * reply) { 
     if (reply->error() == QNetworkReply::NoError) { 
      qDebug() << "connected to " << reply->url(); 
      qDebug() << "HTTP status: " << reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt(); 

     } else { 
      qDebug() << "error while connecting to " << reply->url(); 
      qDebug() << "error code: " << reply->error(); 
      qDebug() << "error string: " << reply->errorString(); 
     } 
    } 

    void slotSslErrors(QNetworkReply * reply, QList<QSslError> const & errors) { 
     qDebug() << "SSL errors: " << errors; 
     qDebug() << "peer's certificate: " 
       << reply->sslConfiguration().peerCertificate(); 
    } 

}; 


int main(int argc, char *argv[]) 
{ 
    QApplication app(argc, argv); 
    Handler handler; 

    // CA certs for: 
    // 1. cert with Subject.CN == mail.google.com cert with serial 1f:19:f6:de:35:dd:63:a1:42:91:8a:d5:2c:c0:ab:12 
    // 2. cert with Subject.CN == www.google.com cert with serial 2F:DF:BC:F6:AE:91:52:6D:0F:9A:A3:DF:40:34:3E:9A 
    QList<QSslCertificate> CAcerts = 
      // serial 30:00:00:02 
      QSslCertificate::fromPath("ThawteSGCCA.crt") + 
      // serial 70:BA:E4:1D:10:D9:29:34:B6:38:CA:7B:03:CC:BA:BF 
      QSslCertificate::fromPath("BuiltinObjectToken-VerisignClass3PublicPrimaryCertificationAuthority.crt"); 

    qDebug() << "root CA certificates:\n" 
      << CAcerts 
      << "\n"; 
    QSslSocket::setDefaultCaCertificates(CAcerts); // line A 

    QWebPage page; 
    // OK because cert with serial 1f:19:f6:de:35:dd:63:a1:42:91:8a:d5:2c:c0:ab:12 is for host mail.google.com 
// page.mainFrame()->load(QUrl("https://mail.google.com")); // line B1 
    // SSL ERROR "The host name did not match any of the valid hosts for this certificate" 
    // because cert with serial 1f:19:f6:de:35:dd:63:a1:42:91:8a:d5:2c:c0:ab:12 is NOT for www.gmail.com 
    page.mainFrame()->load(QUrl("https://www.gmail.com")); // line B2 

    QObject::connect(page.networkAccessManager(), SIGNAL(finished(QNetworkReply*)), &handler, SLOT(slotFinished(QNetworkReply*))); 
    QObject::connect(page.networkAccessManager(), SIGNAL(sslErrors(QNetworkReply*,QList<QSslError>)), &handler, SLOT(slotSslErrors(QNetworkReply*,QList<QSslError>))); 
    QObject::connect(&page, SIGNAL(loadFinished(bool)), &handler, SLOT(slotLoadFinished(bool))); 

    return app.exec(); 
} 

#include "main.moc"