CA系統(tǒng)原理講解_百度文庫

1、CA 注冊前端 xenroll 的方法:acceptPKCS7 接受 CA 發(fā)放的 PKCS #7證書createPKCS10 產(chǎn)生 PKCS #10 Certificate Request,同時產(chǎn)生客戶端證書私鑰 getCertFromPKCS7 獲得 PKCS7證書InstallPKCS7 安裝 PKCS7證書xenroll 的屬性:GenKeyFlags 客戶端的證書是否可以被導(dǎo)出,確省值為“ CRYPT_EXPORTABLE” KeySpec 客戶端私鑰的用途 AT_KEYEXCHANGE, A T_SIGNATURE MyStoreNameRootStoreNameCAStoreNa

2、me Certificate Request加密格式-BEGIN CERTIFICATE- MIICTDCCAbUCAQkwDQYJKoZIhvcNAQEEBQAwgYYxCzAJBgNVBAYTAkNOMRAwDgYD VQQIEwdCZWlqaW5nMRAwDgYDVQQHEwdCZWlqaW5nMQwwCgYDVQQKEwNQS1UxDjAM BgNVBAsTBUluZm9yMREwDwYDVQQDEwhHb2xkdGVjaDEiMCAGCSqGSIb3DQEJARYT c2hpaGFvXzEwMEBzaW5hLmNvbTAeFw0wMjAzMjgwNDU0MzVaFw0wMjA0Mjc

3、wNDU0 MzVaMIGZMQswCQYDVQQGEwJDTjEQMA4GA1UECBMHQmVpamluZzEQMA4GA1UEBxMH QmVpamluZzEaMBgGA1UEChMRUGVraW5nIFVuaXZlcnNpdHkxHzAdBgNVBAsTFklu Zm9ybWF0aW9uIERlcGFydG1lbnQxGjAYBgkqhkiG9w0BCQEWC3JlcmVyZXJlcmVy MQ0wCwYDVQQDEwRyZXJlMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALHnkBT6bI1y t37POTUbj48+8f2S1m7jvu83AywLYOyOUC

4、hJn8RLd/SsvMV5xGd8AZd+GXzZcdX9 i5WtDV7bt08CAwEAATANBgkqhkiG9w0BAQQFAAOBgQBSgDW+C9muasoE+jUXnnIsjUQSy+gce9MIhgtGDQessVxULaof7i3hIlRIVseHcneH0PJHS5oSz2v4Q9oD4DMAwCzdiFSDc+Lu50v6418D8tUzIsuiGEzWxN2rACcfr2OywDiu2Yy4brpGC6WireuoiR9C6/EWRO3NoLFGxzDYvA=-END CERTIFICATE-每行 64字Certificate 加密格式-BEGIN CERTIFIC

5、ATE REQUEST- MIICnjCCAkgCAQAwgZkxCzAJBgNVBAYTAkNOMRAwDgYDVQQIEwdCZWlqaW5nMRAwDgYDVQQH EwdCZWlqaW5nMRowGAYDVQQKExFQZWtpbmcgVW5pdmVyc2l0eTEfMB0GA1UECxMWSW5mb3Jt YXRpb24gRGVwYXJ0bWVudDEaMBgGCSqGSIb3DQEJARYLcmVyZXJlcmVyZXIxDTALBgNVBAMT BHJlcmUwXDANBgkqhkiG9w0BAQEFAANLADBIAkEAseeQFPpsjXK3fs85NRuPjz7x/ZLW

6、buO+ 7zcDLAtg7I5QKEmfxEt39Ky8xXnEZ3wBl34ZfNlx1f2Lla0NXtu3TwIDAQABoIIBRzAaBgor BgEEAYI3DQIDMQwWCjUuMC4yMTk1LjIwNQYKKwYBBAGCNwIBDjEnMCUwDgYDVR0PAQH/BAQD AgbAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMIHxBgorBgEEAYI3DQICMYHiMIHfAgECHk4ATQBp AGMAcgBvAHMAbwBmAHQAIABTAHQAcgBvAG4AZwAgAEMAcgB5AHAAdABvAGcAcgBhAHAAaABp AGM

7、AIABQAHIAbwB2AGkAZABlAHIDgYkAjuYPzZPpbLgCWYnXoNeX2gS6nuI4osrWHlQQKcS6 7VJclhELlnT3hBb9Blr7I0BsJ/lguZvZFTZnC1bMeNULRg17bhExTg+nUovzPcJhMvG7G3DR17PrJ7V+egHAsQV4dQC2hOGGhOnv88JhP9Pwpso3t2tqJROa5ZNRRSJSkw8AAAAAAAAAADAN BgkqhkiG9w0BAQUFAANBABCrCSOvajLRDgAtFMO3Y1lHRkNrubCCm1UmgeJcFswg10ZxGW/C WUPlR5C4GXre

8、gncyT9YIgn/ANhkj77x4Sbc=-END CERTIFICATE REQUEST-每行 72字證書請求的文本格式Certificate Request:Data:Version: 0 (0x0Subject: C=CN, ST=Beijing, L=Beijing, O=Peking University, OU=Information Department/Email=rererererer, CN=rereSubject Public Key Info:Public Key Algorithm: rsaEncryptionRSA Public Key: (512 bitMo

9、dulus (512 bit:00:b1:e7:90:14:fa:6c:8d:72:b7:7e:cf:39:35:1b:8f:8f:3e:f1:fd:92:d6:6e:e3:be:ef:37:03:2c:0b:60:ec:8e:50:28:49:9f:c4:4b:77:f4:ac:bc:c5:79:c4:67:7c:01:97:7e:19:7c:d9:71:d5:fd:8b:95:ad:0d:5e:db:b7:4fExponent: 65537 (0x10001Attributes:Requested Extensions:X509v3 Key Usage: criticalDigital S

10、ignature, Non RepudiationX509v3 Extended Key Usage:TLS Web Client AuthenticationSignature Algorithm: sha1WithRSAEncryption10:ab:09:23:af:6a:32:d1:0e:00:2d:14:c3:b7:63:59:47:46:43:6b:b9:b0:82:9b:55:26:81:e2:5c:16:cc:20:d7:46:71:19:6f:c2:59:43:e5:47:90:b8:19:7a:de:82:77:32:4f:d6:08:82:7f:c0:36:19:23:e

11、f:bc:78:49:b7證書的文本格式Certificate:Data:Version: 1 (0x0Serial Number: 7 (0x7Signature Algorithm: md5WithRSAEncryptionValidityNot Before: Mar 28 04:53:00 2002 GMTNot After : Apr 27 04:53:00 2002 GMTSubject: C=CN, ST=Beijing, L=Beijing, O=Peking University, OU=Information Department/Email=rererererer, CN

12、=rereSubject Public Key Info:Public Key Algorithm: rsaEncryptionRSA Public Key: (512 bitModulus (512 bit:00:b1:e7:90:14:fa:6c:8d:72:b7:7e:cf:39:35:1b:8f:8f:3e:f1:fd:92:d6:6e:e3:be:ef:37:03:2c:0b:60:ec:8e:50:28:49:9f:c4:4b:77:f4:ac:bc:c5:79:c4:67:7c:01:97:7e:19:7c:d9:71:d5:fd:8b:95:ad:0d:5e:db:b7:4fE

13、xponent: 65537 (0x10001Signature Algorithm: md5WithRSAEncryption10:cf:e4:ad:3c:f5:cf:ee:05:ba:94:58:ec:f1:23:24:d9:89:8a:9a:01:59:41:e6:e0:d6:87:6a:62:7f:92:8c:45:21:88:dc:fd:b2:1d:14:c5:65:e9:50:8f:f3:cc:39:44:fb:ea:04:20:76:3b:ab:14:ec:6e:68:3f:8c:34:32:61:09:f8:6a:68:17:c8:f5:54:24:e6:da:90:dd:f7:f5:74:61:80:bf:96:b3:89:47:6a:29:81:ae:db:e9:f1:35:58:5d:d4:d1:ee:1d:ea:06:2d:44:e3:1e:3c:a2:8c:d9