openssl 0.9.7a 版報告“證書籤名失敗”，但 0.9.8e 版很高興
我正在嘗試建構一個可與標準 CentOS 4 安裝作為客戶端一起使用的 openssl 證書鏈。（我知道它已經很老了，但它是我們的客戶正在使用的，所以我們需要支持它）。
第一個問題是 CentOS 4 openssl CA 包不包含所有現代證書，特別是 GoDaddy 根證書
/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority所以我四處探勘並找到了上述證書的Valicert證書並將其放入鏈中。在 CentOS 5（即 openssl 0.9.8e）上執行
openssl s_client此鏈會驗證，但在 CentOS 4（即 openssl 0.9.7a）上它不會驗證。CentOS 5 輸出：
$ openssl s_client -CAfile /etc/pki/tls/certs/ca-bundle.crt -connect svn.example.org:443 CONNECTED(00000003) depth=4 /L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//emailAddress=info@valicert.com verify return:1 depth=3 /C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority verify return:1 depth=2 /C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./CN=Go Daddy Root Certificate Authority - G2 verify return:1 depth=1 /C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2 verify return:1 depth=0 /OU=Domain Control Validated/CN=*.example.org verify return:1 --- Certificate chain 0 s:/OU=Domain Control Validated/CN=*.example.org i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2 1 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2 i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./CN=Go Daddy Root Certificate Authority - G2 2 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./CN=Go Daddy Root Certificate Authority - G2 i:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority 3 s:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority i:/L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//emailAddress=info@valicert.com --- Server certificate -----BEGIN CERTIFICATE----- [ SNIP ] -----END CERTIFICATE----- subject=/OU=Domain Control Validated/CN=*.example.org issuer=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2 --- No client certificate CA names sent --- SSL handshake has read 5697 bytes and written 319 bytes --- New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1 Cipher : DHE-RSA-AES256-SHA Session-ID: [ SNIP ] Session-ID-ctx: Master-Key: [ SNIP ] Key-Arg : None Krb5 Principal: None Start Time: 1394712184 Timeout : 300 (sec) Verify return code: 0 (ok) --- DONE在 CentOS 4 上：
$ openssl s_client -CAfile /usr/share/ssl/certs/ca-bundle.crt -connect svn.example.org:443 CONNECTED(00000003) depth=4 /L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//emailAddress=info@valicert.com verify return:1 depth=3 /C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority verify return:1 depth=2 /C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./CN=Go Daddy Root Certificate Authority - G2 verify error:num=7:certificate signature failure verify return:0 --- Certificate chain 0 s:/OU=Domain Control Validated/CN=*.example.org i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2 1 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2 i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./CN=Go Daddy Root Certificate Authority - G2 2 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./CN=Go Daddy Root Certificate Authority - G2 i:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority 3 s:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority i:/L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//emailAddress=info@valicert.com --- Server certificate -----BEGIN CERTIFICATE----- [ SNIP ] -----END CERTIFICATE----- subject=/OU=Domain Control Validated/CN=*.example.org issuer=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2 --- No client certificate CA names sent --- SSL handshake has read 5697 bytes and written 343 bytes --- New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA Server public key is 2048 bit Secure Renegotiation IS supported SSL-Session: Protocol : TLSv1 Cipher : DHE-RSA-AES256-SHA Session-ID: [ SNIP ] Session-ID-ctx: Master-Key: [ SNIP ] Key-Arg : None Krb5 Principal: None Start Time: 1394712595 Timeout : 300 (sec) Verify return code: 7 (certificate signature failure) --- DONE在這一點上有點困惑，任何想法都會受到讚賞。
假設您的鏈中的證書 #3 是https://certs.godaddy.com/anonymous/repository.pki
gdroot-g2_cross.crt上帶有 SHA1 指紋的證書84 1D 4A 9F C9 D3 B2 F0 CA 5F AB 95 52 5A B2 06 6A CF 83 22，使用 SHA256WithRSA 簽名。is 的實際根Go Daddy Root Certification Authority - G2也是如此gdroot-g2.crt47 BE AB C9 22 EA E8 0E 78 78 34 62 A7 9F 45 C2 54 FD E6 8B，而不是您辨識出的Go Daddy Secure Certificate Authority - G2那個明顯是中間的根gdig2.crt27 AC 93 69 FA F2 52 07 BB 26 27 CE FA CC BE 4E F9 C3 19 B8。我仍然在我的一個系統 0.9.7d 上使用的（一個）OpenSSL 0.9.7不支持 SHA-2。它的日期為 2004 年，基數 0.9.7 顯然是 2002 年 12 月，而 FIPS 180-2 於 2002 年 8 月發布。
我建議您檢查您的實體證書；它也可以用 SHA256 簽名。你的＃1顯然是
gdig2.crt肯定的。如果是這樣，這些將永遠無法在 0.9.7 中工作；您在那裡沒有看到錯誤，因為它已經在鏈條的上游失敗了。我不確定你能找到一個商業 CA，它會在 NIST 截止日期於 2014 年初生效後向你頒發 SHA1 簽名證書（和鏈）；如果是這樣，它可能不會保持有效很長時間，然後您將再次面臨同樣的問題。如果客戶端願意更改他們的信任庫（系統之一，而不更改程式碼）或您關心的任何客戶端應用程序使用的使用者儲存，您可以為您的伺服器創建一個帶有 SHA1 的自簽名證書使用 openssl 的密鑰並讓客戶端信任它。根據您的伺服器，如果您可以將來自蹩腳客戶端的請求分區到不同的埠或地址，您可能只能將自製的 SHA1 證書用於他們，而將商業 SHA256 證書用於其他人。