如何在浏览器上显示根数字证书？

Question

The steps

1. generate a root cert

   a. openssl genrsa -out root-key.key 1024

   b. openssl req -new -out root-req.csr -key root-key.key -keyform PEM

   c. openssl x509 -req -in root-req.csr -out root-cert.cer -signkey root-key.key -CAcreateserial

   d. openssl pkcs12 -export -clcerts -in root-cert.cer -inkey root-key.key -out root.p12

2. generate a server cert and sign using root cert

   a. openssl genrsa -out server-key.key 1024

   b. openssl req -new -out server-req.csr -key server-key.key

   c. openssl x509 -req -in server-req.csr -out server-cert.cer -signkey server-key.key -CA root-cert.cer -CAkey root-key.key -CAcreateserial -days 3650

   d. openssl pkcs12 -export -clcerts -in server-cert.cer -inkey server-key.key -out server.p12

3. server cert convert to jks

   a. keytool -importkeystore -srckeystore server.p12 -srcstoretype PKCS12 -deststoretype JKS -destkeystore server.jks

4. config the tomcat

     <Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol" maxThreads="150" SSLEnabled="true" scheme="https" secure="true" clientAuth="false" sslProtocol="TLS" keystoreFile="server.jks" keystoreType="JKS" keystorePass="123456" keyAlias="server"/> 

5. start tomcat and open the browser to browse it.

The question is browser display "unknow authority"(the server cert issue by root,but the browser doesn't display the cert chain,only display the server cert)?

The browser doesn't know the cert issuer,but some website can show the cert issuer(I don't install the root cert of the website on my computer,I'm pretty sure!!)

But the another web site can display the root cert ( https://kyfw.12306.cn/otn/ )

My cert in browser

Another website（can show cert chain ,I am pretty sure,I don't install the cert of it on my computer）

Answer 1

I can't comment on your primary issue because I don't have real server names or real URLS. However...

But the another web site can display the root cert ( https://kyfw.12306.cn/otn/ )

The kyfw.12306.cn certificate is not trusted under my version of Firefox or Safari. Firefox prompts me for a security exception.

Also, that's one malformed certificate (see below). It looks like an end-entity (server) certificate, but it has the Certificate Sign bit set. I think it can be used to mint certificates in some instances.

I would not trust the server certificate if I were you.

If the issuer, Sinorail Certification Authority , signs those on a regular basis, then you should expect other malformed end entity certificates were signed. In this case, you should explicitly not trust Sinorail Certification Authority .

The certificate has other problems, too. Like a missing Basic Constraints (probably by malicious design decision), one key usage that does not make sense ( Key Agreement is used with Diffie-Hellman parameters, not RSA based certs), and one key usage that violates best practices ( Data Encipherment is bulk encryption under the public key, which should not be performed). Non Repudiation has no meaning so its inert (I think it was CompSci guys trying to be Lawyers).

---

$ openssl s_client -connect kyfw.12306.cn:443 | \
          openssl x509 -text -noout
depth=1 C = CN, O = Sinorail Certification Authority, CN = SRCA
verify error:num=19:self signed certificate in certificate chain
verify return:0
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4051956438837501785 (0x383b70e9b6441f59)
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=CN, O=Sinorail Certification Authority, CN=SRCA
        Validity
            Not Before: May 26 01:44:36 2014 GMT
            Not After : May 25 01:44:36 2019 GMT
        Subject: C=CN, O=Sinorail Certification Authority, OU=\x94\xC1\x8D\xEF[\xA2b7g\x0DR\xA1N-_\xC3, CN=kyfw.12306.cn
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:bc:0b:19:73:f9:5f:f8:2a:45:24:f1:84:f1:57:
                    1c:e2:8b:bc:69:da:06:4f:5a:eb:95:06:2c:10:ea:
                    2c:0b:f7:c8:ad:ef:95:8d:1a:26:02:51:ab:03:5f:
                    2d:ce:f3:06:3e:3e:d6:45:be:01:0a:92:91:ea:43:
                    55:3a:b9:e9:a2:1d:2b:6d:85:44:b5:c5:30:6c:53:
                    f4:ee:5c:5e:80:1d:cf:a8:76:e3:fa:cc:21:8a:71:
                    49:c7:44:09:2c:45:bf:01:19:28:33:04:0f:d7:dc:
                    1f:42:50:a9:d8:6b:d6:00:d8:40:48:61:c7:2b:cc:
                    88:7a:69:10:23:0c:76:ef:61
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier: 
                keyid:79:5E:B6:77:B7:E2:52:83:43:ED:C7:51:88:4C:63:85:2C:00:43:58

            Netscape Cert Type: 
                SSL Client, SSL Server
            X509v3 Key Usage: 
                Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement, Certificate Sign
            X509v3 Subject Key Identifier: 
                8F:FD:26:EF:88:E1:AB:DF:77:22:D3:C2:95:D3:47:60:B2:7C:F3:83
            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, TLS Web Server Authentication
    Signature Algorithm: sha1WithRSAEncryption
         45:de:a1:39:2f:51:54:9e:43:30:31:14:8b:ea:7c:2e:63:bc:
         1b:80:a5:cc:e8:9e:7f:99:89:c8:be:e7:42:5c:bb:5e:c9:8e:
         a6:74:cc:48:e7:e0:7b:0d:1e:6e:7a:9f:c8:84:6e:63:9c:7f:
         5d:df:06:29:74:6a:3e:00:43:3f:61:19:b8:e6:bd:04:ae:7d:
         a0:7a:ff:f2:cc:d6:35:5e:fc:e4:95:00:a0:78:0b:d3:54:75:
         8e:4f:36:ce:c7:0f:37:4b:7e:44:23:8c:37:a1:08:00:da:d4:
         31:fe:4c:fd:fc:ef:d3:79:cc:5a:16:0e:07:a3:43:98:85:b0:
         08:74