堆栈内存溢出
  简体   繁体   English

CSR 是否使用私钥加密？

[英]Is the CSR encrypted withe the private key?

 原文  2020-06-13 06:38:10  1   2    ssl/ openssl/ cryptography/ ssl-certificate/ tls1.2

问题描述

Is the CSR(Certificate Signing Request) containing the public key and the organization details encrypted with the private key?包含公钥和组织详细信息的 CSR（证书签名请求）是否使用私钥加密？

-If yes, How does the certificate Authority decrypt it, as the public key in the CSR is also encrypted? - 如果是，证书颁发机构如何解密它，因为 CSR 中的公钥也被加密了？

-If no, How can the CA be sure that the CSR issuer has the private key? - 如果没有，CA 如何确定 CSR 颁发者拥有私钥？

2 个解决方案

解决方案1
 2 已采纳  2020-06-13 07:23:31

The structure of CSR is defined in PKCS #10 that is re-published as RFC 2986 CSR 的结构在作为RFC 2986重新发布的 PKCS #10 中定义

CSR includes, among other things, the public key of the requestor. CSR 包括请求者的公钥等。 The CA needs to verify that the requestor does hold the corresponding private key. CA 需要验证请求者是否持有相应的私钥。 To ensure the ownership of the private key the requestor signs the CSR's data with it's private key.为了确保私钥的所有权，请求者使用其私钥对 CSR 的数据进行签名。

When CA receives a CSR, it extracts the public key of the requestor and validates the signature.当 CA 收到 CSR 时，它会提取请求者的公钥并验证签名。 If validation fais, the CSR is rejected.如果验证失败，则拒绝 CSR。

The Wikipedia page includes a sample CSR with field-by-field decomposition. Wikipedia 页面包含一个按字段分解的示例 CSR。 The sample is a request for a certificate with RSA public key and is signed using md5WithRSAEncryption algorithm.该示例是对具有 RSA 公钥的证书的请求，并使用md5WithRSAEncryption算法进行签名。

解决方案2
 0  2020-06-13 22:15:11

Is the CSR(Certificate Signing Request) containing the public key and the organization details encrypted with the private key?包含公钥和组织详细信息的 CSR（证书签名请求）是否使用私钥加密？

It is easy to check that it isn't.很容易检查它不是。

1) Create a private key and associated CSR: 1) 创建私钥和关联的 CSR：

openssl req -new -sha256 -newkey rsa:2048 -nodes -keyout example.key -out example.csr

2) I now have 2 files, the private key and the CSR. 2) 我现在有 2 个文件，私钥和 CSR。 Let us show the content of the CSR after having deleted the private key, just to make sure it is not needed, and comparing with the private key.让我们显示删除私钥后的 CSR 内容，以确保不需要它，并与私钥进行比较。

With private key still there:私钥仍然存在：

$ openssl req -noout -text -in example.csr
Certificate Request:
    Data:
        Version: 1 (0x0)
        Subject: C = AU, ST = Some-State, O = Internet Widgits Pty Ltd
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:e2:23:3c:4e:d8:39:ce:9a:16:2f:e2:ef:e7:9b:
                    5d:7f:20:a7:9a:4b:dd:54:ad:6b:b3:ff:33:78:65:
                    f2:b1:e1:e3:b5:eb:23:9d:da:b3:8d:3c:2f:1f:60:
                    9a:17:36:df:0f:4e:3a:bd:fb:9f:73:d5:00:c2:65:
                    04:a2:77:e6:5b:27:f2:30:8f:57:31:c8:bf:d1:0a:
                    cc:db:f5:95:8e:98:ff:34:c5:ed:68:57:f8:43:47:
                    41:ff:cb:6d:27:ae:de:33:95:cd:d6:0a:f8:0b:25:
                    27:99:4e:6b:7d:d8:c4:dd:83:97:57:7a:42:69:4c:
                    41:e2:d6:7f:86:d0:6f:1b:c2:30:b2:e7:a9:ee:5b:
                    9d:a1:ce:80:ec:45:a6:ad:a4:6e:b1:6a:b1:68:ef:
                    c4:7d:5b:6c:e5:24:fe:54:f9:bb:09:48:5c:49:ca:
                    fe:41:28:bc:48:e8:02:bf:ac:b0:5b:c6:3f:bb:0e:
                    17:d4:31:02:31:27:b1:a3:7a:ff:82:49:f0:11:10:
                    64:53:44:ca:61:82:fd:3a:82:5c:07:48:23:1f:db:
                    e5:0f:64:79:09:19:25:b4:a5:07:42:d3:b4:54:75:
                    61:13:43:63:34:a2:72:55:07:d6:d1:8c:74:31:cb:
                    5c:54:1e:6a:e7:04:86:35:4c:d9:a4:31:3f:fd:36:
                    9c:59
                Exponent: 65537 (0x10001)
        Attributes:
            a0:00
    Signature Algorithm: sha256WithRSAEncryption
         6d:fb:a6:e5:2b:89:5c:ef:5c:ca:cc:d3:9a:3d:b1:c1:41:9d:
         b5:55:ca:2c:17:ca:ea:74:1d:79:b9:16:ec:81:08:95:94:98:
         e1:2b:50:c7:46:eb:d4:97:09:25:cc:da:b4:bd:34:3c:5a:14:
         c8:88:ed:21:99:63:e9:c0:0e:fa:bb:5d:a7:27:11:22:61:a1:
         1f:d3:65:c8:cc:14:ff:d7:ce:19:29:14:67:ed:e5:b8:31:b5:
         25:55:8e:59:42:f1:2a:6d:f9:fe:4a:be:08:b9:23:c5:b6:3b:
         c8:7e:3f:0c:bd:bb:37:f6:fd:5a:0e:50:50:43:8e:59:f7:b6:
         77:06:50:b2:45:2a:17:f4:53:5a:7c:3c:50:6d:de:74:e3:0e:
         df:94:48:bc:a9:fa:b8:a1:9a:3e:dc:10:c8:50:cb:9b:a7:49:
         cc:ac:88:66:54:e6:d3:06:81:95:f4:ac:e1:61:d7:88:18:74:
         e8:8e:d2:8d:e9:71:7f:99:41:b9:b3:a1:ad:af:d6:0b:2f:46:
         8d:fa:c4:29:b4:40:38:fb:80:31:33:5c:62:67:62:dd:62:14:
         36:fe:8f:8d:36:dc:0c:52:7b:0b:46:1c:58:94:2f:84:a9:54:
         b0:a8:78:a0:9d:30:e9:0d:2f:a5:09:7d:3e:4e:75:16:56:f7:
         94:a7:09:8f

Now removing private key:现在删除私钥：

rm example.key

and decoding the CSR again:并再次解码 CSR：

$ openssl req -noout -text -in example.csr
Certificate Request:
    Data:
        Version: 1 (0x0)
        Subject: C = AU, ST = Some-State, O = Internet Widgits Pty Ltd
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:e2:23:3c:4e:d8:39:ce:9a:16:2f:e2:ef:e7:9b:
                    5d:7f:20:a7:9a:4b:dd:54:ad:6b:b3:ff:33:78:65:
                    f2:b1:e1:e3:b5:eb:23:9d:da:b3:8d:3c:2f:1f:60:
                    9a:17:36:df:0f:4e:3a:bd:fb:9f:73:d5:00:c2:65:
                    04:a2:77:e6:5b:27:f2:30:8f:57:31:c8:bf:d1:0a:
                    cc:db:f5:95:8e:98:ff:34:c5:ed:68:57:f8:43:47:
                    41:ff:cb:6d:27:ae:de:33:95:cd:d6:0a:f8:0b:25:
                    27:99:4e:6b:7d:d8:c4:dd:83:97:57:7a:42:69:4c:
                    41:e2:d6:7f:86:d0:6f:1b:c2:30:b2:e7:a9:ee:5b:
                    9d:a1:ce:80:ec:45:a6:ad:a4:6e:b1:6a:b1:68:ef:
                    c4:7d:5b:6c:e5:24:fe:54:f9:bb:09:48:5c:49:ca:
                    fe:41:28:bc:48:e8:02:bf:ac:b0:5b:c6:3f:bb:0e:
                    17:d4:31:02:31:27:b1:a3:7a:ff:82:49:f0:11:10:
                    64:53:44:ca:61:82:fd:3a:82:5c:07:48:23:1f:db:
                    e5:0f:64:79:09:19:25:b4:a5:07:42:d3:b4:54:75:
                    61:13:43:63:34:a2:72:55:07:d6:d1:8c:74:31:cb:
                    5c:54:1e:6a:e7:04:86:35:4c:d9:a4:31:3f:fd:36:
                    9c:59
                Exponent: 65537 (0x10001)
        Attributes:
            a0:00
    Signature Algorithm: sha256WithRSAEncryption
         6d:fb:a6:e5:2b:89:5c:ef:5c:ca:cc:d3:9a:3d:b1:c1:41:9d:
         b5:55:ca:2c:17:ca:ea:74:1d:79:b9:16:ec:81:08:95:94:98:
         e1:2b:50:c7:46:eb:d4:97:09:25:cc:da:b4:bd:34:3c:5a:14:
         c8:88:ed:21:99:63:e9:c0:0e:fa:bb:5d:a7:27:11:22:61:a1:
         1f:d3:65:c8:cc:14:ff:d7:ce:19:29:14:67:ed:e5:b8:31:b5:
         25:55:8e:59:42:f1:2a:6d:f9:fe:4a:be:08:b9:23:c5:b6:3b:
         c8:7e:3f:0c:bd:bb:37:f6:fd:5a:0e:50:50:43:8e:59:f7:b6:
         77:06:50:b2:45:2a:17:f4:53:5a:7c:3c:50:6d:de:74:e3:0e:
         df:94:48:bc:a9:fa:b8:a1:9a:3e:dc:10:c8:50:cb:9b:a7:49:
         cc:ac:88:66:54:e6:d3:06:81:95:f4:ac:e1:61:d7:88:18:74:
         e8:8e:d2:8d:e9:71:7f:99:41:b9:b3:a1:ad:af:d6:0b:2f:46:
         8d:fa:c4:29:b4:40:38:fb:80:31:33:5c:62:67:62:dd:62:14:
         36:fe:8f:8d:36:dc:0c:52:7b:0b:46:1c:58:94:2f:84:a9:54:
         b0:a8:78:a0:9d:30:e9:0d:2f:a5:09:7d:3e:4e:75:16:56:f7:
         94:a7:09:8f

Conclusion: same results, proving the key is not needed.结论：相同的结果，不需要证明密钥。

Of course:当然：

1) it was trivial to see that immediately, because if the key was needed when decoding the CSR, you would have need to specify it on command line of openssl (it does not poke out randomly at files) 1) 立即看到这一点很简单，因为如果在解码 CSR 时需要密钥，则需要在openssl的命令行上指定它（它不会在文件中随机出现）

2) it is of course silly to have deleted the private key because now if some certificate is indeed created out of this CSR, it is useless as the attached private key does not exist anymore. 2）删除私钥当然是愚蠢的，因为现在如果确实从这个CSR创建了一些证书，那么它是无用的，因为附加的私钥不再存在。

暂无
暂无

声明:本站的技术帖子网页，遵循CC BY-SA 4.0协议，如果您需要转载，请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.

相关问题 从私钥生成CSR密钥 - generate CSR key from private key CSR 和 SSL 证书。 和私钥 - CSR, and SSL certificate. and Private Key 使用现有私钥创建 CSR - Create CSR using existing private key 可以在没有CSR且使用旧私钥的情况下颁发证书 - Can a Cert be issued without a CSR and using old Private Key ssl 证书-从 csr 获取私钥 - ssl certificate- get private key from csr 生成 CSR 时如何使用 Keytool 生成私钥 - how to generate private key with Keytool when generating CSR Pem证书中的私钥如何加密？ - How is a private key encrypted in a pem certificate? 如何产生用对称密钥加密的PKCS8私钥？ - How to produce a PKCS8 private key encrypted by a symmetric key? 从ASN1加密的pem证书中获取公钥和私钥 - Get public and private key from ASN1 encrypted pem certificate 为什么必须从私钥创建证书请求（CSR）？ - Why do I have to create a certificate request (CSR) from the private key?
相关标签
 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM