phpseclib 生成的证书完整性无法保证/损坏

Question

我使用以下代码通过我自己的 CA 签署 CSR：

<?php
require_once("vendor/autoload.php");

$privKey = new \phpseclib\Crypt\RSA();
$privKey->setHash('sha512');
$keypair = $privKey->createKey(4096);
$privKey->loadKey($keypair['privatekey']);
$pubKey = new \phpseclib\Crypt\RSA();
$pubKey->loadKey($keypair['publickey']);
$pubKey->setPublicKey();

$subject = new \phpseclib\File\X509();
$subject->setPrivateKey($privKey);
$subject->setPublicKey($pubKey);
$subject->setDNProp("id-at-organizationName", "??");
$subject->setDNProp("id-at-organizationalUnitName", "?");
$subject->setDNProp("id-at-commonName", "127.0.0.1");
$subject->setDNProp("id-at-localityName", "?");
$subject->setDNProp("id-at-stateOrProvinceName", "?");
$subject->setDNProp("id-at-countryName", "??");
$subject->setDNProp("emailAddress", "?");
$subject->loadCSR($subject->saveCSR($subject->signCSR('sha512WithRSAEncryption')));
$subject->setExtension('id-ce-basicConstraints', array('cA'=>FALSE));
$subject->setExtension('netscape-cert-type', ['SSLServer']);
$subject->setExtension('id-ce-keyUsage', ['digitalSignature', 'keyEncipherment'], TRUE);
$subject->setExtension('id-ce-extKeyUsage', ['id-kp-serverAuth', 'id-kp-OCSPSigning'], TRUE);
$strCSR = $subject->saveCSR($subject->signCSR('sha512WithRSAEncryption'));
file_put_contents("a.csr", $strCSR);

$cakey = new \phpseclib\Crypt\RSA();
$cakey->setPassword(file_get_contents("private/passphrase.txt"));
$cakey->loadKey(file_get_contents("private/cakey.pem"));
$ca = new \phpseclib\File\X509();
$ca->loadX509(file_get_contents("cacert.pem"));
$ca->setPrivateKey($cakey);
$x509 = new \phpseclib\File\X509();
$x509->makeCA();
@$x509->setEndDate(new \DateTime("2018-08-08 08:08:08", new \DateTimeZone(@date_default_timezone_get())));
$x509->setSerialNumber(999, 10);
$sign_result = $x509->sign($ca, $subject, $subject->currentCert['signatureAlgorithm']['algorithm']);
$cert = $x509->saveX509($sign_result);
file_put_contents("a.crt", $cert);

但是，签名证书似乎有这样的问题：https://i.stack.imgur.com/F4p5I.png

谁能告诉我我做错了什么？

我的环境信息：

PHP 7.2.0
phpseclib 2.0
Windows 7

编辑： 我用openssl验证过，之后好像少了点什么 第二个“签名算法”……

Certificate:
    Data:
        ***********
    Signature Algorithm: sha512WithRSAEncryption
        ***************
        X509v3 extensions:
            ***********
    Signature Algorithm: sha512WithRSAEncryption
        **(something is missing here, there's nothing after this point)**

编辑：我的 openssl.cnf

default_bits            = 4096
default_md              = sha512
dir         = "."
[ca]
default_ca      = CA_default
[CA_default]
serial          = $dir/serial.txt
database        = $dir/index.txt
new_certs_dir       = $dir/newcerts
certificate     = $dir/cacert.pem
private_key     = $dir/private/cakey.pem
default_days        = 3650
preserve        = no
email_in_dn     = no
nameopt         = default_ca
certopt         = default_ca
policy          = policy_match
default_crl_days = 365
[policy_match]
countryName     = optional
stateOrProvinceName = optional
organizationName    = optional
organizationalUnitName  = optional
commonName      = supplied
emailAddress        = supplied
[req]
string_mask     = nombstr
distinguished_name  = req_distinguished_name
req_extensions      = v3_req
[req_distinguished_name]
............
[v3_ca]
basicConstraints    = CA:TRUE
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid:always,issuer:always
keyUsage                = critical, cRLSign, digitalSignature, keyCertSign
[v3_req]
........

Answer 1

问题是您的 CA 证书尚未安装。这不是 phpseclib 问题，也不是编程问题。事实上，这个问题最好放在 superuser.com 上。

也就是说，我能够重现您的问题。

这就是我点击生成的证书的结果。

没有安装 CA 证书：

我执行了以下步骤：

1. 点击 CA 证书的“安装证书...”
2. 点击“下一步”
3. 选择“将所有证书放入以下存储”
4. 点击“浏览...”
5. 选择“受信任的根证书颁发机构”
6. 点击“确定”
7. 点击“下一步”
8. 点击“完成”
9. 点击“是”
10. 点击“确定”

这是我之后得到的：