【发布时间】：2018-03-10 18:01:14
【问题描述】：
我目前正在了解证书签名请求 (csr) 的工作原理。我的 csr 的内容是这样的
openssl req -text -noout -verify -in bobsbooks.com.csr
verify OK
Certificate Request:
Data:
Version: 0 (0x0)
Subject: C=UK, ST=Hampshire, L=Southampton, O=Bob's books Ltd, OU=IT Department, CN=bobsbooks.com/emailAddress=admin@bobsbooks.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:94:e6:c2:33:ee:e0:67:c9:aa:e8:ff:82:07:40:
0e:91:ca:19:ea:b2:98:2a:87:b7:1a:ce:c7:d3:3b:
e3:a9:39:9d:8d:7f:e6:26:84:70:4a:a8:49:97:e9:
37:72:07:98:58:77:98:03:a7:fd:0f:9e:0d:7f:f6:
d7:84:ac:40:79:2b:bd:62:18:da:75:f3:e8:5e:33:
48:82:e4:c2:91:0b:81:74:11:cd:d4:3c:f2:60:f6:
de:a2:32:97:fd:8c:73:53:6e:fe:33:6c:28:2b:d0:
e9:9f:af:dc:b3:c6:30:04:bb:e0:e5:41:d8:4b:78:
b9:0b:53:b2:32:c4:33:62:e0:11:cc:b7:59:26:96:
95:82:ca:0e:22:37:70:ca:06:9f:1d:27:41:6d:b4:
64:c6:1b:09:8e:85:72:e0:72:54:1e:eb:ee:d7:54:
d6:b9:98:99:61:46:1b:1c:da:2d:35:8a:0a:59:bf:
fe:e9:bd:92:5b:52:74:44:ab:1d:a0:6c:2d:6d:a2:
6b:d1:ce:ed:ca:ce:a6:0a:d4:4a:14:22:4c:bb:f9:
1b:e8:8f:74:32:f2:12:4b:6c:54:e4:35:b0:bf:e1:
3b:83:f0:57:da:55:be:5e:38:03:c2:2c:36:8c:19:
e0:e5:af:91:67:38:4d:7a:10:04:3d:e2:72:c9:3e:
eb:ed
Exponent: 65537 (0x10001)
Attributes:
a0:00
Signature Algorithm: sha256WithRSAEncryption
67:0a:00:b3:62:36:13:e6:c6:ef:04:10:5b:ec:1f:54:fe:55:
c1:50:30:bc:ca:ae:c6:61:a4:44:9d:98:d5:9b:84:a0:93:60:
6b:83:02:62:a3:73:96:10:55:f3:90:9e:85:00:22:78:0a:1f:
45:1c:d0:e6:03:8a:35:72:ce:44:66:08:19:65:44:d7:12:5d:
00:0a:b9:db:3b:1f:a7:a6:fa:a9:84:f5:3a:61:5f:14:48:89:
37:37:b4:b0:1f:51:48:2d:02:6b:f4:ff:6b:4d:d3:56:c5:2e:
43:46:67:6a:cc:be:07:86:b3:82:12:4c:06:67:33:35:5e:63:
b0:76:33:13:1f:85:70:d9:b6:1e:b3:76:ee:f3:54:40:09:a8:
60:bc:35:21:cd:1e:bc:bb:49:c8:10:ae:11:03:c9:d2:fa:7c:
40:9a:53:08:d6:7e:08:9b:be:43:9a:60:79:25:14:7f:5e:6d:
81:45:2f:39:89:91:3d:8b:8e:3b:84:9c:50:e4:40:88:e1:82:
cb:5d:3f:af:13:2c:d0:34:3d:c3:e7:35:11:f3:ac:70:1d:b5:
2e:ae:d6:35:5c:45:75:5c:b5:81:82:a5:c4:73:4e:8a:09:1f:
5c:44:b7:73:42:d7:68:a0:e2:30:91:4d:29:04:32:e2:1e:bc:
12:37:74:00
我想弄清楚的是如何生成签名块（签名算法：sha256WithRSAEncryption）。我的理解是被私钥加密的是公钥的哈希，即：
$ sha256sum bobsbooks.com.public.key | openssl rsautl -inkey bobsbooks.com.private.key -sign | hexdump
0000000 574e 10f5 3a49 5784 25cc 7b06 c234 6ecf
0000010 adb2 9011 9332 e9e7 8dbf 7b10 c7d1 707e
0000020 aaf3 10b1 9497 32a6 d943 5b68 caba 8e5c
0000030 507d 24c7 76bb ab19 d5d7 e653 51e1 f54a
0000040 2a56 7f14 360d 15a9 767b 736a 16bc c3d8
0000050 8cb9 be7a 5ebe 701f 86ef ca5d cfd9 f035
0000060 0b5a 71ac fec4 c5cd 015e 643b 541e 6e5c
0000070 266b 5c33 98d6 db99 2431 d98e d591 04d1
0000080 4479 c85b e180 648b e71c b164 de14 6f33
0000090 fcb1 c2f6 3cc7 61ea 6f0f ab93 a1ad 5ba2
00000a0 af61 addd 4e5e 949e f38b e454 45f7 d12a
00000b0 5dfe 8bc3 b166 e4a0 8075 aa55 2089 49e4
00000c0 1a1d f137 d82b cb47 c0aa 0b14 a897 7879
00000d0 13e2 7c0a 6455 92a6 f9c7 b607 d52b ec07
00000e0 1c66 b9cb d055 ee0b 27b5 fabb 9191 8eb9
00000f0 104c 8ee2 cd81 02b9 d2a9 7502 99bd dbe1
0000100
但是这个输出看起来不像签名。我一定是
【问题讨论】：
-
'我的理解是用私钥加密的是公钥的哈希'：你的理解是错误的。你从哪里得到这个小信息？这甚至没有意义。为什么例如加密步骤？这样的签名能证明什么？
-
欺骗stackoverflow.com/questions/39842014/… 和security.stackexchange.com/questions/58717/… 可能还有stackoverflow.com/questions/24609310/how-does-csr-signing-work，另见stackoverflow.com/questions/38767660/…。另请注意，某些签名方案是确定性的，但有些并非如此简单地未能产生相同的签名不是证据，尽管在这种情况下您实际上是错误的。
-
Stack Overflow 是一个编程和开发问题的网站。这个问题似乎离题了，因为它与编程或开发无关。请参阅帮助中心的What topics can I ask about here。也许Cryptography Stack Exchange 或Information Security Stack Exchange 会是一个更好的提问地点。
标签： ssl openssl digital-signature csr