csr证书请求文件openssl校验失败的两种特殊情况

1类：

出错概率：0.8%左右

原因：签名的R段和S段，这两段的签名的第一个字节为0x00时，openssl就会报校验失败。

规避：只要算到签名的R段和S段第一个字节为0x00时重新算，算到非0x00后再用这个签名；

2类：

出错概率：0.8%左右

原因：签名的R段和S段，这两段的签名的第一个字节为0x80时，openssl就会报校验失败。

规避：只要算到签名的R段和S段第一个字节为0x80时，需要在签名补0x00并把所有成都+1即可；

 

推荐一个证书请求文件校验网址：（如无法访问请使用lantern或其它FQ工具）

https://www.entrust.net/ssl-technical/csr-viewer.cfm

下面这个链接可以查看证书内容，但无法验证签名是否正确

https://www.chinassl.net/ssltools/decoder-csr.html

openssl校验命令

openssl req -verify -in client.req -noout -text

req [options] outfile
where options  are
 -inform arg    input format - DER or PEM
 -outform arg   output format - DER or PEM
 -in arg        input file
 -out arg       output file
 -text          text form of request
 -pubkey        output public key
 -noout         do not output REQ
 -verify        verify signature on REQ
 -modulus       RSA modulus
 -nodes         don't encrypt the output key
 -engine e      use engine e, possibly a hardware device
 -subject       output the request's subject
 -passin        private key password source
 -key file      use the private key contained in file
 -keyform arg   key file format
 -keyout arg    file to send the key to
 -rand file;file;...
                load the file (or the files in the directory) into
                the random number generator
 -newkey rsa:bits generate a new RSA key of 'bits' in size
 -newkey dsa:file generate a new DSA key, parameters taken from CA in 'file'
 -newkey ec:file generate a new EC key, parameters taken from CA in 'file'
 -[digest]      Digest to sign with (md5, sha1, md2, mdc2, md4)
 -config file   request template file.
 -subj arg      set or modify request subject
 -multivalue-rdn enable support for multivalued RDNs
 -new           new request.
 -batch         do not ask anything during request generation
 -x509          output a x509 structure instead of a cert. req.
 -days          number of days a certificate generated by -x509 is valid for.
 -set_serial    serial number to use for a certificate generated by -x509.
 -newhdr        output "NEW" in the header lines
 -asn1-kludge   Output the 'request' in a format that is wrong but some CA's
                have been reported as requiring
 -extensions .. specify certificate extension section (override value in config file)
 -reqexts ..    specify request extension section (override value in config file)
 -utf8          input characters are UTF8 (default ASCII)
 -nameopt arg    - various certificate name options
 -reqopt arg    - various request text options


C:\OpenSSL\bin>openssl req -verify -in client.req -noout -text
verify OK
Certificate Request:
    Data:
        Version: 0 (0x0)
        Subject: C=CN, ST=Tianjin, L=Tianjin, O=CHINASSL Inc, OU=Sales, CN=www.chinassl.net/[email protected]
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (2048 bit)
                Modulus (2048 bit):
                    00:b7:4a:f6:96:7c:2a:8d:94:59:82:dc:76:a3:ec:
                    93:fd:4b:49:80:14:b5:69:13:c3:17:df:f0:b1:d5:
                    1a:33:6f:76:86:a1:de:40:ba:3f:f9:f0:77:2e:b0:
                    c1:f8:b8:2e:06:76:a1:ff:4a:08:90:cc:1d:e2:1b:
                    20:f2:23:d4:a6:f9:64:1c:40:b4:ab:b0:ea:b8:ec:
                    ee:32:60:10:a4:bb:1a:10:c5:08:2a:a4:0b:d2:83:
                    b8:ec:4e:80:b0:79:de:59:64:4e:a3:6d:30:43:84:
                    16:33:67:3d:72:47:55:c0:a7:b4:2b:14:6a:73:c2:
                    d2:d7:d9:41:47:80:c8:2c:36:0a:24:f0:2d:83:c6:
                    43:07:7a:83:80:eb:af:51:1f:b0:5b:5b:3d:e0:91:
                    c5:0b:b4:db:d0:e3:0c:f2:8f:5b:96:65:93:3e:63:
                    90:49:a0:5a:3f:aa:c6:55:39:df:4f:1f:41:cd:14:
                    0e:00:3e:99:81:15:bd:eb:69:59:79:f9:33:bd:4a:
                    b1:98:55:cf:91:82:cd:f1:3e:83:4f:99:19:ae:be:
                    f7:35:86:56:4e:b5:6c:28:cc:ef:71:00:bb:55:ae:
                    25:be:96:84:24:58:77:2c:43:98:aa:3e:b6:be:7f:
                    d1:17:dc:ca:c3:17:e3:c6:6c:59:26:88:e8:38:61:
                    49:8b
                Exponent: 65537 (0x10001)
        Attributes:
            a0:00
    Signature Algorithm: sha1WithRSAEncryption
        6f:10:f3:d4:bc:cf:de:94:13:fb:bc:4b:68:41:94:fd:7a:7b:
        77:9f:4f:08:bd:47:07:ef:6c:df:86:d2:67:56:5f:18:eb:41:
        34:d9:8c:9d:ae:25:43:2a:36:54:1a:b1:b4:35:ff:74:45:31:
        b2:05:b8:42:e8:49:9c:7d:63:0c:71:f7:3c:f4:ee:c7:f3:95:
        cf:f1:33:57:27:1f:2e:46:94:6e:08:6d:01:c4:c3:27:d2:12:
        65:56:0a:49:c1:1c:96:74:5b:8e:27:8d:f3:6c:18:fe:15:8f:
        79:2f:f4:cb:22:8f:c4:e3:2c:93:da:54:1b:3e:ef:6c:5c:ad:
        f8:46:c4:2c:d4:e1:b6:55:b6:95:2b:bb:72:35:c2:3c:23:86:
        41:e4:01:1e:85:c8:ed:3e:c8:5b:a0:1b:60:23:5a:86:ff:fd:
        55:bb:71:ce:36:ea:84:73:84:8b:c2:9f:73:5d:ca:ae:32:91:
        a0:29:12:86:c7:ac:8a:a6:f5:96:61:58:f9:be:dd:48:d8:5d:
        ab:0d:24:00:4e:76:54:d9:f2:b5:26:00:1d:7a:e8:9b:60:9c:
        f1:61:8f:8c:1c:c1:4c:01:c6:b4:5e:c4:24:60:78:d1:cc:6a:
        a0:40:50:38:b1:c6:d3:ec:21:fc:8b:c3:71:52:33:9a:90:fa:
        42:01:a5:a0

C:\OpenSSL\bin>openssl req -verify -in client.req -noout -text
unable to load X509 request
8764:error:0906D064:PEM routines:PEM_read_bio:bad base64 decode:.\crypto\pem\pem_lib.c:753: