x509证书
http://en.wikipedia.org/wiki/X.509
http://blog.csdn.net/wuzh1230/article/details/4240238
http://blog.csdn.net/wuzh1230/article/details/7211997
证书文件的编码
二进制编码 - DER
按照x509的ASN1定义的结构编码结果直接写入二进制文件。
Certificate ::= SEQUENCE {
tbsCertificate TBSCertificate,
signatureAlgorithm AlgorithmIdentifier,
signatureValue BIT STRING }
TBSCertificate ::= SEQUENCE {
version [0] EXPLICIT Version DEFAULT v1,
serialNumber CertificateSerialNumber,
signature AlgorithmIdentifier,
issuer Name,
validity Validity,
subject Name,
subjectPublicKeyInfo SubjectPublicKeyInfo,
issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL,
-- If present, version MUST be v2 or v3
subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL,
-- If present, version MUST be v2 or v3
extensions [3] EXPLICIT Extensions OPTIONAL
-- If present, version MUST be v3
}
Version ::= INTEGER { v1(0), v2(1), v3(2) }
CertificateSerialNumber ::= INTEGER
Validity ::= SEQUENCE {
notBefore Time,
notAfter Time }
Time ::= CHOICE {
utcTime UTCTime,
generalTime GeneralizedTime }
UniqueIdentifier ::= BIT STRING
SubjectPublicKeyInfo ::= SEQUENCE {
algorithm AlgorithmIdentifier,
subjectPublicKey BIT STRING }
Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
Extension ::= SEQUENCE {
extnID OBJECT IDENTIFIER,
critical BOOLEAN DEFAULT FALSE,
extnValue OCTET STRING
-- contains the DER encoding of an ASN.1 value
-- corresponding to the extension type identified
-- by extnID
}
AlgorithmIdentifier ::= SEQUENCE {
algorithm OBJECT IDENTIFIER,
parameters ANY DEFINED BY algorithm OPTIONAL
}
如何提取tbs证书(how to extrace a tbsCertificate from a cert)
openssl asn1parse -in alicecert.pem -out tbsCert.der -noout -strparse 4
* 注意输入是pem编码的证书，输出是der编码的证书, 输出如下：
00000000 30 82 02 ba 02 09 00 f3 f9 32 df e4 8e ec 15 30 |0........2.....0| 00000010 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 2b |...*.H........0+| 00000020 31 29 30 27 06 09 2a 86 48 86 f7 0d 01 09 01 16 |1)0'..*.H.......| 00000030 1a 69 6d 61 6c 69 63 65 2e 66 72 65 65 6d 61 69 |.imalice.freemai| 00000040 6c 40 67 6d 61 69 6c 2e 63 6f 6d 30 1e 17 0d 31 |[email protected]| 00000050 35 30 33 32 35 30 38 32 32 35 33 5a 17 0d 31 36 |50325082253Z..16| 00000060 30 33 32 34 30 38 32 32 35 33 5a 30 2b 31 29 30 |0324082253Z0+1)0| 00000070 27 06 09 2a 86 48 86 f7 0d 01 09 01 16 1a 69 6d |'..*.H........im| 00000080 61 6c 69 63 65 2e 66 72 65 65 6d 61 69 6c 40 67 |alice.freemail@g| 00000090 6d 61 69 6c 2e 63 6f 6d 30 82 02 22 30 0d 06 09 |mail.com0.."0...| 000000a0 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 |*.H.............| 000000b0 30 82 02 0a 02 82 02 01 00 b0 7f 43 78 36 9c 0b |0..........Cx6..| 000000c0 fe db 64 d1 36 0b 6b 98 61 6b 73 52 cc 3f ff f0 |..d.6.k.aksR.?..| 000000d0 35 6a 45 80 ef 5a 9d f8 1d 19 9f a6 b7 29 09 10 |5jE..Z.......)..| 000000e0 63 bb 9e 47 13 79 7e 10 a3 9c 68 1c fe 24 d1 41 |c..G.y~...h..$.A| 000000f0 47 1e b5 2c 30 c9 4e ab cd 14 fc aa 9e 25 60 10 |G..,0.N......%`.| 00000100 dd b9 af 7d ca 71 23 b2 fc 16 f6 44 7b 01 d5 09 |...}.q#....D{...| 00000110 89 36 7a b3 61 3d c8 9a bb 4d b7 64 c1 3d 09 40 |.6z.a=...M.d.=.@| 00000120 1a af 95 bd d2 f0 fc 8c 0f 93 e7 2d de 23 4d 86 |...........-.#M.| 00000130 d3 a5 a4 1b a4 6c 71 32 b5 34 0d b0 90 a4 aa c3 |.....lq2.4......| 00000140 75 51 69 58 0c a5 bd b1 a7 a3 8e 7c 2d 15 5b c1 |uQiX.......|-.[.| 00000150 19 70 5f 76 e5 91 12 42 01 00 63 8d ec 70 e5 60 |.p_v...B..c..p.`| 00000160 c6 ef 8a bf 81 ff 7b 55 4c 39 b1 33 ca 60 06 91 |......{UL9.3.`..| 00000170 58 5a 7d 5c 1c a7 e1 98 13 42 7c c9 de c8 4d 26 |XZ}\.....B|...M&| 00000180 a0 18 31 73 0a 65 f1 8b 8d 2b ad 2b a8 81 82 1f |..1s.e...+.+....| 00000190 47 83 22 b4 9d 44 db 7f 84 5d 5b 02 c1 4e 7a 84 |G."..D...][..Nz.| 000001a0 a9 37 cd 5c 29 41 31 3c 15 19 40 0d d7 3a b9 4d |.7.\)A1<..@..:.M| 000001b0 f4 7d a8 e0 07 9e 18 ab 26 a3 e7 ec 4d 9f 44 3f |.}......&...M.D?| 000001c0 7f 0c 14 32 be 51 6d b1 36 7e bc 2d 5e 09 dc 22 |...2.Qm.6~.-^.."| 000001d0 f3 74 d2 0e 36 e8 f7 5e 0f b7 3c 44 39 41 f5 b8 |.t..6..^..<D9A..| 000001e0 28 74 c8 9e e9 5c a0 1f 31 26 91 bb e6 da 0f c0 |(t...\..1&......| 000001f0 a0 62 f6 ee f4 62 48 2d 4e 77 04 5c 4f 22 15 d3 |.b...bH-Nw.\O"..| 00000200 cc b6 bf 03 21 66 92 11 e0 ee f9 5a 34 e6 98 06 |....!f.....Z4...| 00000210 a8 53 5c e5 7c 2d 28 54 5b d9 59 f6 4d 60 54 32 |.S\.|-(T[.Y.M`T2| 00000220 78 29 37 82 3b 03 d2 59 39 81 66 74 30 ee 8f e1 |x)7.;..Y9.ft0...| 00000230 64 39 1a 7f c0 33 0f be 92 1a f6 75 87 24 ab 35 |d9...3.....u.$.5| 00000240 3c 24 00 16 2b c8 01 a1 56 24 8b 2b e8 f1 84 b6 |<$..+...V$.+....| 00000250 39 eb 27 4d ab 25 06 bd f6 14 1b 20 45 88 d5 d3 |9.'M.%..... E...| 00000260 28 41 5c e5 af 75 0c 5f bf 80 b6 8a d1 79 c7 cc |(A\..u._.....y..| 00000270 96 74 3e 31 c4 e7 cb dd cd 5f ec c7 2c e2 34 fd |.t>1....._..,.4.| 00000280 41 30 3a 06 5a ea 06 0e f3 23 0a c7 d8 bb ac 04 |A0:.Z....#......| 00000290 71 62 b3 d3 dc e0 d5 1c 69 6e 4c 3e 58 0b 18 d3 |qb......inL>X...| 000002a0 f3 55 8d ee 1d 47 89 8c 83 c6 1d 5c 12 9b ce 7a |.U...G.....\...z| 000002b0 3b 43 4b 98 e3 0a ac fc 1f 02 03 01 00 01 |;CK...........|
还有个办法（alterlate way is use `dd' to pick tbsCertificate out of originate cert file)
dd if=alicecert.der of=alicecert.tbs.der bs=1 count=702 skip=4
文本编码 - PEM
通过base64编码DER证书的二进制内容以后，
前后附加
"-----BEGIN CERTIFICATE-----"
base64编码的证书内容
"-----END CERTIFICATE-----"
等字段保存为文本文件(Privacy Enhanced Mail)。
证书文件的后缀
当然有的时候，der和pem也可直接用作文件的后缀，直接表示这个证书的编码。
x509证书格式定义
...
一个典型的网站证书
Certificate:
Data:
Version: 1 (0x0)
Serial Number: 7829 (0x1e95)
Signature Algorithm: md5WithRSAEncryption
Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc,
OU=Certification Services Division,
CN=Thawte Server CA/[email protected]
Validity
Not Before: Jul 9 16:04:02 1998 GMT
Not After : Jul 9 16:04:02 1999 GMT
Subject: C=US, ST=Maryland, L=Pasadena, O=Brent Baccala,
OU=FreeSoft, CN=www.freesoft.org/[email protected]
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (1024 bit)
Modulus (1024 bit):
00:b4:31:98:0a:c4:bc:62:c1:88:aa:dc:b0:c8:bb:
33:35:19:d5:0c:64:b9:3d:41:b2:96:fc:f3:31:e1:
66:36:d0:8e:56:12:44:ba:75:eb:e8:1c:9c:5b:66:
70:33:52:14:c9:ec:4f:91:51:70:39:de:53:85:17:
16:94:6e:ee:f4:d5:6f:d5:ca:b3:47:5e:1b:0c:7b:
c5:cc:2b:6b:c1:90:c3:16:31:0d:bf:7a:c7:47:77:
8f:a0:21:c7:4c:d0:16:65:00:c1:0f:d7:b8:80:e3:
d2:75:6b:c1:ea:9e:5c:5c:ea:7d:c1:a1:10:bc:b8:
e8:35:1c:9e:27:52:7e:41:8f
Exponent: 65537 (0x10001)
Signature Algorithm: md5WithRSAEncryption
93:5f:8f:5f:c5:af:bf:0a:ab:a5:6d:fb:24:5f:b6:59:5d:9d:
92:2e:4a:1b:8b:ac:7d:99:17:5d:cd:19:f6:ad:ef:63:2f:92:
ab:2f:4b:cf:0a:13:90:ee:2c:0e:43:03:be:f6:ea:8e:9c:67:
d0:a2:40:03:f7:ef:6a:15:09:79:a9:46:ed:b7:16:1b:41:72:
0d:19:aa:ad:dd:9a:df:ab:97:50:65:f5:5e:85:a6:ef:19:d1:
5a:de:9d:ea:63:cd:cb:cc:6d:5d:01:85:b5:6d:c8:f3:d9:f7:
8f:0e:fc:ba:1f:34:e9:96:6e:6c:cf:f2:ef:9b:bf:de:b5:22:
68:9f 证书的验证
自签名证书
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
Signature Algorithm: md5WithRSAEncryption
Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc,
OU=Certification Services Division,
CN=Thawte Server CA/[email protected]
Validity
Not Before: Aug 1 00:00:00 1996 GMT
Not After : Dec 31 23:59:59 2020 GMT
Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc,
OU=Certification Services Division,
CN=Thawte Server CA/[email protected]
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (1024 bit)
Modulus (1024 bit):
00:d3:a4:50:6e:c8:ff:56:6b:e6:cf:5d:b6:ea:0c:
68:75:47:a2:aa:c2:da:84:25:fc:a8:f4:47:51:da:
85:b5:20:74:94:86:1e:0f:75:c9:e9:08:61:f5:06:
6d:30:6e:15:19:02:e9:52:c0:62:db:4d:99:9e:e2:
6a:0c:44:38:cd:fe:be:e3:64:09:70:c5:fe:b1:6b:
29:b6:2f:49:c8:3b:d4:27:04:25:10:97:2f:e7:90:
6d:c0:28:42:99:d7:4c:43:de:c3:f5:21:6d:54:9f:
5d:c3:58:e1:c0:e4:d9:5b:b0:b8:dc:b4:7b:df:36:
3a:c2:b5:66:22:12:d6:87:0d
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints: critical
CA:TRUE
Signature Algorithm: md5WithRSAEncryption
07:fa:4c:69:5c:fb:95:cc:46:ee:85:83:4d:21:30:8e:ca:d9:
a8:6f:49:1a:e6:da:51:e3:60:70:6c:84:61:11:a1:1a:c8:48:
3e:59:43:7d:4f:95:3d:a1:8b:b7:0b:62:98:7a:75:8a:dd:88:
4e:4e:9e:40:db:a8:cc:32:74:b9:6f:0d:c6:e3:b3:44:0b:d9:
8a:6f:9a:29:9b:99:18:28:3b:d1:e3:40:28:9a:5a:3c:d5:b5:
e7:20:1b:8b:ca:a4:ab:8d:e9:51:d9:e2:4c:2c:59:a9:da:b9:
b2:75:1b:f6:42:f2:ef:c7:f2:18:f9:89:bc:a3:ff:8a:23:2e:
70:47 md5碰撞攻击
...