{"id":7675,"date":"2026-08-18T14:14:05","date_gmt":"2026-08-18T06:14:05","guid":{"rendered":"https:\/\/i007.cc\/wordpress\/?p=7675"},"modified":"2026-08-18T14:14:05","modified_gmt":"2026-08-18T06:14:05","slug":"x-509-%e8%af%81%e4%b9%a6%e6%a0%87%e5%87%86%e8%af%a6%e8%a7%a3","status":"publish","type":"post","link":"https:\/\/i007.cc\/wordpress\/archives\/7675","title":{"rendered":"X.509 \u8bc1\u4e66\u6807\u51c6\u8be6\u89e3"},"content":{"rendered":"
\n

\u4e00\u3001\u662f\u4ec0\u4e48<\/span><\/h1>\n<\/div>\n
\n
X.509 \u662f ITU-T<\/strong> \u5236\u5b9a\u7684\u516c\u94a5\u8bc1\u4e66\uff08Public Key Certificate\uff09\u683c\u5f0f\u6807\u51c6\uff0c\u6700\u65e9\u662f X.500 \u76ee\u5f55\u670d\u52a1\u4f53\u7cfb\u7684\u4e00\u90e8\u5206\uff0c\u5f53\u524d\u5e7f\u6cdb\u4f7f\u7528\u7684\u662f v3 \u7248\u672c<\/strong>\uff08RFC 5280\uff09\u3002\u5b83\u7684\u6838\u5fc3\u4f5c\u7528\u662f\uff1a\u628a\u4e00\u4e2a\u516c\u94a5\u4e0e\u4e00\u4e2a\u8eab\u4efd\uff08\u4e3b\u4f53\uff09\u901a\u8fc7\u6570\u5b57\u7b7e\u540d\u7ed1\u5b9a\u8d77\u6765<\/strong>\uff0c\u4ece\u800c\u89e3\u51b3 “\u516c\u94a5\u5230\u5e95\u5c5e\u4e8e\u8c01” \u7684\u4fe1\u4efb\u95ee\u9898\u3002<\/div>\n<\/div>\n
\n
\u4e00\u53e5\u8bdd\uff1aX.509 \u8bc1\u4e66 = \u8eab\u4efd\u4fe1\u606f + \u516c\u94a5 + CA \u7684\u6570\u5b57\u7b7e\u540d\u3002<\/div>\n<\/div>\n
\n
\n

\u4e8c\u3001\u8bc1\u4e66\u7ed3\u6784\uff08ASN.1 DER \u7f16\u7801\uff09<\/h2>\n<\/div>\n
\n
\u4e00\u5f20 X.509 v3 \u8bc1\u4e66\u5305\u542b\u4ee5\u4e0b\u5b57\u6bb5\uff1a<\/div>\n<\/div>\n
\n
\n
\n
\u8868\u683c<\/div>\n
\n
<\/div>\n
<\/div>\n
<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\u5b57\u6bb5<\/th>\n\u8bf4\u660e<\/th>\n<\/tr>\n<\/thead>\n
Version<\/strong><\/td>\n\u7248\u672c\u53f7\uff0cv3 \u5bf9\u5e94\u503c\u4e3a 2<\/td>\n<\/tr>\n
Serial Number<\/strong><\/td>\nCA \u5206\u914d\u7684\u552f\u4e00\u5e8f\u5217\u53f7\uff0c\u7528\u4e8e\u540a\u9500\u7b49\u573a\u666f<\/td>\n<\/tr>\n
Signature Algorithm<\/strong><\/td>\n\u8bc1\u4e66\u7b7e\u540d\u6240\u7528\u7b97\u6cd5\uff0c\u5982 sha256WithRSAEncryption<\/code>\u3001ecdsa-with-SHA384<\/code><\/td>\n<\/tr>\n
Issuer<\/strong><\/td>\n\u9881\u53d1\u8005\uff08CA\uff09\u7684\u53ef\u8bc6\u522b\u540d\uff08DN\uff09\uff0c\u5982 C=US, O=Let's Encrypt, CN=R3<\/code><\/td>\n<\/tr>\n
Validity<\/strong><\/td>\n\u6709\u6548\u671f\uff0c\u5305\u542b notBefore<\/code> \u548c notAfter<\/code><\/td>\n<\/tr>\n
Subject<\/strong><\/td>\n\u8bc1\u4e66\u4e3b\u4f53\u7684 DN\uff0c\u5982 CN=example.com<\/code>\uff1b\u81ea\u7b7e\u540d\u8bc1\u4e66\u4e2d Issuer = Subject<\/td>\n<\/tr>\n
Subject Public Key Info<\/strong><\/td>\n\u4e3b\u4f53\u516c\u94a5 + \u7b97\u6cd5\u6807\u8bc6\uff08RSA\/ECDSA\/Ed25519 \u7b49\uff09<\/td>\n<\/tr>\n
Issuer Unique ID<\/strong><\/td>\nv2 \u5f15\u5165\uff0c\u5df2\u4e0d\u63a8\u8350\u4f7f\u7528<\/td>\n<\/tr>\n
Subject Unique ID<\/strong><\/td>\n\u540c\u4e0a<\/td>\n<\/tr>\n
Extensions<\/strong><\/td>\nv3 \u6269\u5c55\uff0c\u662f\u73b0\u4ee3\u8bc1\u4e66\u7684\u6838\u5fc3<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n

\u5173\u952e v3 \u6269\u5c55<\/h3>\n<\/div>\n
\n
    \n
  • Subject Alternative Name (SAN)<\/strong>\uff1a\u4e3b\u4f53\u5907\u7528\u540d\uff0c\u53ef\u5305\u542b\u591a\u4e2a\u57df\u540d\u3001IP\u3001\u90ae\u7bb1\u3002\u73b0\u4ee3 TLS \u8bc1\u4e66\u4e2d SAN \u662f\u5fc5\u586b\u9879\uff0cCN<\/code> \u5b57\u6bb5\u5df2\u57fa\u672c\u88ab SAN \u53d6\u4ee3\u3002<\/li>\n
  • Key Usage<\/strong>\uff1a\u9650\u5b9a\u516c\u94a5\u7528\u9014\uff08\u6570\u5b57\u7b7e\u540d\u3001\u5bc6\u94a5\u52a0\u5bc6\u3001\u6570\u636e\u52a0\u5bc6\u3001\u8bc1\u4e66\u7b7e\u540d\u3001CRL \u7b7e\u540d\u7b49\uff09\u3002<\/li>\n
  • Extended Key Usage (EKU)<\/strong>\uff1a\u66f4\u7ec6\u7c92\u5ea6\u7528\u9014\uff0c\u5982 serverAuth<\/code>\u3001clientAuth<\/code>\u3001codeSigning<\/code>\u3001emailProtection<\/code>\u3002<\/li>\n
  • Basic Constraints<\/strong>\uff1a\u6807\u8bc6\u662f\u5426\u4e3a CA \u8bc1\u4e66\uff08CA:TRUE<\/code>\uff09\uff0c\u4ee5\u53ca\u8def\u5f84\u957f\u5ea6\u9650\u5236\u3002<\/li>\n
  • Authority Key Identifier (AKI)<\/strong>\uff1a\u6307\u5411\u9881\u53d1\u8005\u516c\u94a5\uff0c\u7528\u4e8e\u6784\u5efa\u8bc1\u4e66\u94fe\u3002<\/li>\n
  • Subject Key Identifier (SKI)<\/strong>\uff1a\u4e3b\u4f53\u516c\u94a5\u7684\u54c8\u5e0c\u6807\u8bc6\u3002<\/li>\n
  • CRL Distribution Points<\/strong>\uff1a\u8bc1\u4e66\u540a\u9500\u5217\u8868\uff08CRL\uff09\u4e0b\u8f7d\u5730\u5740\u3002<\/li>\n
  • Authority Information Access (AIA)<\/strong>\uff1a\u5305\u542b OCSP \u5730\u5740\u548c\u4e0a\u7ea7 CA \u8bc1\u4e66\u4e0b\u8f7d\u5730\u5740\uff08caIssuers<\/code>\uff09\u3002<\/li>\n
  • Name Constraints<\/strong>\uff1aCA \u8bc1\u4e66\u4e2d\u7528\u4e8e\u9650\u5b9a\u53ef\u7b7e\u53d1\u7684\u540d\u79f0\u8303\u56f4\uff08\u91cd\u8981\u7684\u5b89\u5168\u7ea6\u675f\uff09\u3002<\/li>\n<\/ul>\n<\/div>\n
    \n
    \n

    \u4e09\u3001PKI \u4fe1\u4efb\u4f53\u7cfb<\/h2>\n<\/div>\n
    \n
    X.509 \u672c\u8eab\u53ea\u5b9a\u4e49\u683c\u5f0f\uff0c\u4fe1\u4efb\u7531 PKI\uff08Public Key Infrastructure\uff09<\/strong> \u4f53\u7cfb\u63d0\u4f9b\uff1a<\/div>\n<\/div>\n
    \n
    \n
    \n
    \n
    \n
    \n
    plaintext<\/div>\n
    <\/div>\n<\/div>\n
    \n
    <\/div>\n
    \n
    \u6839 CA (Root CA) \u2500\u2500\u81ea\u7b7e\u540d\u2500\u2500 \u4fe1\u4efb\u951a\uff0c\u9884\u7f6e\u5728\u64cd\u4f5c\u7cfb\u7edf\/\u6d4f\u89c8\u5668\u4e2d\r\n    \u2502\r\n    \u2514\u2500\u2500 \u4e2d\u95f4 CA (Intermediate CA) \u2500\u2500\u7531\u6839\u7b7e\u540d\u2500\u2500 \u5b9e\u9645\u7528\u4e8e\u7b7e\u53d1\u7ec8\u7aef\u8bc1\u4e66\r\n            \u2502\r\n            \u2514\u2500\u2500 \u7ec8\u7aef\u8bc1\u4e66 (End-Entity \/ Leaf) \u2500\u2500\u7531\u4e2d\u95f4 CA \u7b7e\u540d\u2500\u2500 \u670d\u52a1\u5668\/\u7528\u6237\/\u4ee3\u7801<\/pre>\n
     <\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
    \n
    <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
    \n
    \u8bc1\u4e66\u94fe\u9a8c\u8bc1<\/strong>\uff1a\u5ba2\u6237\u7aef\u62ff\u5230 Leaf \u8bc1\u4e66\u540e\uff0c\u9010\u7ea7\u5411\u4e0a\u9a8c\u8bc1\u7b7e\u540d\uff0c\u76f4\u5230\u547d\u4e2d\u672c\u5730\u4fe1\u4efb\u5e93\u4e2d\u7684 Root CA\u3002\u4efb\u4f55\u4e00\u7ea7\u7b7e\u540d\u5931\u8d25\u3001\u8fc7\u671f\u3001\u88ab\u540a\u9500\uff0c\u9a8c\u8bc1\u5373\u4e0d\u901a\u8fc7\u3002<\/div>\n<\/div>\n
    \n
    \n
    \n
    \u4e3a\u4ec0\u4e48\u7528\u4e2d\u95f4 CA\uff1f\u6839 CA \u5bc6\u94a5\u957f\u671f\u79bb\u7ebf\u4fdd\u5b58\uff0c\u4e2d\u95f4 CA \u5728\u7ebf\u7b7e\u53d1\uff0c\u964d\u4f4e\u6839\u5bc6\u94a5\u6cc4\u9732\u98ce\u9669\uff1b\u540c\u65f6\u4e2d\u95f4 CA \u53ef\u88ab\u5feb\u901f\u540a\u9500\u8f6e\u6362\u3002<\/div>\n<\/div>\n<\/blockquote>\n<\/div>\n
    \n
    \n
    \u56db\u3001\u5e38\u89c1\u6587\u4ef6\u683c\u5f0f<\/h2>\n<\/div>\n
    \n
    X.509 \u8bc1\u4e66\u5728\u5b9e\u9645\u4f7f\u7528\u4e2d\u6709\u591a\u79cd\u5c01\u88c5\u683c\u5f0f\uff0c\u8fd9\u662f\u6700\u5bb9\u6613\u6df7\u6dc6\u7684\u90e8\u5206\uff1a<\/div>\n<\/div>\n
    \n
    \n
    \n
    \u8868\u683c<\/div>\n
    \n
    <\/div>\n
    <\/div>\n
    <\/div>\n<\/div>\n<\/div>\n
    \n
    \n
    \n
    \n\n\n\n\n\n\n\n\n
    \u683c\u5f0f<\/th>\n\u6269\u5c55\u540d<\/th>\n\u7f16\u7801<\/th>\n\u8bf4\u660e<\/th>\n<\/tr>\n<\/thead>\n
    DER<\/strong><\/td>\n.cer<\/code> .crt<\/code> .der<\/code><\/td>\n\u4e8c\u8fdb\u5236<\/td>\nASN.1 DER \u539f\u59cb\u7f16\u7801\uff0c\u5355\u5f20\u8bc1\u4e66<\/td>\n<\/tr>\n
    PEM<\/strong><\/td>\n.pem<\/code> .crt<\/code> .cer<\/code><\/td>\nBase64 \u6587\u672c<\/td>\nDER \u7684 Base64 \u7f16\u7801\uff0c\u5e26 -----BEGIN CERTIFICATE-----<\/code> \u5934\u5c3e\uff0c\u53ef\u4e32\u8054\u591a\u5f20<\/td>\n<\/tr>\n
    PKCS#7<\/strong><\/td>\n.p7b<\/code> .p7c<\/code><\/td>\n\u4e8c\u8fdb\u5236 \/ Base64<\/td>\n\u53ef\u5305\u542b\u8bc1\u4e66\u94fe\uff08\u4e0d\u542b\u79c1\u94a5\uff09\uff0cWindows \u73af\u5883\u5e38\u89c1<\/td>\n<\/tr>\n
    PKCS#12<\/strong><\/td>\n.pfx<\/code> .p12<\/code><\/td>\n\u4e8c\u8fdb\u5236<\/td>\n\u540c\u65f6\u5305\u542b\u8bc1\u4e66\u94fe\u548c\u79c1\u94a5<\/strong>\uff0c\u901a\u5e38\u6709\u5bc6\u7801\u4fdd\u62a4<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
    \n
    \u53e6\u5916\u79c1\u94a5\u683c\u5f0f\uff1a<\/div>\n<\/div>\n
    \n
      \n
    • PKCS#1<\/strong>\uff1a-----BEGIN RSA PRIVATE KEY-----<\/code>\uff0c\u4ec5 RSA<\/li>\n
    • PKCS#8<\/strong>\uff1a-----BEGIN PRIVATE KEY-----<\/code>\uff08\u660e\u6587\uff09\u6216 -----BEGIN ENCRYPTED PRIVATE KEY-----<\/code>\uff08\u52a0\u5bc6\uff09\uff0c\u901a\u7528\u683c\u5f0f\uff0c\u63a8\u8350\u4f7f\u7528<\/li>\n<\/ul>\n<\/div>\n
      \n
      \n
      \u4e94\u3001\u5e94\u7528\u573a\u666f<\/h2>\n<\/div>\n
      \n
        \n
      1. TLS\/HTTPS \u670d\u52a1\u5668\u8ba4\u8bc1<\/strong>\uff1a\u6700\u5e38\u89c1\u573a\u666f\uff0c\u670d\u52a1\u5668\u5411\u5ba2\u6237\u7aef\u8bc1\u660e\u8eab\u4efd\u3002<\/li>\n
      2. TLS \u5ba2\u6237\u7aef\u8ba4\u8bc1\uff08mTLS\uff09<\/strong>\uff1a\u53cc\u5411\u8ba4\u8bc1\uff0c\u5ba2\u6237\u7aef\u4e5f\u6301\u8bc1\u4e66\uff0c\u5e38\u7528\u4e8e API \u7f51\u5173\u3001\u96f6\u4fe1\u4efb\u67b6\u6784\u3001K8s \u5185\u90e8\u901a\u4fe1\u3002<\/li>\n
      3. \u4ee3\u7801\u7b7e\u540d<\/strong>\uff1aAuthenticode\u3001Java JAR \u7b7e\u540d\uff0c\u8bc1\u660e\u8f6f\u4ef6\u6765\u6e90\u548c\u5b8c\u6574\u6027\u3002<\/li>\n
      4. S\/MIME<\/strong>\uff1a\u7535\u5b50\u90ae\u4ef6\u52a0\u5bc6\u548c\u7b7e\u540d\u3002<\/li>\n
      5. \u6587\u6863\u7b7e\u540d<\/strong>\uff1aPDF \u6570\u5b57\u7b7e\u540d\u3002<\/li>\n
      6. \u667a\u80fd\u5361 \/ USB Key<\/strong>\uff1a\u5b58\u50a8\u8bc1\u4e66\u548c\u79c1\u94a5\uff0c\u7528\u4e8e\u8eab\u4efd\u8ba4\u8bc1\u3002<\/li>\n
      7. \u7269\u8054\u7f51\u8bbe\u5907\u8eab\u4efd<\/strong>\uff1a\u6bcf\u53f0\u8bbe\u5907\u9884\u7f6e\u552f\u4e00 X.509 \u8bc1\u4e66\uff0c\u7528\u4e8e\u8bbe\u5907\u63a5\u5165\u8ba4\u8bc1\u3002<\/li>\n<\/ol>\n<\/div>\n
        \n
        \n
        \u516d\u3001\u8bc1\u4e66\u9a8c\u8bc1\u6d41\u7a0b\uff08\u4ee5 TLS \u4e3a\u4f8b\uff09<\/h2>\n<\/div>\n
        \n
        \u5ba2\u6237\u7aef\u6536\u5230\u670d\u52a1\u5668\u8bc1\u4e66\u94fe\u540e\uff0c\u5178\u578b\u9a8c\u8bc1\u6b65\u9aa4\uff1a<\/div>\n<\/div>\n
        \n
          \n
        1. \u89e3\u6790\u8bc1\u4e66<\/strong>\uff0c\u786e\u8ba4\u683c\u5f0f\u5408\u6cd5\u3002<\/li>\n
        2. \u6709\u6548\u671f\u68c0\u67e5<\/strong>\uff1a\u5f53\u524d\u65f6\u95f4\u5728 notBefore<\/code> ~ notAfter<\/code> \u4e4b\u95f4\u3002<\/li>\n
        3. \u7b7e\u540d\u9a8c\u8bc1<\/strong>\uff1a\u7528\u4e0a\u7ea7 CA \u516c\u94a5\u9a8c\u7b7e\uff0c\u9010\u7ea7\u5230\u6839\u3002<\/li>\n
        4. \u4fe1\u4efb\u951a\u68c0\u67e5<\/strong>\uff1a\u6839\u8bc1\u4e66\u5728\u672c\u5730\u4fe1\u4efb\u5e93\u4e2d\u3002<\/li>\n
        5. \u540d\u79f0\u6821\u9a8c<\/strong>\uff1a\u8bbf\u95ee\u7684\u57df\u540d\u5339\u914d SAN\uff08\u6216 CN\uff09\u3002<\/li>\n
        6. \u7528\u9014\u68c0\u67e5<\/strong>\uff1aEKU \u5305\u542b serverAuth<\/code>\uff0cKey Usage \u5141\u8bb8\u6570\u5b57\u7b7e\u540d\u3002<\/li>\n
        7. \u540a\u9500\u72b6\u6001\u68c0\u67e5<\/strong>\uff1a\u901a\u8fc7 CRL \u6216 OCSP \u786e\u8ba4\u8bc1\u4e66\u672a\u88ab\u540a\u9500\uff08\u53ef\u9009\uff0c\u6d4f\u89c8\u5668\u7b56\u7565\u4e0d\u540c\uff09\u3002<\/li>\n
        8. \u57fa\u672c\u7ea6\u675f\u68c0\u67e5<\/strong>\uff1a\u4e2d\u95f4\u8bc1\u4e66\u5fc5\u987b CA:TRUE<\/code>\uff0cLeaf \u5fc5\u987b CA:FALSE<\/code>\u3002<\/li>\n<\/ol>\n<\/div>\n
          \n
          \n
          \u4e03\u3001\u5e38\u7528 OpenSSL \u547d\u4ee4<\/h2>\n<\/div>\n
          \n
          \n
          \n
          \n
          \n
          \n
          bash<\/div>\n
          <\/div>\n<\/div>\n
          \n
          <\/div>\n
          \n
          # \u67e5\u770b\u8bc1\u4e66\u5185\u5bb9\uff08\u6587\u672c\u5f62\u5f0f\uff09\r\nopenssl x509 -in cert.pem -text -noout\r\n\r\n# \u67e5\u770b\u8bc1\u4e66\u7684 SAN \u548c\u6709\u6548\u671f\r\nopenssl x509 -in cert.pem -noout -ext subjectAltName -dates\r\n\r\n# DER \u8f6c PEM\r\nopenssl x509 -inform DER -in cert.cer -out cert.pem\r\n\r\n# PEM \u8f6c DER\r\nopenssl x509 -outform DER -in cert.pem -out cert.cer\r\n\r\n# \u4ece PFX \u63d0\u53d6\u8bc1\u4e66\uff08\u4e0d\u542b\u79c1\u94a5\uff09\r\nopenssl pkcs12 -in cert.pfx -clcerts -nokeys -out cert.pem\r\n\r\n# \u4ece PFX \u63d0\u53d6\u79c1\u94a5\uff08PKCS#8 \u52a0\u5bc6\u683c\u5f0f\uff09\r\nopenssl pkcs12 -in cert.pfx -nocerts -out key.pem\r\n\r\n# \u9a8c\u8bc1\u8bc1\u4e66\u94fe\r\nopenssl verify -CAfile chain.pem cert.pem\r\n\r\n# \u8fde\u63a5\u8fdc\u7a0b\u670d\u52a1\u5668\u67e5\u770b\u8bc1\u4e66\u94fe\r\nopenssl s_client -connect example.com:443 -showcerts\r\n\r\n# \u751f\u6210\u81ea\u7b7e\u540d\u8bc1\u4e66\uff08RSA 2048\uff0c\u6709\u6548\u671f 365 \u5929\uff09\r\nopenssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem \\\r\n  -days 365 -nodes -subj \"\/CN=localhost\" \\\r\n  -addext \"subjectAltName=DNS:localhost,IP:127.0.0.1\"\r\n\r\n# \u751f\u6210 ECDSA \u81ea\u7b7e\u540d\u8bc1\u4e66\uff08\u66f4\u8f7b\u91cf\uff09\r\nopenssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 \\\r\n  -keyout key.pem -out cert.pem -days 365 -nodes \\\r\n  -subj \"\/CN=localhost\"<\/pre>\n
           <\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
          \n
          <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
          \n
          \n
          \u516b\u3001\u51e0\u4e2a\u5bb9\u6613\u8e29\u7684\u5751<\/h2>\n<\/div>\n
          \n
            \n
          1. CN \u5df2\u88ab SAN \u53d6\u4ee3<\/strong>\uff1a\u73b0\u4ee3\u6d4f\u89c8\u5668\uff08Chrome 58+\uff09\u53ea\u770b SAN\uff0c\u4e0d\u770b CN\u3002\u7b7e\u53d1\u8bc1\u4e66\u5fc5\u987b\u5e26 SAN\u3002<\/li>\n
          2. \u8bc1\u4e66\u94fe\u987a\u5e8f<\/strong>\uff1aTLS \u63e1\u624b\u65f6\u670d\u52a1\u5668\u5e94\u53d1\u9001 Leaf \u2192 Intermediate \u2192 ...<\/code>\uff0c\u4e0d\u5305\u542b\u6839\u8bc1\u4e66<\/strong>\u3002\u987a\u5e8f\u9519\u8bef\u4f1a\u5bfc\u81f4\u90e8\u5206\u5ba2\u6237\u7aef\u9a8c\u8bc1\u5931\u8d25\u3002<\/li>\n
          3. PKCS#12 \u5bc6\u7801<\/strong>\uff1a\u7a7a\u5bc6\u7801\u5728\u67d0\u4e9b\u7cfb\u7edf\uff08\u5982 macOS\uff09\u4e0a\u4f1a\u5bfc\u5165\u5931\u8d25\u3002<\/li>\n
          4. \u4e2d\u95f4\u8bc1\u4e66\u7f3a\u5931<\/strong>\uff1a\u670d\u52a1\u5668\u53ea\u53d1 Leaf \u4e0d\u53d1 Intermediate\uff0c\u79fb\u52a8\u7aef \/ \u65e7\u6d4f\u89c8\u5668\u53ef\u80fd\u56e0\u6ca1\u6709\u7f13\u5b58\u4e2d\u95f4\u8bc1\u4e66\u800c\u9a8c\u8bc1\u5931\u8d25\u3002<\/li>\n
          5. Key Usage \u4e0d\u5339\u914d<\/strong>\uff1a\u8bc1\u4e66\u7528\u9014\u9519\u8bef\uff08\u5982\u7528 CA \u8bc1\u4e66\u5f53\u670d\u52a1\u5668\u8bc1\u4e66\uff09\u4f1a\u88ab\u4e25\u683c\u5ba2\u6237\u7aef\u62d2\u7edd\u3002<\/li>\n
          6. \u65f6\u95f4\u654f\u611f<\/strong>\uff1a\u8bc1\u4e66\u9a8c\u8bc1\u4f9d\u8d56\u7cfb\u7edf\u65f6\u949f\uff0c\u65f6\u949f\u504f\u5dee\u8fc7\u5927\u4f1a\u5bfc\u81f4\u9a8c\u8bc1\u5931\u8d25\u3002<\/li>\n<\/ol>\n<\/div>\n
            \n
            \n
            \u9700\u8981\u6211\u6df1\u5165\u67d0\u4e2a\u65b9\u5411\u5417\uff1f\u6bd4\u5982 \u8bc1\u4e66\u540a\u9500\u673a\u5236\uff08CRL vs OCSP vs OCSP Stapling\uff09<\/strong>\u3001mTLS \u5728 K8s \/ \u670d\u52a1\u7f51\u683c\u4e2d\u7684\u5b9e\u8df5<\/strong>\u3001\u6216\u8005 \u4ece\u96f6\u642d\u5efa\u4e00\u4e2a\u79c1\u6709 CA \u7684\u5b8c\u6574\u6d41\u7a0b<\/strong>\u3002<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
            \u4e00\u3001\u662f\u4ec0\u4e48 X.509 \u662f ITU-T <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[24],"tags":[],"class_list":["post-7675","post","type-post","status-publish","format-standard","hentry","category-value_docs"],"_links":{"self":[{"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/posts\/7675","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/comments?post=7675"}],"version-history":[{"count":1,"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/posts\/7675\/revisions"}],"predecessor-version":[{"id":7676,"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/posts\/7675\/revisions\/7676"}],"wp:attachment":[{"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/media?parent=7675"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/categories?post=7675"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/tags?post=7675"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}