1

我希望如果我有一个 X509 证书作为内存中的对象，将其保存为 pem 文件，然后将其重新加载，我最终会得到与我开始时相同的证书。然而，情况似乎并非如此。我们将原始证书称为 A，从 pem 文件加载的证书 BAas_text() 与 B.as_text() 相同，但 A.as_pem() 与 B.as_pem() 不同。至少可以说，我对此感到困惑。作为旁注，如果 A 已由另一个实体 C 签名，则 A 将根据 C 的证书进行验证，但 B 不会。

我已经整理了一个小示例程序来演示我所看到的。当我运行它时，会引发第二个 RuntimeError。

谢谢，
布洛克

#!/usr/bin/python2.6

import M2Crypto as m2
import time

cur_time = m2.ASN1.ASN1_UTCTIME()
cur_time.set_time(int(time.time()) - 60*60*24)

expire_time = m2.ASN1.ASN1_UTCTIME()
# Expire certs in 1 hour.
expire_time.set_time(int(time.time()) + 60 * 60 * 24)


cs_rsa = m2.RSA.gen_key(1024, 65537, lambda: None)
cs_pk = m2.EVP.PKey()
cs_pk.assign_rsa(cs_rsa)
cs_cert = m2.X509.X509()

# These two seem the minimum necessary to make the as_text function call work
# at all
cs_cert.set_not_before(cur_time)
cs_cert.set_not_after(expire_time)

# This seems necessary to fill out the complete cert without errors.
cs_cert.set_pubkey(cs_pk)

# I've tried with the following set lines commented out and not commented.
cs_name = m2.X509.X509_Name()
cs_name.C = "US"
cs_name.ST = "CA"
cs_name.OU = "Fake Org CA 1"
cs_name.CN = "www.fakeorg.dex"
cs_name.Email = "cs1@www.fakeorg.dex"
cs_cert.set_subject(cs_name)
cs_cert.set_issuer_name(cs_name)
cs_cert.sign(cs_pk, md="sha256")

orig_text = cs_cert.as_text()
orig_pem = cs_cert.as_pem()

print "orig_text:\n%s" % orig_text

cs_cert.save_pem("/tmp/foo")

tcs = m2.X509.load_cert("/tmp/foo")

tcs_text = tcs.as_text()
tcs_pem = tcs.as_pem()

if orig_text != tcs_text:
        raise RuntimeError(
            "Texts were different.\nOrig:\n%s\nAfter load:\n%s" %
            (orig_text, tcs_text))

if orig_pem != tcs_pem:
        raise RuntimeError(
            "Pems were different.\nOrig:\n%s\nAfter load:\n%s" %
            (orig_pem, tcs_pem))
4

1 回答 1

1

If you try this with a cert that you created with OpenSSL command line tools (for example, the server.pem in tests directory sans the key and text) by loading and saving it with M2Crypto, you should get identical files.

I thought SimpleX509Create.py in the contrib directory worked differently, but I tested it and I experience the same issue you found. Apparently there is some step we are missing that OpenSSL command line tools do.

于 2010-04-28T05:09:41.930 回答