google-chrome - 是什么导致 Chrome “不符合安全标准。”

Question

对于 HTTPS 可访问服务的本地测试，我正在使用以下程序生成自己的密钥和证书。毫无疑问，该程序构建的证书在各种方面都不符合现实世界证书的最佳实践。但是，导致 Chrome 以这种“不符合安全标准”的错误拒绝它们的特定问题让我无法理解。

Chrome 报告的完整（较少域）错误是：

生成证书、密钥等的程序是：

#!/usr/bin/env python

from __future__ import unicode_literals, print_function

from string import uppercase
from datetime import datetime, timedelta

from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.x509.oid import NameOID
from cryptography.hazmat.primitives.hashes import SHA256
from cryptography.hazmat.primitives import serialization
from cryptography.x509 import (
    CertificateBuilder,
    SubjectAlternativeName,
    BasicConstraints,
    DNSName,
    Name,
    NameAttribute,
)
from cryptography.hazmat.backends import default_backend

def cert(issuer, subject, issuer_key, subject_key, ca):
    builder = CertificateBuilder(
    ).issuer_name(
        Name([NameAttribute(NameOID.COMMON_NAME, issuer)]),
    ).subject_name(
        Name([NameAttribute(NameOID.COMMON_NAME, subject)]),
    ).add_extension(
        SubjectAlternativeName([DNSName(subject)]),
        critical=False,
    )
    if ca:
        builder = builder.add_extension(
            BasicConstraints(True, None),
            critical=True,
        )
    return builder.public_key(subject_key.public_key(),
    ).serial_number(1,
    ).not_valid_before(datetime.utcnow(),
    ).not_valid_after(datetime.utcnow() + timedelta(days=365),
    ).sign(issuer_key, SHA256(), default_backend(),
    )

def main(num_certs, subject_name):
    keys = tuple(
        rsa.generate_private_key(
            public_exponent=65537,
            key_size=1024,
            backend=default_backend(),
        )
        for i in range(num_certs)
    )

    names = list(
        ch + ".invalid"
        for ch
        in uppercase.decode("ascii")[:len(keys) - 1]
    ) + [subject_name]

    certs = tuple(
        cert(
            issuer=issuer_name,
            subject=subject_name,
            issuer_key=issuer_key,
            subject_key=subject_key,
            ca=is_ca,
        )
        for (issuer_name, subject_name, issuer_key, subject_key, is_ca)
        in zip(
            names[:1] + names[:-1],
            names,
            keys[:1] + keys[:-1],
            keys,
            range(len(keys) - 1, -1, -1),
        )
    )

    print("\n".join(
        key.private_bytes(
            encoding=serialization.Encoding.PEM,
            format=serialization.PrivateFormat.TraditionalOpenSSL,
            encryption_algorithm=serialization.NoEncryption(),
        for key
        in keys
    ))

    print("\n".join(
        cert.public_bytes(serialization.Encoding.PEM)
        for cert
        in certs
    ))

main(3, "<some domain name>")

该程序吐出密钥，然后是证书。在链长度为 3 的默认设置下，有一个 CA 密钥/证书、一个中间密钥/证书和一个服务器密钥/证书。

这是它的输出示例：

score 2 · Accepted Answer

所有这三个证书都具有完全相同的序列号 (0x59544282)。Chrome 不喜欢这样——您需要为您的 CA 签署的每个证书使用唯一的序列号。

google-chrome - 是什么导致 Chrome “不符合安全标准。”

1 回答 1

Related

Reference