PKI 使用场景：HTTPS、S/MIME 与代码签名

PKI 在实际应用中的场景

HTTPS：用于网站安全的 PKI

# Check HTTPS certificate details
curl -v https://example.com 2>&1 | grep -A 10 'SSL certificate'

# Test TLS configuration quality
openssl s_client -connect example.com:443 -tls1_3 2>/dev/null | \
  grep -E 'Protocol|Cipher|Verify'
# Protocol: TLSv1.3
# Cipher: TLS_AES_256_GCM_SHA384
# Verify return code: 0 (ok)

S/MIME：用于电子邮件安全的 PKI

# S/MIME email signing and encryption with OpenSSL
# Sign an email
openssl smime -sign -in email_body.txt -signer alice_cert.pem \
  -inkey alice_private.key -out signed_email.eml -outform PEM

# Encrypt an email (using Bob's public key/certificate)
openssl smime -encrypt -aes256 -in email_body.txt \
  -out encrypted_email.eml bob_cert.pem

# Bob decrypts with his private key
openssl smime -decrypt -in encrypted_email.eml \
  -recip bob_cert.pem -inkey bob_private.key

代码签名：用于软件完整性的 PKI

# Verify code signing on Windows (PowerShell)
Get-AuthenticodeSignature -FilePath 'C:\Software\installer.exe' | Format-List
# Status: Valid
# SignerCertificate: [certificate details]
# TimeStamperCertificate: [timestamp CA details]

# On Linux/macOS, verify GPG signature of downloaded software
gpg --verify hashicorp_public.gpg terraform.zip.sig terraform.zip
# Good signature from 'HashiCorp Security (hashicorp.com/security)'

客户端证书身份验证

# nginx configuration for mutual TLS (client certificate required)
# server {
#   listen 443 ssl;
#   ssl_certificate /path/to/server_cert.pem;
#   ssl_certificate_key /path/to/server_key.pem;
#   ssl_client_certificate /path/to/ca_cert.pem;
#   ssl_verify_client on;
#   ssl_verify_depth 2;
# }

# Test with a client certificate
curl --cert client_cert.pem --key client_key.pem https://api.example.com/

SSH 主机密钥验证

# First-time SSH connection stores server host key
ssh user@server.example.com
# The authenticity of host 'server.example.com' can't be established.
# ED25519 key fingerprint is SHA256:abc123...
# Are you sure you want to continue connecting (yes/no/[fingerprint])? yes

# Host key stored in: ~/.ssh/known_hosts
cat ~/.ssh/known_hosts | grep server.example.com

# If host key changes: 
# WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!

文档签名与时间戳

物联网设备证书

使用证书进行 VPN 身份验证

# OpenVPN client certificate configuration
# client
# remote vpn.example.com 1194
# proto udp
# ca ca.crt        <- CA certificate (trust anchor)
# cert client.crt  <- Client's certificate
# key client.key   <- Client's private key
# tls-auth ta.key 1
# cipher AES-256-GCM

# The VPN server verifies the client cert chain against ca.crt
# Revoked certs listed in CRL won't be accepted

常见的证书相关错误

# Diagnose certificate errors with openssl
openssl s_client -connect server.example.com:443 2>&1
# Common error messages:
# depth=0 ... error 10 at 0 depth lookup: certificate has expired
# depth=0 ... error 18: self-signed certificate
# depth=0 ... error 20: unable to get local issuer certificate (broken chain)
# depth=0 ... error 23: certificate revoked
# Verify return code: 0 (ok) = success

通配符证书与 SAN 证书

快速检查

课程回顾