![使用 openssl 连接到 google 服务器但无法获取本地颁发者证书。为什么?](https://linux22.com/image/1624633/%E4%BD%BF%E7%94%A8%20openssl%20%E8%BF%9E%E6%8E%A5%E5%88%B0%20google%20%E6%9C%8D%E5%8A%A1%E5%99%A8%E4%BD%86%E6%97%A0%E6%B3%95%E8%8E%B7%E5%8F%96%E6%9C%AC%E5%9C%B0%E9%A2%81%E5%8F%91%E8%80%85%E8%AF%81%E4%B9%A6%E3%80%82%E4%B8%BA%E4%BB%80%E4%B9%88%EF%BC%9F.png)
尝试连接到imap.google.com:993和openssl。
1)从以下网站下载编码的DER格式的CAfilehttps://pki.goog/. 该文件名为GTS 根 R1
2)将此文件转换为PEM格式
openssl x509 -inform der -in GTSR1.crt -out googleRootCA.pem
3)连接到 imap.gmail.com:993 并使用此 googleRootCA.pem 文件
openssl.exe s_client -connect imap.gmail.com:993 -CAfile ./googleRootCA.pem
但是 openssl 报告: 验证返回代码:20(无法获取本地颁发者证书)
为什么?这是来自谷歌的官方根 CA,所以它应该可以工作?!操作系统:Windows 10
答案1
它是来自谷歌的官方根 CA,所以它应该可以工作吧?!
它是一个官方的谷歌根,但它不是正确的一。
看着全部输出自openssl s_client
:
openssl s_client -connect imap.gmail.com:993 -CAfile GTSR1.pem
CONNECTED(00000094)
depth=1 C = US, O = Google Trust Services, CN = GTS CA 1O1
verify error:num=20:unable to get local issuer certificate
---
Certificate chain
0 s:/C=US/ST=California/L=Mountain View/O=Google LLC/CN=imap.gmail.com
i:/C=US/O=Google Trust Services/CN=GTS CA 1O1
1 s:/C=US/O=Google Trust Services/CN=GTS CA 1O1
i:/OU=GlobalSign Root CA - R2/O=GlobalSign/CN=GlobalSign
---
Server certificate
[snipped -- irrelevant]
---
No client certificate CA names sent
Peer signing digest: SHA256
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 3216 bytes and written 261 bytes
Verification error: unable to get local issuer certificate
---
New, TLSv1.2, Cipher is ECDHE-RSA-CHACHA20-POLY1305
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
[snipped except]
Verify return code: 20 (unable to get local issuer certificate)
---
请注意,中间证书(链显示中编号为 1)的颁发者为(i:
)
/OU=GlobalSign Root CA - R2/O=GlobalSign/CN=GlobalSign
这是网页中标记为“GS Root R2”(不是 GTS)的根目录,链接在这里,并使用转换为 PEM 的文件:
openssl s_client -connect imap.gmail.com:993 -CAfile GSR2.pem -quiet
depth=2 OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
verify return:1
depth=1 C = US, O = Google Trust Services, CN = GTS CA 1O1
verify return:1
depth=0 C = US, ST = California, L = Mountain View, O = Google LLC, CN = imap.gmail.com
verify return:1
* OK Gimap ready for requests from [redacted]
此外,openssl错误告诉你中间的使用的 (又名下属) CA 是 GTS CA 1O1,并且同一网页显示 GTS CA 1O1 位于 GS Root 2 下,而不是 GTS Root 1。