gmssl使用雙證書雙向認證的gmtl協議報錯crypto/sm2/sm2_sign.c 510: sm2_do_verifySSL3 alert write:fatal:decrypt error

報錯內容

crypto/sm2/sm2_sign.c 510: sm2_do_verify
SSL3 alert write:fatal:decrypt error
SSL_accept:error in error
ERROR
140655864152064:error:1417B07B:SSL routines:tls_process_cert_verify:bad signature:ssl/statem/statem_srvr.c:2941:

相關內容

  • 版本：GmSSL 2.5.4 - OpenSSL 1.1.0d ?19 Jun 2019?
  • 工作路徑：/home/chy-cpabe/GMSSL_certificate/sm2Certs?
  • 證書：根據江南天安的自動化腳本生成的根證書、服務端和客戶端的私鑰、簽名和加密證書，共9個文件

服務端

  • 執行命令
  • gmssl s_server -gmtls -accept 44330 -key SS.key.pem -cert SS.cert.pem ?-dkey SE.key.pem -dcert SE.cert.pem -CAfile CA.cert.pem -state -verify 1
  • -gmtls? ? 協議類型
  • -accept? 監聽端口
  • -key? ? ? ?簽名私鑰
  • -cert? ? ? ?簽名證書
  • -dkey? ? ? 加密私鑰
  • -dcert? ? ? 加密證書
  • -CAfile? ? CA證書路徑
  • -state? ? ?狀態信息
  • -verify? ? ?開啟國密雙證書雙向認證
  • 1? ? ? ? ? ? ?驗證深度，分析源碼可知，這個數只是接收并輸出，并無關鍵性影響
chy-cpabe@ubuntu:~/GMSSL_certificate/sm2Certs$ gmssl s_server -gmtls -accept 44330 -key SS.key.pem -cert SS.cert.pem  -dkey SE.key.pem -dcert SE.cert.pem -CAfile CA.cert.pem -state -verify 1
verify depth is 1
Using default temp DH parameters
[GMTLS_DEBUG] set sm2 signing certificate
[GMTLS_DEBUG] set sm2 signing private key
[GMTLS_DEBUG] set sm2 encryption certificate
[GMTLS_DEBUG] set sm2 decryption private key
ACCEPT
SSL_accept:before SSL initialization
SSL_accept:before SSL initialization
SSL_accept:SSLv3/TLS read client hello
SSL_accept:SSLv3/TLS write server hello
SSL_accept:SSLv3/TLS write certificate
SSL_accept:SSLv3/TLS write key exchange
SSL_accept:SSLv3/TLS write certificate request
SSL_accept:SSLv3/TLS write server done
SSL_accept:SSLv3/TLS write server done
depth=1 C = CN, ST = BJ, L = HaiDian, O = Beijing JNTA Technology LTD., OU = SORB of TASS, CN = Test CA (SM2)
verify return:1
depth=0 C = CN, ST = BJ, L = HaiDian, O = Beijing JNTA Technology LTD., OU = BSRC of TASS, CN = client sign (SM2)
verify return:1
SSL_accept:SSLv3/TLS read client certificate
ssl_get_algorithm2=fe8b700008x
SSL_accept:SSLv3/TLS read client key exchange
crypto/sm2/sm2_sign.c 510: sm2_do_verify
SSL3 alert write:fatal:decrypt error
SSL_accept:error in error
ERROR
140655864152064:error:1417B07B:SSL routines:tls_process_cert_verify:bad signature:ssl/statem/statem_srvr.c:2941:
shutting down SSL
CONNECTION CLOSED
ACCEPT

客戶端

  • gmssl s_client -connect localhost:44330 -key CS.key.pem -cert CS.cert.pem -dkey CE.key.pem -dcert CE.cert.pem -CAfile CA.cert.pem -gmtls -showcerts
  • -connect? ?對應服務端的IP地址
  • :44330? ? ? 端口號
  • -showcerts 打印證書信息
chy-cpabe@ubuntu:~/GMSSL_certificate/sm2Certs$ gmssl s_client -connect localhost:44330 -key CS.key.pem -cert CS.cert.pem -dkey CE.key.pem -dcert CE.cert.pem -CAfile CA.cert.pem -gmtls -showcerts
[GMTLS_DEBUG] set sm2 signing certificate
[GMTLS_DEBUG] set sm2 signing private key
[GMTLS_DEBUG] set sm2 encryption certificate
[GMTLS_DEBUG] set sm2 decryption private key
CONNECTED(00000003)
depth=1 C = CN, ST = BJ, L = HaiDian, O = Beijing JNTA Technology LTD., OU = SORB of TASS, CN = Test CA (SM2)
verify return:1
depth=0 C = CN, ST = BJ, L = HaiDian, O = Beijing JNTA Technology LTD., OU = BSRC of TASS, CN = server sign (SM2)
verify return:1
Z=BCDCCB61AADD790C076DAC60ED09DDD5285A906A4025DD748DA2FB5816464C58
C=00021E3082021A308201C0A0030201020209008563C7E770648765300A06082A811CCF55018375308182310B300906035504061302434E310B300906035504080C02424A3110300E06035504070C074861694469616E31253023060355040A0C1C4265696A696E67204A4E544120546563686E6F6C6F6779204C54442E31153013060355040B0C0C534F5242206F6620544153533116301406035504030C0D546573742043412028534D3229301E170D3230303632303130313832365A170D3234303732393130313832365A308185310B300906035504061302434E310B300906035504080C02424A3110300E06035504070C074861694469616E31253023060355040A0C1C4265696A696E67204A4E544120546563686E6F6C6F6779204C54442E31153013060355040B0C0C42535243206F6620544153533119301706035504030C1073657276657220656E632028534D32293059301306072A8648CE3D020106082A811CCF5501822D03420004B999853302F02CC522CC4CCA287019E86B901FC24E3CCF9A61B93BB177B28C2CE8E23C5C522DF73C23F7AC36FF688CB2E685A3FA4770103F7C99EFC32D06C11FA31A301830090603551D1304023000300B0603551D0F040403020338300A06082A811CCF550183750348003045022100EC4368F400870BED441817AF4D359BDC61A9EDFDDEE54AB0C185084B450C46B902206E0C3A08BC584590046DC85603CD4E8A51F97D9669B1ACA3E2A3627BE61D49A2
ssl_get_algorithm2=e678500008x
140024100052992:error:1409441B:SSL routines:ssl3_read_bytes:tlsv1 alert decrypt error:ssl/record/rec_layer_s3.c:1385:SSL alert number 51
---
Certificate chain0 s:/C=CN/ST=BJ/L=HaiDian/O=Beijing JNTA Technology LTD./OU=BSRC of TASS/CN=server sign (SM2)i:/C=CN/ST=BJ/L=HaiDian/O=Beijing JNTA Technology LTD./OU=SORB of TASS/CN=Test CA (SM2)
-----BEGIN CERTIFICATE-----
MIICGjCCAcGgAwIBAgIJAIVjx+dwZIdkMAoGCCqBHM9VAYN1MIGCMQswCQYDVQQG
EwJDTjELMAkGA1UECAwCQkoxEDAOBgNVBAcMB0hhaURpYW4xJTAjBgNVBAoMHEJl
aWppbmcgSk5UQSBUZWNobm9sb2d5IExURC4xFTATBgNVBAsMDFNPUkIgb2YgVEFT
UzEWMBQGA1UEAwwNVGVzdCBDQSAoU00yKTAeFw0yMDA2MjAxMDE4MjVaFw0yNDA3
MjkxMDE4MjVaMIGGMQswCQYDVQQGEwJDTjELMAkGA1UECAwCQkoxEDAOBgNVBAcM
B0hhaURpYW4xJTAjBgNVBAoMHEJlaWppbmcgSk5UQSBUZWNobm9sb2d5IExURC4x
FTATBgNVBAsMDEJTUkMgb2YgVEFTUzEaMBgGA1UEAwwRc2VydmVyIHNpZ24gKFNN
MikwWTATBgcqhkjOPQIBBggqgRzPVQGCLQNCAAS0lHzt7CkOzCtyf6VwCqoT2PYD
CL/AJrCsHa+6lE8wDZ7DShI2bvfmrpavndEW67CHQOlO0q6/aoEB0PoAgpopoxow
GDAJBgNVHRMEAjAAMAsGA1UdDwQEAwIGwDAKBggqgRzPVQGDdQNHADBEAiB06JWp
uxFbGBfvG9juhe2Umu/auI1H2XeMdvDjbOtfuQIgMXT8jewkzq9TR3OPzRTkZCRH
3H+xKEb8r8JsEEStwaU=
-----END CERTIFICATE-----1 s:/C=CN/ST=BJ/L=HaiDian/O=Beijing JNTA Technology LTD./OU=BSRC of TASS/CN=server enc (SM2)i:/C=CN/ST=BJ/L=HaiDian/O=Beijing JNTA Technology LTD./OU=SORB of TASS/CN=Test CA (SM2)
-----BEGIN CERTIFICATE-----
MIICGjCCAcCgAwIBAgIJAIVjx+dwZIdlMAoGCCqBHM9VAYN1MIGCMQswCQYDVQQG
EwJDTjELMAkGA1UECAwCQkoxEDAOBgNVBAcMB0hhaURpYW4xJTAjBgNVBAoMHEJl
aWppbmcgSk5UQSBUZWNobm9sb2d5IExURC4xFTATBgNVBAsMDFNPUkIgb2YgVEFT
UzEWMBQGA1UEAwwNVGVzdCBDQSAoU00yKTAeFw0yMDA2MjAxMDE4MjZaFw0yNDA3
MjkxMDE4MjZaMIGFMQswCQYDVQQGEwJDTjELMAkGA1UECAwCQkoxEDAOBgNVBAcM
B0hhaURpYW4xJTAjBgNVBAoMHEJlaWppbmcgSk5UQSBUZWNobm9sb2d5IExURC4x
FTATBgNVBAsMDEJTUkMgb2YgVEFTUzEZMBcGA1UEAwwQc2VydmVyIGVuYyAoU00y
KTBZMBMGByqGSM49AgEGCCqBHM9VAYItA0IABLmZhTMC8CzFIsxMyihwGehrkB/C
TjzPmmG5O7F3sows6OI8XFIt9zwj96w2/2iMsuaFo/pHcBA/fJnvwy0GwR+jGjAY
MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgM4MAoGCCqBHM9VAYN1A0gAMEUCIQDsQ2j0
AIcL7UQYF69NNZvcYant/d7lSrDBhQhLRQxGuQIgbgw6CLxYRZAEbchWA81OilH5
fZZpsayj4qNie+YdSaI=
-----END CERTIFICATE-----2 s:/C=CN/ST=BJ/L=HaiDian/O=Beijing JNTA Technology LTD./OU=SORB of TASS/CN=Test CA (SM2)i:/C=CN/ST=BJ/L=HaiDian/O=Beijing JNTA Technology LTD./OU=SORB of TASS/CN=Test CA (SM2)
-----BEGIN CERTIFICATE-----
MIICWjCCAgCgAwIBAgIJAP5W2mLaOWq5MAoGCCqBHM9VAYN1MIGCMQswCQYDVQQG
EwJDTjELMAkGA1UECAwCQkoxEDAOBgNVBAcMB0hhaURpYW4xJTAjBgNVBAoMHEJl
aWppbmcgSk5UQSBUZWNobm9sb2d5IExURC4xFTATBgNVBAsMDFNPUkIgb2YgVEFT
UzEWMBQGA1UEAwwNVGVzdCBDQSAoU00yKTAeFw0yMDA2MjAxMDE4MjVaFw0yNDA3
MjkxMDE4MjVaMIGCMQswCQYDVQQGEwJDTjELMAkGA1UECAwCQkoxEDAOBgNVBAcM
B0hhaURpYW4xJTAjBgNVBAoMHEJlaWppbmcgSk5UQSBUZWNobm9sb2d5IExURC4x
FTATBgNVBAsMDFNPUkIgb2YgVEFTUzEWMBQGA1UEAwwNVGVzdCBDQSAoU00yKTBZ
MBMGByqGSM49AgEGCCqBHM9VAYItA0IABArjN7ag+H8D12eqXJpMeTOR9m3sB2RC
ojH7fZPB77SDfHZb9g1lcqUhrug0nw2F8wBMsLfjvsK3wQn/ryi3YvSjXTBbMB0G
A1UdDgQWBBRCcBGiEpd09qSpUlkiGkZ+q+CFbDAfBgNVHSMEGDAWgBRCcBGiEpd0
9qSpUlkiGkZ+q+CFbDAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBBjAKBggqgRzP
VQGDdQNIADBFAiBjdylWVsUoTRcHu9DoMHv4lgtYJMf2xHAGLoJUjmbizAIhAOFD
i3EmFVUgGVdgbnztFZcBLxtBzIAh/Q4Q3dm3/MFu
-----END CERTIFICATE-----
---
Server certificate
subject=/C=CN/ST=BJ/L=HaiDian/O=Beijing JNTA Technology LTD./OU=BSRC of TASS/CN=server sign (SM2)
issuer=/C=CN/ST=BJ/L=HaiDian/O=Beijing JNTA Technology LTD./OU=SORB of TASS/CN=Test CA (SM2)
---
Acceptable client certificate CA names
/C=CN/ST=BJ/L=HaiDian/O=Beijing JNTA Technology LTD./OU=SORB of TASS/CN=Test CA (SM2)
Client Certificate Types: RSA sign, DSA sign
---
SSL handshake has read 2036 bytes and written 2116 bytes
Verification: OK
---
New, GMTLSv1.1, Cipher is SM2-WITH-SMS4-SM3
Server public key is 256 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:Protocol  : GMTLSv1.1Cipher    : SM2-WITH-SMS4-SM3Session-ID: E16755CE6A883D7046C7B0F3B8A01868FBD2E5B758CF014F137C5FE3249A741ESession-ID-ctx: Master-Key: 7AED44218C8CD96DA572A25767CAAB92CFCF34AFA61D08CA5FB9899134568788CAF38F31BE32C6ECB777A2A96597376BPSK identity: NonePSK identity hint: NoneSRP username: NoneStart Time: 1663992362Timeout   : 7200 (sec)Verify return code: 0 (ok)Extended master secret: no
---

?報錯原因

  • tls_construct_client_verify方法中，pkey = s->cert->key->privatekey，而在使用SM2雙證時s->cert->key不指向&s->cert->pkeys[SSL_PKEY_SM2]而是指向&s->cert->pkeys[SSL_PKEY_SM2_ENC]，導致簽名密鑰與服務端驗簽時使用的公鑰不匹配
  • 追查源代碼 ：
  • ? ? [-] GmSSL-master\ssl\statem\statem_clnt.c? 的??tls_construct_client_verify 函數

解決措施

  • 在?tls_construct_client_verify 的 p = ssl_handshake_start(s); 和?pkey = s->cert->key->privatekey; 之間 添加如下代碼
/* 這是新添加的 */
#ifndef OPENSSL_NO_GMTLS
if (SSL_IS_GMTLS(s) && s->cert->pkeys[SSL_PKEY_SM2].privatekey)
pkey = s->cert->pkeys[SSL_PKEY_SM2].privatekey;
else
#endif
/* 新添加的結束 */
  • 最后的結構（代碼不全）?
int tls_construct_client_verify(SSL *s)
{unsigned char *p;EVP_PKEY *pkey;const EVP_MD *md = s->s3->tmp.md[s->cert->key - s->cert->pkeys];EVP_MD_CTX *mctx;unsigned u = 0;unsigned long n = 0;long hdatalen = 0;void *hdata;mctx = EVP_MD_CTX_new();if (mctx == NULL) {SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_VERIFY, ERR_R_MALLOC_FAILURE);goto err;}p = ssl_handshake_start(s);/* 這是新添加的 */
#ifndef OPENSSL_NO_GMTLS
if (SSL_IS_GMTLS(s) && s->cert->pkeys[SSL_PKEY_SM2].privatekey)
pkey = s->cert->pkeys[SSL_PKEY_SM2].privatekey;
else
#endif
/* 新添加的結束 */pkey = s->cert->key->privatekey;
  • 重新編譯gmssl
    • 命令
    • sudo??./config --prefix=/usr/local/gmssl --openssldir=/usr/local/gmssl
    • sudo make
    • sudo make install
    • 配置 /etc/profile
    • 激活 source /etc/profile
    • 驗證 gmssl version
  • 參考鏈接：
  • Ubuntu配置gmssl和openssl，且均使用動態庫，使用時根據需要進行動態切換_MY CUP OF TEA的博客-CSDN博客?
  • Ubuntu安裝GmSSL庫適用于ubuntu18和ubuntu20版本_MY CUP OF TEA的博客-CSDN博客_gmssl安裝

成果演示

服務端

  • gmssl s_server -gmtls -accept 44330 -key SS.key.pem -cert SS.cert.pem ?-dkey SE.key.pem -dcert SE.cert.pem -CAfile CA.cert.pem -state -verify 1
chy-cpabe@ubuntu:~/GMSSL_certificate/sm2Certs$ gmssl s_server -gmtls -accept 44330 -key SS.key.pem -cert SS.cert.pem  -dkey SE.key.pem -dcert SE.cert.pem -CAfile CA.cert.pem -state -verify 1
verify depth is 1
Using default temp DH parameters
[GMTLS_DEBUG] set sm2 signing certificate
[GMTLS_DEBUG] set sm2 signing private key
[GMTLS_DEBUG] set sm2 encryption certificate
[GMTLS_DEBUG] set sm2 decryption private key
ACCEPT
SSL_accept:before SSL initialization
SSL_accept:before SSL initialization
SSL_accept:SSLv3/TLS read client hello
SSL_accept:SSLv3/TLS write server hello
SSL_accept:SSLv3/TLS write certificate
SSL_accept:SSLv3/TLS write key exchange
SSL_accept:SSLv3/TLS write certificate request
SSL_accept:SSLv3/TLS write server done
SSL_accept:SSLv3/TLS write server done
depth=1 C = CN, ST = BJ, L = HaiDian, O = Beijing JNTA Technology LTD., OU = SORB of TASS, CN = Test CA (SM2)
verify return:1
depth=0 C = CN, ST = BJ, L = HaiDian, O = Beijing JNTA Technology LTD., OU = BSRC of TASS, CN = client sign (SM2)
verify return:1
SSL_accept:SSLv3/TLS read client certificate
ssl_get_algorithm2=10f9400008x
SSL_accept:SSLv3/TLS read client key exchange
SSL_accept:SSLv3/TLS read certificate verify
SSL_accept:SSLv3/TLS read change cipher spec
SSL_accept:SSLv3/TLS read finished
SSL_accept:SSLv3/TLS write change cipher spec
SSL_accept:SSLv3/TLS write finished
-----BEGIN SSL SESSION PARAMETERS-----
MIICmAIBAQICAQEEAuATBCD1YV5LF0CkDevOy4+6Laja+3JuUVSLZpvi/JIHfGqA
9wQwwEeDRT3secQJVmyLk0s0nRpcCCPKz18bH8LBH5UwfAKlWM8EDIhSzL4L5Mie
mf4CoQYCBGMuiwiiBAICHCCjggIfMIICGzCCAcGgAwIBAgIJAIVjx+dwZIdmMAoG
CCqBHM9VAYN1MIGCMQswCQYDVQQGEwJDTjELMAkGA1UECAwCQkoxEDAOBgNVBAcM
B0hhaURpYW4xJTAjBgNVBAoMHEJlaWppbmcgSk5UQSBUZWNobm9sb2d5IExURC4x
FTATBgNVBAsMDFNPUkIgb2YgVEFTUzEWMBQGA1UEAwwNVGVzdCBDQSAoU00yKTAe
Fw0yMDA2MjAxMDE4MjZaFw0yNDA3MjkxMDE4MjZaMIGGMQswCQYDVQQGEwJDTjEL
MAkGA1UECAwCQkoxEDAOBgNVBAcMB0hhaURpYW4xJTAjBgNVBAoMHEJlaWppbmcg
Sk5UQSBUZWNobm9sb2d5IExURC4xFTATBgNVBAsMDEJTUkMgb2YgVEFTUzEaMBgG
A1UEAwwRY2xpZW50IHNpZ24gKFNNMikwWTATBgcqhkjOPQIBBggqgRzPVQGCLQNC
AARV/eII1n2NVqYjwt9r9A5Eh6Z0iG+WUpsw4sGxhfKL0vr0OKcur6DZqjqLDSCr
ZEhU6yuntNtaW+pexPblqXAroxowGDAJBgNVHRMEAjAAMAsGA1UdDwQEAwIGwDAK
BggqgRzPVQGDdQNIADBFAiEAiX+PoCNW/n9SDbv6/o+NyCCV/7kBgunc7w5b7xGm
4RICIBMDlLjPZE2ACYhu1Wjqph23PfMPMgae4+Gtd7wzFz2UpAYEBAEAAAA=
-----END SSL SESSION PARAMETERS-----
Client certificate
-----BEGIN CERTIFICATE-----
MIICGzCCAcGgAwIBAgIJAIVjx+dwZIdmMAoGCCqBHM9VAYN1MIGCMQswCQYDVQQG
EwJDTjELMAkGA1UECAwCQkoxEDAOBgNVBAcMB0hhaURpYW4xJTAjBgNVBAoMHEJl
aWppbmcgSk5UQSBUZWNobm9sb2d5IExURC4xFTATBgNVBAsMDFNPUkIgb2YgVEFT
UzEWMBQGA1UEAwwNVGVzdCBDQSAoU00yKTAeFw0yMDA2MjAxMDE4MjZaFw0yNDA3
MjkxMDE4MjZaMIGGMQswCQYDVQQGEwJDTjELMAkGA1UECAwCQkoxEDAOBgNVBAcM
B0hhaURpYW4xJTAjBgNVBAoMHEJlaWppbmcgSk5UQSBUZWNobm9sb2d5IExURC4x
FTATBgNVBAsMDEJTUkMgb2YgVEFTUzEaMBgGA1UEAwwRY2xpZW50IHNpZ24gKFNN
MikwWTATBgcqhkjOPQIBBggqgRzPVQGCLQNCAARV/eII1n2NVqYjwt9r9A5Eh6Z0
iG+WUpsw4sGxhfKL0vr0OKcur6DZqjqLDSCrZEhU6yuntNtaW+pexPblqXAroxow
GDAJBgNVHRMEAjAAMAsGA1UdDwQEAwIGwDAKBggqgRzPVQGDdQNIADBFAiEAiX+P
oCNW/n9SDbv6/o+NyCCV/7kBgunc7w5b7xGm4RICIBMDlLjPZE2ACYhu1Wjqph23
PfMPMgae4+Gtd7wzFz2U
-----END CERTIFICATE-----
subject=/C=CN/ST=BJ/L=HaiDian/O=Beijing JNTA Technology LTD./OU=BSRC of TASS/CN=client sign (SM2)
issuer=/C=CN/ST=BJ/L=HaiDian/O=Beijing JNTA Technology LTD./OU=SORB of TASS/CN=Test CA (SM2)
Shared ciphers:SM9-WITH-SMS4-SM3:SM9DHE-WITH-SMS4-SM3:SM2-WITH-SMS4-SM3:SM2DHE-WITH-SMS4-SM3:RSA-WITH-SMS4-SHA1:RSA-WITH-SMS4-SM3
CIPHER is SM2-WITH-SMS4-SM3
Secure Renegotiation IS supported

客戶端

  • gmssl s_client -connect localhost:44330 -key CS.key.pem -cert CS.cert.pem -dkey CE.key.pem -dcert CE.cert.pem -CAfile CA.cert.pem -gmtls -showcerts
chy-cpabe@ubuntu:~/GMSSL_certificate/sm2Certs$ gmssl s_client -connect localhost:44330 -key CS.key.pem -cert CS.cert.pem -dkey CE.key.pem -dcert CE.cert.pem -CAfile CA.cert.pem -gmtls -showcerts
[GMTLS_DEBUG] set sm2 signing certificate
[GMTLS_DEBUG] set sm2 signing private key
[GMTLS_DEBUG] set sm2 encryption certificate
[GMTLS_DEBUG] set sm2 decryption private key
CONNECTED(00000003)
depth=1 C = CN, ST = BJ, L = HaiDian, O = Beijing JNTA Technology LTD., OU = SORB of TASS, CN = Test CA (SM2)
verify return:1
depth=0 C = CN, ST = BJ, L = HaiDian, O = Beijing JNTA Technology LTD., OU = BSRC of TASS, CN = server sign (SM2)
verify return:1
Z=BCDCCB61AADD790C076DAC60ED09DDD5285A906A4025DD748DA2FB5816464C58
C=00021E3082021A308201C0A0030201020209008563C7E770648765300A06082A811CCF55018375308182310B300906035504061302434E310B300906035504080C02424A3110300E06035504070C074861694469616E31253023060355040A0C1C4265696A696E67204A4E544120546563686E6F6C6F6779204C54442E31153013060355040B0C0C534F5242206F6620544153533116301406035504030C0D546573742043412028534D3229301E170D3230303632303130313832365A170D3234303732393130313832365A308185310B300906035504061302434E310B300906035504080C02424A3110300E06035504070C074861694469616E31253023060355040A0C1C4265696A696E67204A4E544120546563686E6F6C6F6779204C54442E31153013060355040B0C0C42535243206F6620544153533119301706035504030C1073657276657220656E632028534D32293059301306072A8648CE3D020106082A811CCF5501822D03420004B999853302F02CC522CC4CCA287019E86B901FC24E3CCF9A61B93BB177B28C2CE8E23C5C522DF73C23F7AC36FF688CB2E685A3FA4770103F7C99EFC32D06C11FA31A301830090603551D1304023000300B0603551D0F040403020338300A06082A811CCF550183750348003045022100EC4368F400870BED441817AF4D359BDC61A9EDFDDEE54AB0C185084B450C46B902206E0C3A08BC584590046DC85603CD4E8A51F97D9669B1ACA3E2A3627BE61D49A2
ssl_get_algorithm2=8193900008x
---
Certificate chain0 s:/C=CN/ST=BJ/L=HaiDian/O=Beijing JNTA Technology LTD./OU=BSRC of TASS/CN=server sign (SM2)i:/C=CN/ST=BJ/L=HaiDian/O=Beijing JNTA Technology LTD./OU=SORB of TASS/CN=Test CA (SM2)
-----BEGIN CERTIFICATE-----
MIICGjCCAcGgAwIBAgIJAIVjx+dwZIdkMAoGCCqBHM9VAYN1MIGCMQswCQYDVQQG
EwJDTjELMAkGA1UECAwCQkoxEDAOBgNVBAcMB0hhaURpYW4xJTAjBgNVBAoMHEJl
aWppbmcgSk5UQSBUZWNobm9sb2d5IExURC4xFTATBgNVBAsMDFNPUkIgb2YgVEFT
UzEWMBQGA1UEAwwNVGVzdCBDQSAoU00yKTAeFw0yMDA2MjAxMDE4MjVaFw0yNDA3
MjkxMDE4MjVaMIGGMQswCQYDVQQGEwJDTjELMAkGA1UECAwCQkoxEDAOBgNVBAcM
B0hhaURpYW4xJTAjBgNVBAoMHEJlaWppbmcgSk5UQSBUZWNobm9sb2d5IExURC4x
FTATBgNVBAsMDEJTUkMgb2YgVEFTUzEaMBgGA1UEAwwRc2VydmVyIHNpZ24gKFNN
MikwWTATBgcqhkjOPQIBBggqgRzPVQGCLQNCAAS0lHzt7CkOzCtyf6VwCqoT2PYD
CL/AJrCsHa+6lE8wDZ7DShI2bvfmrpavndEW67CHQOlO0q6/aoEB0PoAgpopoxow
GDAJBgNVHRMEAjAAMAsGA1UdDwQEAwIGwDAKBggqgRzPVQGDdQNHADBEAiB06JWp
uxFbGBfvG9juhe2Umu/auI1H2XeMdvDjbOtfuQIgMXT8jewkzq9TR3OPzRTkZCRH
3H+xKEb8r8JsEEStwaU=
-----END CERTIFICATE-----1 s:/C=CN/ST=BJ/L=HaiDian/O=Beijing JNTA Technology LTD./OU=BSRC of TASS/CN=server enc (SM2)i:/C=CN/ST=BJ/L=HaiDian/O=Beijing JNTA Technology LTD./OU=SORB of TASS/CN=Test CA (SM2)
-----BEGIN CERTIFICATE-----
MIICGjCCAcCgAwIBAgIJAIVjx+dwZIdlMAoGCCqBHM9VAYN1MIGCMQswCQYDVQQG
EwJDTjELMAkGA1UECAwCQkoxEDAOBgNVBAcMB0hhaURpYW4xJTAjBgNVBAoMHEJl
aWppbmcgSk5UQSBUZWNobm9sb2d5IExURC4xFTATBgNVBAsMDFNPUkIgb2YgVEFT
UzEWMBQGA1UEAwwNVGVzdCBDQSAoU00yKTAeFw0yMDA2MjAxMDE4MjZaFw0yNDA3
MjkxMDE4MjZaMIGFMQswCQYDVQQGEwJDTjELMAkGA1UECAwCQkoxEDAOBgNVBAcM
B0hhaURpYW4xJTAjBgNVBAoMHEJlaWppbmcgSk5UQSBUZWNobm9sb2d5IExURC4x
FTATBgNVBAsMDEJTUkMgb2YgVEFTUzEZMBcGA1UEAwwQc2VydmVyIGVuYyAoU00y
KTBZMBMGByqGSM49AgEGCCqBHM9VAYItA0IABLmZhTMC8CzFIsxMyihwGehrkB/C
TjzPmmG5O7F3sows6OI8XFIt9zwj96w2/2iMsuaFo/pHcBA/fJnvwy0GwR+jGjAY
MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgM4MAoGCCqBHM9VAYN1A0gAMEUCIQDsQ2j0
AIcL7UQYF69NNZvcYant/d7lSrDBhQhLRQxGuQIgbgw6CLxYRZAEbchWA81OilH5
fZZpsayj4qNie+YdSaI=
-----END CERTIFICATE-----2 s:/C=CN/ST=BJ/L=HaiDian/O=Beijing JNTA Technology LTD./OU=SORB of TASS/CN=Test CA (SM2)i:/C=CN/ST=BJ/L=HaiDian/O=Beijing JNTA Technology LTD./OU=SORB of TASS/CN=Test CA (SM2)
-----BEGIN CERTIFICATE-----
MIICWjCCAgCgAwIBAgIJAP5W2mLaOWq5MAoGCCqBHM9VAYN1MIGCMQswCQYDVQQG
EwJDTjELMAkGA1UECAwCQkoxEDAOBgNVBAcMB0hhaURpYW4xJTAjBgNVBAoMHEJl
aWppbmcgSk5UQSBUZWNobm9sb2d5IExURC4xFTATBgNVBAsMDFNPUkIgb2YgVEFT
UzEWMBQGA1UEAwwNVGVzdCBDQSAoU00yKTAeFw0yMDA2MjAxMDE4MjVaFw0yNDA3
MjkxMDE4MjVaMIGCMQswCQYDVQQGEwJDTjELMAkGA1UECAwCQkoxEDAOBgNVBAcM
B0hhaURpYW4xJTAjBgNVBAoMHEJlaWppbmcgSk5UQSBUZWNobm9sb2d5IExURC4x
FTATBgNVBAsMDFNPUkIgb2YgVEFTUzEWMBQGA1UEAwwNVGVzdCBDQSAoU00yKTBZ
MBMGByqGSM49AgEGCCqBHM9VAYItA0IABArjN7ag+H8D12eqXJpMeTOR9m3sB2RC
ojH7fZPB77SDfHZb9g1lcqUhrug0nw2F8wBMsLfjvsK3wQn/ryi3YvSjXTBbMB0G
A1UdDgQWBBRCcBGiEpd09qSpUlkiGkZ+q+CFbDAfBgNVHSMEGDAWgBRCcBGiEpd0
9qSpUlkiGkZ+q+CFbDAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBBjAKBggqgRzP
VQGDdQNIADBFAiBjdylWVsUoTRcHu9DoMHv4lgtYJMf2xHAGLoJUjmbizAIhAOFD
i3EmFVUgGVdgbnztFZcBLxtBzIAh/Q4Q3dm3/MFu
-----END CERTIFICATE-----
---
Server certificate
subject=/C=CN/ST=BJ/L=HaiDian/O=Beijing JNTA Technology LTD./OU=BSRC of TASS/CN=server sign (SM2)
issuer=/C=CN/ST=BJ/L=HaiDian/O=Beijing JNTA Technology LTD./OU=SORB of TASS/CN=Test CA (SM2)
---
Acceptable client certificate CA names
/C=CN/ST=BJ/L=HaiDian/O=Beijing JNTA Technology LTD./OU=SORB of TASS/CN=Test CA (SM2)
Client Certificate Types: RSA sign, DSA sign
---
SSL handshake has read 2121 bytes and written 2116 bytes
Verification: OK
---
New, GMTLSv1.1, Cipher is SM2-WITH-SMS4-SM3
Server public key is 256 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:Protocol  : GMTLSv1.1Cipher    : SM2-WITH-SMS4-SM3Session-ID: F5615E4B1740A40DEBCECB8FBA2DA8DAFB726E51548B669BE2FC92077C6A80F7Session-ID-ctx: Master-Key: C04783453DEC79C409566C8B934B349D1A5C0823CACF5F1B1FC2C11F95307C02A558CF040C8852CCBE0BE4C89E99FE02PSK identity: NonePSK identity hint: NoneSRP username: NoneStart Time: 1663994632Timeout   : 7200 (sec)Verify return code: 0 (ok)Extended master secret: no
---

抓包驗證

參考鏈接

  • 出錯原因：
  • GMTLS雙向認證CertificateVerify階段失敗 · Issue #854 · guanzhi/GmSSL · GitHub
  • 解決措施：
  • SSL 雙向認證問題 · Issue #716 · guanzhi/GmSSL · GitHub
  • 未來計劃：
  • https://github.com/jntass/TASSL-1.1.1k
  • gmssl官網：
  • GitHub - guanzhi/GmSSL at master

本文來自互聯網用戶投稿，該文觀點僅代表作者本人，不代表本站立場。本站僅提供信息存儲空間服務，不擁有所有權，不承擔相關法律責任。
如若轉載，請注明出處：http://www.pswp.cn/news/445871.shtml
繁體地址，請注明出處：http://hk.pswp.cn/news/445871.shtml
英文地址，請注明出處：http://en.pswp.cn/news/445871.shtml

如若內容造成侵權/違法違規/事實不符，請聯系多彩編程網進行投訴反饋email:809451989@qq.com，一經查實，立即刪除！

相關文章

糾偏的意思_承壓能力和糾偏能力，決定成長的高度

糾偏的意思_承壓能力和糾偏能力，決定成長的高度

承壓能力，包含抗壓能力、抵御能力，擔當能力，分解能力，消化能力，釋放能力，等一系列的精神要素，是一個人生存生活工作中一項重要的素質。有的人，承壓能力很強，無論經受什么…
閱讀更多...
《Java8實戰》筆記（15）：面向對象和函數式編程的混合-Java 8和Scala的比較

《Java8實戰》筆記（15）：面向對象和函數式編程的混合-Java 8和Scala的比較

面向對象和函數式編程的混合：Java 8和Scala的比較 Scala是一種混合了面向對象和函數式編程的語言。它常常被看作Java的一種替代語言，程序員們希望在運行于JVM上的靜態類型語言中使用函數式特性，同時又期望保持Java體驗的一致性。和Java比較起…
閱讀更多...
函數指針作為形參進行調用

函數指針作為形參進行調用

代碼 兩個代碼均位于namespace作用域之內addOne將傳遞進來的形參進行加一，然后返回performance_test函數主要是想簡化函數調用，兩個形參，第一個表示循環的次數，第二個是帶參數的函數指針，函數內部初始化start和end兩個…
閱讀更多...
python中fetchall_Python連接MySQL并使用fetchall()方法過濾特殊字符

python中fetchall_Python連接MySQL并使用fetchall()方法過濾特殊字符

來一個簡單的例子，看Python如何操作數據庫，相比Java的JDBC來說，確實非常簡單，省去了很多復雜的重復工作，只關心數據的獲取與操作。準備工作需要有相應的環境和模塊：Ubuntu 14.04 64bitPython 2.7.6MySQLdb注…
閱讀更多...
《Java8實戰》筆記（16）：結論以及Java的未來

《Java8實戰》筆記（16）：結論以及Java的未來

結論以及Java的未來 回顧Java8的語言特性 行為參數化（Lambda以及方法引用） 流 CompletableFuture Optional 默認方法 Java的未來 集合 類型系統的改進 聲明位置變量 更多的類型推斷 模式匹配 更加豐富的泛型形式 具化泛型 泛型中特別為函…
閱讀更多...
解決吉大正源(身份認證網關|USBKey)和gmssl(server|client)使用gmtl協議交叉互通報錯tlsv1 alert decrypt error

解決吉大正源(身份認證網關|USBKey)和gmssl(server|client)使用gmtl協議交叉互通報錯tlsv1 alert decrypt error

報錯內容 SSL_connect:error in SSLv3/TLS write finished140057291788288:error:1409441B:SSL routines:ssl3_read_bytes:tlsv1 alert decrypt error:ssl/record/rec_layer_s3.c:1385:SSL alert number 51 報錯原因 gmssl庫生成 certificate verify 消息時，對自客…
閱讀更多...
12無法使用otg_12個冷知識：或許只能看看而無法使用，但卻真實存在著

12無法使用otg_12個冷知識：或許只能看看而無法使用，但卻真實存在著

12個或許只能看看而無法使用，但卻真實存在著。臉紅一所有已知動物中，唯一可以臉紅的是人類。二有些地區將雨水歸類為公共財物，作為公共財物是不允許收集的，違反者將面臨處罰。三世界上汽車研發成本最高的一款車是福特蒙迪歐&#…
閱讀更多...
《Java8實戰》筆記匯總

《Java8實戰》筆記匯總

《Java8實戰》筆記（01）：為什么要關心Java8 《Java8實戰》筆記（02）：通過行為參數傳遞代碼 《Java8實戰》筆記（03）：Lambda表達式 《Java8實戰》筆記（04&…
閱讀更多...
三目運算符_C語言知識點：運算符的優先級和結合性

三目運算符_C語言知識點：運算符的優先級和結合性

運算符是一種告訴編譯器執行特定的數學或邏輯操作的符號。C語言內置了豐富的運算符，大體可分為10類：算術運算符、關系運算符、邏輯運算符、位操作運算符、賦值運算符、條件運算符、逗號運算符、指針運算符、求字節數運算符和特殊運算符。根據運算符可操作…
閱讀更多...
可以直接進行運算么_WORD辦公技巧：如何直接在WORD中進行加法、乘法運算？

可以直接進行運算么_WORD辦公技巧：如何直接在WORD中進行加法、乘法運算？

排版目標下圖文檔中有一張2020年１－３月口罩購買情況統計表，數據量并不大，我們想不動用excel表格進行統計，直接利用WORD自帶的函數公式計算出表格內空白單元格的數值。其中，金額＝單價&…
閱讀更多...
對dladdr未定義的引用

對dladdr未定義的引用

參考鏈接 c - 為什么我得到“對dladdr的未定義引用”，即使是這個簡單程序的-ldl？ | 碼農俱樂部 - Golang中國 - Go語言中文社區 注意事項 dladdr需要與-ldl鏈接，且-ldl放置在鏈接的最后 CMakeLists.txt 模板 cmake_minimum_required(VERSI…
閱讀更多...
如何優雅互換Map鍵與值

如何優雅互換Map鍵與值

一般方法 //map must be a bijection in order for this to work properly public static <K,V> HashMap<V,K> reverse(Map<K,V> map) {HashMap<V,K> rev new HashMap<V, K>();for(Map.Entry<K,V> entry : map.entrySet())rev.put(entry…
閱讀更多...
python程序設計題怎么寫_《Python語言程序設計基礎》第1章程序練習題

python程序設計題怎么寫_《Python語言程序設計基礎》第1章程序練習題

本文為中國大學MOOC《Python語言程序設計》課程學習筆記&#xff0c;課程主講&#xff1a;嵩天老師&#xff0c;練習平臺&#xff1a;Python123&#xff0c;參考教材&#xff1a;《Python語言程序設計基礎》1.1 字符串拼接Str1 input("請輸入一個人的名字&#xff1a;&qu…
閱讀更多...
《劍指Offer》36：二叉搜索樹與雙向鏈表

《劍指Offer》36：二叉搜索樹與雙向鏈表

題目 輸入一棵二叉搜索樹&#xff0c;將該二叉搜索樹轉換成一個排序的雙向鏈表。要求不能創建任何新的節點&#xff0c;只能調整樹中節點指針的指向。比如&#xff0c;輸入下圖中的二叉搜索樹&#xff0c;輸出轉換之后的排序雙向鏈表。 二叉樹節點的定義如下&#xff1a; pub…
閱讀更多...
窗口位置按鈕取消_VBA002：“宏”的保存位置有哪幾種方式？

窗口位置按鈕取消_VBA002：“宏”的保存位置有哪幾種方式？

商務合作請加微信 | Allen_Lyq文章投稿 | jiangjunpeng1996126.com微信公眾號 | Word和Excel達人先生頭條號 | 跟小小筱學辦公技能通過上一篇文章的學習&#xff0c;我們已經知道宏的基本用法&#xff0c;在錄制宏的過程中&#xff0c;還有幾個點需要我們注意下&#xff1a;宏命…
閱讀更多...
《劍指Offer》60：n個骰子的點數

《劍指Offer》60：n個骰子的點數

題目 把n個骰子扔在地上&#xff0c;所有骰子朝上一面的點數之和為S。輸入n&#xff0c;打印出S的所有可能的值出現的概率。 分析 直接法 假設骰子有face面&#xff0c;有n個骰子&#xff0c;那么總排列數就有face?個。&#xff08;例如&#xff0c;有3個6面骰子&#xff…
閱讀更多...
fastjson解析多層數據_怎么解析三層List json數據

fastjson解析多層數據_怎么解析三層List json數據

注意這個json格式不對前后的 [ ] 應該要去掉。 (我不是說你缺少的結束符)FastJSON 隨意解決的事情。0, compile com.alibaba:fastjson:1.2.71&#xff0c;去這個網站 http://www.jsonschema2pojo.org/粘貼你的json字符串1.1 Source type:JSON1.2 Annotation style:NONE1.3 所有…
閱讀更多...
《劍指Offer》37：序列化二叉樹

《劍指Offer》37：序列化二叉樹

題目 請實現兩個函數&#xff0c;分別用來序列化和反序列化二叉樹。 分析 我們清楚可以通過前序遍歷序列和中序遍歷序列創造出一棵二叉樹。因此&#xff0c;我們可以先把一棵二叉樹序列化成一個前序遍歷序列和一個中序遍歷序列&#xff0c;然后在反序列化時通過這兩種序列還…
閱讀更多...
c linux 判斷ip合法_shell 檢測ip的合法性與檢測網絡掩碼的合法性

c linux 判斷ip合法_shell 檢測ip的合法性與檢測網絡掩碼的合法性

有時我們需要檢測IP輸入的正確性與網絡掩碼的正確性&#xff0c;用shell腳本寫的&#xff1a;#驗證ip地址的正確性check_ip_format(){echo $1 | grep "^[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}$" > /dev/nullif [ $? 1 ]; thenreturn 1elseaec…
閱讀更多...
《劍指Offer》38：字符串的排列

《劍指Offer》38：字符串的排列

題目 輸入一個字符串&#xff0c;打印該字符中字符的所有排列。 例如&#xff0c;輸入字符串abc&#xff0c;則打印出由字符a、b、c所能排列出來的所有字符串有abc、acb、bac、bca、cab、cba 分析 把一個字符串看成由兩部分組成&#xff1a;第一部分是它的第一個字符&#…
閱讀更多...
最新文章

Copyright @ 2022~2023