-
Notifications
You must be signed in to change notification settings - Fork 11
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
关于启用mTLS的一些疑问 #42
Comments
@zzx-QDU hi,你的tls的问题由于上下文信息不太够无法确认是什么原因导致的,我这边猜测一些可能的原因。 下面简单给一下生成过程作为参考:
openssl genrsa -out ca.key 3072
openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 -out ca.crt
openssl genrsa -out server.key 3072
openssl req -new -sha256 -key server.key -out server.csr
openssl genrsa -out client.key 3072
openssl req -new -sha256 -key client.key -out client.csr 4.设置签发策略,将策略写入ca.ext文件中
签发完成之后,服务端证书/私钥在capsule-manager中使用,客户端证书/私钥在sdk侧使用。 |
非常感谢!我重新生成证书后握手没有失败,但是alice和bob的机构ID验证失败。 我试着将ID换成用ca.crt生成的机构ID,却能成功上传。请问可能是什么原因导致的? |
common配置下的证书仍然需要使用alice.crt,与party_id是对应的。 |
是对应的 party_id: "MBIXLYH4DYVZJTD7AAW23HQMTNYTILKOMGS3R4T6SNLEA72P63ZA" cert_pems_file: private_key_file: alice.key |
我试着只写alice.crt,相应的报错是说ID是错误的。 |
common下不要把ca.crt填进去,这是两套证书体系,alice.crt并不是ca.crt签发出来的,它们不构成证书链关系 |
可以贴一下完整的配置文件吗? |
host: "127.0.0.1:8888" root_ca_file: /home/u22/ca.crt common: party_id: "MBIXLYH4DYVZJTD7AAW23HQMTNYTILKOMGS3R4T6SNLEA72P63ZA" cert_pems_file: private_key_file: alice.key register_data_keys: |
麻烦用```将内容包起来,否则看不清楚 |
“host: "127.0.0.1:8888" root_ca_file: /home/u22/ca.crt common: party_id: "MBIXLYH4DYVZJTD7AAW23HQMTNYTILKOMGS3R4T6SNLEA72P63ZA" cert_pems_file:
private_key_file: alice.key register_data_keys:
|
不好意思 本来我想截图或者直接上传文件,但是都上传失败。 |
发送的配置文件内容用的前后都用```包起来,可以避免格式混乱。像我下面这样,给个示例:
看起来你这边依然将tls证书和机构自签证书混用了。 你的配置文件中我看到几个问题: |
大佬,真的非常感谢!是我脑抽了,一直没有理解TLS证书和机构证书是两套同时存在的证书。 |
感谢提问,这块看起来还是比较多的人会confuse,后续我们也尽力在文档中更加明确这些定义 |
Issue Type
Build/Install
Source
binary
Capsule Manager Version
0.2.0b0
Capsule Manager SDK Version
0.2.0b0
Tee Apps Version
0.2.0b0
OS Platform and Distribution
Ubuntu 22.04
Python version
3.10
Bazel version
No response
GCC/Compiler version
No response
What happend and What you expected to happen.
Reproduction code to reproduce the issue.
The text was updated successfully, but these errors were encountered: