My understanding is... -dennis2(Dennis) @拉斯维加斯华人论坛:拉斯维加斯枫下论坛 The Rolia Forum of Las Vegas

My understanding is...

dennis2(Dennis)

本文发表在 rolia.net 枫下论坛> 如果选择require，客户端不能访问加密端口，要求提供client
> certificate，从哪里得到？如何与server匹配？

If you want to use the certificate on the Internet, you'll need to get one from one of the CA (verisign, thawte, equifax, etc.). If for internal use, you can setup your own CA and sign cert for both server and client.

In order for the server to be able to authenticate the client, the server must have the CA certificate that signs the client certificate installed as trusted CA. Usually the browser comes with surficiant(spelling?) CA certificate.

> 请问，ignore和accept有何分别？是真的建立加密通道了吗？如何验
> 证？require的情况下，如何得到client certificate？

My understanding is, ignore will not require any client certificate; accept will ask for client certificate but it's not mandatory. Often, you can assign different privilages for users with and without certificate on the server side.

To make sure the secure channel has been established, see the corner of your IE brower, there shoud be a lock that is locked. If you are still worried, get a sniffer (NT/2k's network monitor will do) and sniff the wire and see if you can get some plain text.

See above for client certificate.更多精彩文章及讨论，请光临枫下论坛 rolia.net

(#178375@0)
Last Updated: 2001-8-24
This post has been archived. It cannot be replied.

client authentication 授权后, SSL通道正式建立了. -flying_snow(飞雪浮冰); 2001-8-24 {348} (#178279@0)

事实上IE5会调用wininet中的HttpOpenRequest和HttpSendRequest函数建立SSL连接,初次调用时若遇到SERVER端证书非法,会跳出一个对话框要求client authentication,当YES按下后,函数中的FLAG被置成INTERNET_FLAG_SECURE | INTERNET_FLAG_IGNORE_CERT_CN_INVALID | INTERNET_FLAG_IGNORE_CERT_DATE_INVALID ....然后系统再次调用HttpOpenRequest及HttpSendRequest,SSL连接成功 :-)

SSL建立成功的标志是什么？如何验证？ -guest:; 2001-8-24 {535} (#178297@0)
在server端安装了CA service，发布了server端证书，并安装和配置了加密端口，此时，iis5对client certificates有三个选项，ignore, accept, require，
如果选择require，客户端不能访问加密端口，要求提供client certificate，从哪里得到？如何与server匹配？
如果选择ignore，客户端无任何提示，进入加密通道。
如果选择accept，客户端首先接到security alert，按yes后，提示request identification，但下面列表是空的，OK后进入加密通道。

请问，ignore和accept有何分别？是真的建立加密通道了吗？如何验证？require的情况下，如何得到client certificate？

多谢。

哇,太高深了,我可不是专家,刚巧前几天碰了一点皮毛而已. -flying_snow(飞雪浮冰); 2001-8-24 {553} (#178333@0)
总的来说,选择require,客户端必须提供client certificate, 证书可以从CA中心签发,在IE的tools - option - connect菜单里有列出很多证书中心,可以向他们申请. 这些证书中心应该IIS都默认支持的,若有不支持的,也许应该安装他们的根证书,这样就可以识别了.
因为我是写浏览器端插件的,所以对IIS不是很熟.但从客户端的角度来看,客户端可以不提供证书(如B2C)模式, 也可以以对等方式提供证书(如B2B)模式.
至于如何判断是否真的建立了加密通道,我想也许可以用一个笨办法, 用IE访问你那个网站,URL为https://.......,取得页面后看浏览器底部状态栏里是否有一个小锁,鼠标指上去应该会显示: SSL 128... :-)

呵呵，那问题又回到开始了。客户向CA中心购买证书才能建立SSL？我的目的是利用MS现有组件建立SSL，不另行购买。另外，你的鉴别方法我知道，只是希望confirm一下。多谢。 -guest:; 2001-8-24 (#178383@0)

不用,客户端不用购买证书一样可以建立SSL, 因为SSL的重要作用之一就是互相确认对方身份, 而在B2C模式中,CLIENT端只要确认SERVER的身份就可以了,SERVER则无需管对方是谁.因此SERVER要有证书, CLIENT无所谓. -flying_snow(飞雪浮冰); 2001-8-24 (#178394@0)

That's true for B2C, but B2B needs client authentication in most cases. -dennis2(Dennis); 2001-8-24 (#178421@0)

My understanding is... -dennis2(Dennis); 2001-8-24 {1220} (#178375@0)
本文发表在 rolia.net 枫下论坛> 如果选择require，客户端不能访问加密端口，要求提供client
> certificate，从哪里得到？如何与server匹配？

If you want to use the certificate on the Internet, you'll need to get one from one of the CA (verisign, thawte, equifax, etc.). If for internal use, you can setup your own CA and sign cert for both server and client.

In order for the server to be able to authenticate the client, the server must have the CA certificate that signs the client certificate installed as trusted CA. Usually the browser comes with surficiant(spelling?) CA certificate.

> 请问，ignore和accept有何分别？是真的建立加密通道了吗？如何验
> 证？require的情况下，如何得到client certificate？

My understanding is, ignore will not require any client certificate; accept will ask for client certificate but it's not mandatory. Often, you can assign different privilages for users with and without certificate on the server side.

To make sure the secure channel has been established, see the corner of your IE brower, there shoud be a lock that is locked. If you are still worried, get a sniffer (NT/2k's network monitor will do) and sniff the wire and see if you can get some plain text.

See above for client certificate.更多精彩文章及讨论，请光临枫下论坛 rolia.net

访问商业网站加密区时，有的会让我安装证书，有的是安静连接，他们的加密等级是一样的？前者是如何制作证书并远程安装到client的？我确实想装sniffer截取一个包看看是否真正加密。多谢。 -guest:; 2001-8-24 (#178387@0)

让你安装什么证书? 是要你的client certificate还是要你接受server的certificate? 安静连接是因为both client and server satisfies the authentication requirement. -dennis2(Dennis); 2001-8-24 {74} (#178420@0)
加密等级是另一个概念, 你应该可以在server端设置的, 比如说40-bit or 128-bit.

"初次调用时若遇到SERVER端证书非法,会跳出一个对话框要求client authentication" --- ??? If server cert is invalid, the client will get a warning (not client authentication). -dennis2(Dennis); 2001-8-24 {134} (#178352@0)
It shouldn't request client authentication unless the server is configured to do so. I think you misunderstood the original question.

不, 无论是浏览器还是我自己写的WININET测试代码都会自动验证SERVER端证书的有效性,我想这应该是被封装在WININET这一层的.如果客户端没有IGNORE这个WARNING,SSL SESSION 会被立即终止. -flying_snow(飞雪浮冰); 2001-8-24 (#178380@0)
飞雪多说了一层意思。我的server端证书当然没问题了。我感兴趣的是，对client分发密钥的问题。 -guest:; 2001-8-24 {284} (#178409@0)
作为商业网站，要求客户do something是愚蠢又失礼的，万不得已时才能要求客户升级他们的软件，或安装什么东西。

因此，我希望建立安静连接，或者是有一次security alert。不希望客户安装证书，或者被莫名其妙的popup window迷惑。

因为我很想知道大型商业网站是如何制作他们的加密方案的。

多谢。

嘻嘻,这下问对了,我刚巧和这个问题斗争了两天!客户端POP对话框有3个原因 -flying_snow(飞雪浮冰); 2001-8-24 {345} (#178423@0)
第一个:SERVER证书为陌生机构签发,第二个:SERVER证书过期,第三个:证书和服务器不符.
我在程序里面用IGNORE参数屏蔽了后两个验证,但第一个验证我无法避免,最后值得安装根证书,实现了安静连接,IE的工作模式也是一样的.因此,我想你可能应该在IIS设置IGNORE CLIENT CERTIFICATE,并且你SERVER端的证书最好采用所有BROWSER都支持的大证书中心签发的.这样理论上就能实现安静连接

"但第一个验证我无法避免" -- Of course, how are you supposed to do authentication without the ca cert that signs the server cert? :-) -dennis2(Dennis); 2001-8-24 (#178434@0)

you are right, so I have to install my root cert at client site...then the alarm disappeared. :-) 我这几天一直在研究这些东东,挺有意思的,一起探讨吧? 有一个网站不错, 还有一本书也很好, 叫"SSL and TLS" - by Eric -flying_snow(飞雪浮冰); 2001-8-24 (#178448@0)

Yeah, I know that book, it got 5 star on amazon! The guy also wrote a program called ssldump to let you see the encrypted packets for debugging but I've never tried it myself. -dennis2(Dennis); 2001-8-24 {164} (#178477@0)
Another pretty good web site:

http://www.pki-page.org

Bruce Schneier's "Applied Cryptography" is another very good book, I have the e-version if you want.

I am really interested in it, would you please email the e-book to me? Thanks a lot :-) -flying_snow(飞雪浮冰); 2001-8-24 (#178483@0)

Check your mail box. -dennis2(Dennis); 2001-8-24 (#178496@0)

555，咋没有俺的啦？5555555 -guest:; 2001-8-24 (#178515@0)

You need to give me your email address :-) -dennis2(Dennis); 2001-8-24 (#178539@0)

另外补充一下,在IE的Tools - Internet Options - Content - Certificates 里有Trusted Root Certification Authorities 的列表. 我的SSL SERVER程序用了一个自己证书中心签发的证书,导致CLIENT端只得安装自己中心的根证书. -flying_snow(飞雪浮冰); 2001-8-24 (#178437@0)
远程向client"分发密钥"(should be certificate)是不可能的. Certificate的目的就是要验证身份, 你若不知道客户是谁, 怎么能发给他certificate? -dennis2(Dennis); 2001-8-24 {146} (#178441@0)
其实身份验证与加密通道的建立没有必然联系, 它只不过是SSL/TLS标准的要求罢了. 如果没有身份验证, 你就无法知道你在与谁对话, 从而也就失去了加密的意义了.

呵呵，和大家讨论不仅能学到东西，还能增添信心。我早就建立了根证书，现在可以说能够正式发布我的加密网站了，习习。在网络安全方面，以后还会向各位请教。多谢。 -guest:; 2001-8-24 (#178487@0)

@Las Vegas

My understanding is...

Replies, comments and Discussions:

More Topics