导致 Chrome “<domain name> 不遵守安全标准的原因。”

Question

为了本地测试可通过 HTTPS 访问的服务，我使用以下程序生成自己的密钥和证书。毫无疑问，该程序构建的证书在各种方面都不符合现实世界证书的最佳实践。但是，导致 Chrome 拒绝他们并出现此 "doesn't adhere to security standards" 错误的一个或多个特定问题让我难以理解。

Chrome报告的完整（少域）错误是：

生成证书、密钥等的程序是：

#!/usr/bin/env python

from __future__ import unicode_literals, print_function

from string import uppercase
from datetime import datetime, timedelta

from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.x509.oid import NameOID
from cryptography.hazmat.primitives.hashes import SHA256
from cryptography.hazmat.primitives import serialization
from cryptography.x509 import (
    CertificateBuilder,
    SubjectAlternativeName,
    BasicConstraints,
    DNSName,
    Name,
    NameAttribute,
)
from cryptography.hazmat.backends import default_backend

def cert(issuer, subject, issuer_key, subject_key, ca):
    builder = CertificateBuilder(
    ).issuer_name(
        Name([NameAttribute(NameOID.COMMON_NAME, issuer)]),
    ).subject_name(
        Name([NameAttribute(NameOID.COMMON_NAME, subject)]),
    ).add_extension(
        SubjectAlternativeName([DNSName(subject)]),
        critical=False,
    )
    if ca:
        builder = builder.add_extension(
            BasicConstraints(True, None),
            critical=True,
        )
    return builder.public_key(subject_key.public_key(),
    ).serial_number(1,
    ).not_valid_before(datetime.utcnow(),
    ).not_valid_after(datetime.utcnow() + timedelta(days=365),
    ).sign(issuer_key, SHA256(), default_backend(),
    )

def main(num_certs, subject_name):
    keys = tuple(
        rsa.generate_private_key(
            public_exponent=65537,
            key_size=1024,
            backend=default_backend(),
        )
        for i in range(num_certs)
    )

    names = list(
        ch + ".invalid"
        for ch
        in uppercase.decode("ascii")[:len(keys) - 1]
    ) + [subject_name]

    certs = tuple(
        cert(
            issuer=issuer_name,
            subject=subject_name,
            issuer_key=issuer_key,
            subject_key=subject_key,
            ca=is_ca,
        )
        for (issuer_name, subject_name, issuer_key, subject_key, is_ca)
        in zip(
            names[:1] + names[:-1],
            names,
            keys[:1] + keys[:-1],
            keys,
            range(len(keys) - 1, -1, -1),
        )
    )

    print("\n".join(
        key.private_bytes(
            encoding=serialization.Encoding.PEM,
            format=serialization.PrivateFormat.TraditionalOpenSSL,
            encryption_algorithm=serialization.NoEncryption(),
        for key
        in keys
    ))

    print("\n".join(
        cert.public_bytes(serialization.Encoding.PEM)
        for cert
        in certs
    ))

main(3, "<some domain name>")

程序吐出密钥，然后吐出证书。链长默认设置为 3，有一个 CA key/cert，一个中间 key/cert，和一个服务器 key/cert.

这是其输出示例：

Answer 1

所有这三个证书都具有完全相同的序列号 (0x59544282)。 Chrome doesn't like that -- 您需要为每个由您的 CA 签名的证书使用唯一的序列号。

导致 Chrome “<domain name> 不遵守安全标准的原因。”

What causes Chrome "<domain name> doesn't adhere to security standards."

cryptography

google-chrome

x509

tls1.2

python-cryptography