php小编草莓在介绍签署证书时指出，授权密钥标识符（SKID）在签署过程中起到重要的作用。当签署证书时，SKID会被复制到证书中，用于标识该证书的授权密钥。这个标识符的存在可以帮助确保证书的真实性和合法性，同时也方便了后续的证书验证和管理工作。签署证书时，SKID的复制是必要的步骤，它在证书的使用和维护过程中扮演着重要的角色。
问题内容
我正在尝试使用 csr 和 spacemonkeygo/openssl 包装器签署证书。
用于签署证书的控制台 openssl 命令按预期工作，我获得了有效的证书。
openssl x509 -req -days 365 -in cert_client.csr -ca ca/root.crt -cakey ca/root.key -set_serial 10101 -out cert_client.crt -extfile ca/extensions.cnf
从截图中可以看出，skid和issuer的keyid是不同的。
但是，我在 go 中的代码提供了错误的证书，其中 skid 包含颁发证书的 keyid 的确切值。这会导致在“权威密钥标识符”中复制“颁发者”的无效值：由于 skid 与颁发者的 keyid 相同，因此它“认为”证书是自行颁发的。
package main
import (
"github.com/spacemonkeygo/openssl"
"math/big"
"os"
"time"
)
func main() {
crtfilepath := filepath("ca/root.crt")
keyfilepath := filepath("ca/root.key")
certca, privatekeyca, err := getrootca(pathcert(crtfilepath), pathkey(keyfilepath))
if err != nil {
panic(err)
}
serialnumber := big.newint(10101)
country := "ru"
organization := "some organization"
commonname := "commonname"
expirationdate := time.now().adddate(1, 0, 0)
certinfo := &openssl.certificateinfo{
serial: serialnumber,
expires: expirationdate.sub(time.now()),
commonname: commonname,
// will fail if these are empty or not initialized
country: country,
organization: organization,
}
// just for example. publickey is received from csr
privatekeycert, err := openssl.generatersakey(2048)
if err != nil {
panic(err)
}
newcert, err := openssl.newcertificate(certinfo, openssl.publickey(privatekeycert))
if err != nil {
panic(err)
}
err = newcert.setversion(openssl.x509_v3)
if err != nil {
panic(err)
}
// (?) must be called before adding extensions
err = newcert.setissuer(certca)
if err != nil {
panic(err)
}
err = newcert.addextension(openssl.nid_basic_constraints,
"critical,ca:false")
if err != nil {
panic(err)
}
err = newcert.addextension(openssl.nid_subject_key_identifier,
"hash")
if err != nil {
panic(err)
}
err = newcert.addextension(openssl.nid_authority_key_identifier,
"keyid:always,issuer:always")
if err != nil {
panic(err)
}
err = newcert.sign(privatekeyca, openssl.evp_sha256)
if err != nil {
panic(err)
}
pembytes, err := newcert.marshalpem()
if err != nil {
panic(err)
}
err = os.writefile("generated.crt", pembytes, os.filemode(0644))
if err != nil {
panic(err)
}
print("done")
}
type filepath string
type pathcert string
type pathkey string
func getrootca(pathcert pathcert, pathkey pathkey) (*openssl.certificate, openssl.privatekey, error) {
capublickeyfile, err := os.readfile(string(pathcert))
if err != nil {
return nil, nil, err
}
certca, err := openssl.loadcertificatefrompem(capublickeyfile)
if err != nil {
return nil, nil, err
}
caprivatekeyfile, err := os.readfile(string(pathkey))
if err != nil {
return nil, nil, err
}
privatekeyca, err := openssl.loadprivatekeyfrompem(caprivatekeyfile)
if err != nil {
return nil, nil, err
}
return certca, privatekeyca, nil
}
（生成的是正确的）
如果我不调用setissuer，skid是新生成的，但生成的证书仍然显示为“无效”。
我在代码中做错了什么？
更新：
我比较了为 2 个包装器添加扩展的实现：spacemonkey/go 和 pyopenssl。
去：
// add an extension to a certificate.
// extension constants are nid_* as found in openssl.
func (c *certificate) addextension(nid nid, value string) error {
issuer := c
if c.issuer != nil {
issuer = c.issuer
}
var ctx c.x509v3_ctx
c.x509v3_set_ctx(&ctx, c.x, issuer.x, nil, nil, 0)
ex := c.x509v3_ext_conf_nid(nil, &ctx, c.int(nid), c.cstring(value))
if ex == nil {
return errors.new("failed to create x509v3 extension")
}
defer c.x509_extension_free(ex)
if c.x509_add_ext(c.x, ex, -1) <= 0 {
return errors.new("failed to add x509v3 extension")
}
return nil
}
python（省略一些注释）：
# X509Extension::__init__
def __init__(
self,
type_name: bytes,
critical: bool,
value: bytes,
subject: Optional["X509"] = None,
issuer: Optional["X509"] = None,
) -> None:
ctx = _ffi.new("X509V3_CTX*")
# A context is necessary for any extension which uses the r2i
# conversion method. That is, X509V3_EXT_nconf may segfault if passed
# a NULL ctx. Start off by initializing most of the fields to NULL.
_lib.X509V3_set_ctx(ctx, _ffi.NULL, _ffi.NULL, _ffi.NULL, _ffi.NULL, 0)
# We have no configuration database - but perhaps we should (some
# extensions may require it).
_lib.X509V3_set_ctx_nodb(ctx)
# Initialize the subject and issuer, if appropriate. ctx is a local,
# and as far as I can tell none of the X509V3_* APIs invoked here steal
# any references, so no need to mess with reference counts or
# duplicates.
if issuer is not None:
if not isinstance(issuer, X509):
raise TypeError("issuer must be an X509 instance")
ctx.issuer_cert = issuer._x509
if subject is not None:
if not isinstance(subject, X509):
raise TypeError("subject must be an X509 instance")
ctx.subject_cert = subject._x509
if critical:
# There are other OpenSSL APIs which would let us pass in critical
# separately, but they're harder to use, and since value is already
# a pile of crappy junk smuggling a ton of utterly important
# structured data, what's the point of trying to avoid nasty stuff
# with strings? (However, X509V3_EXT_i2d in particular seems like
# it would be a better API to invoke. I do not know where to get
# the ext_struc it desires for its last parameter, though.)
value = b"critical," + value
extension = _lib.X509V3_EXT_nconf(_ffi.NULL, ctx, type_name, value)
if extension == _ffi.NULL:
_raise_current_error()
self._extension = _ffi.gc(extension, _lib.X509_EXTENSION_free)
明显的区别在于 api：python 的版本接受 subject 和 issuer 作为参数进行重载。 go 的版本没有。
实现上的差异如下：
- 在python中调用
x509v3_ext_nconf -
x509v3_ext_conf_nid在 go 中调用 这两个函数都可以在 github 上找到。
我认为使用 openspacemonkey/go-openssl 与 ca 签名时不可能添加 skid 扩展。
似乎唯一的方法是手动使用 c 绑定并“像 python 那样做”。
解决方法
我实施了一种巧妙的解决方法来添加 skid 和authoritykeyidentifier。生成的证书有效。但是，由于 certificate 结构体的 x *c.x509 成员未导出，因此访问它们的唯一方法是通过不安全的指针和强制转换。
这不是推荐的方法，而是在 spacemonkey/go 更新之前的一种方法（我怀疑它会很快发生）。
func addAuthorityKeyIdentifier(c *openssl.Certificate) error {
var ctx C.X509V3_CTX
C.X509V3_set_ctx(&ctx, nil, nil, nil, nil, 0)
// this is ugly and very unsafe!
cx509 := *(**C.X509)(unsafe.Pointer(c))
cx509Issuer := cx509
if c.Issuer != nil {
cx509Issuer = *(**C.X509)(unsafe.Pointer(c.Issuer))
}
ctx.issuer_cert = cx509Issuer
cExtName := C.CString("authorityKeyIdentifier")
defer C.free(unsafe.Pointer(cExtName))
cExtValue := C.CString("keyid:always,issuer:always")
defer C.free(unsafe.Pointer(cExtValue))
extension := C.X509V3_EXT_nconf(nil, &ctx, cExtName, cExtValue)
if extension == nil {
return errors.New("failed to set 'authorityKeyIdentifier' extension")
}
defer C.X509_EXTENSION_free(extension)
addResult := C.X509_add_ext(cx509, extension, -1)
if addResult == 0 {
return errors.New("failed to set 'authorityKeyIdentifier' extension")
}
return nil
}
func addSKIDExtension(c *openssl.Certificate) error {
var ctx C.X509V3_CTX
C.X509V3_set_ctx(&ctx, nil, nil, nil, nil, 0)
// this is ugly and very unsafe!
cx509 := *(**C.X509)(unsafe.Pointer(c))
_ = cx509
ctx.subject_cert = cx509
_ = ctx
cExtName := C.CString("subjectKeyIdentifier")
defer C.free(unsafe.Pointer(cExtName))
cExtValue := C.CString("hash")
defer C.free(unsafe.Pointer(cExtValue))
extension := C.X509V3_EXT_nconf(nil, &ctx, cExtName, cExtValue)
if extension == nil {
return errors.New("failed to set 'subjectKeyIdentifier' extension")
}
defer C.X509_EXTENSION_free(extension)
// adding itself as a subject
addResult := C.X509_add_ext(cx509, extension, -1)
if addResult == 0 {
return errors.New("failed to set 'subjectKeyIdentifier' extension")
}
return nil
} 
