SSL/TLS 证书在客户端-服务器通信中的详解

SSL/TLS 证书在客户端-服务器通信中的详解

证书文件概述

在SSL/TLS通信中，通常使用三种主要的PEM格式证书文件：

详细用途说明

1. CA证书 (ca.pem)

作用：信任锚点，用于验证其他证书的合法性
内容：CA的公钥和身份信息
格式：—–BEGIN CERTIFICATE—– … —–END CERTIFICATE—–

客户端使用：验证服务器证书是否由可信CA签发
服务器使用：验证客户端证书（如启用双向认证）

2. 服务器证书 (cert.pem)

作用：证明服务器身份
内容：服务器公钥、服务器信息、CA的数字签名
格式：—–BEGIN CERTIFICATE—– … —–END CERTIFICATE—–

包含信息：

• 服务器域名/主机名
• 服务器公钥
• 有效期
• 颁发者（CA）信息
• CA的数字签名

3. 私钥文件 (key.pem)

作用：服务器私钥，用于解密和签名
内容：RSA/ECDSA私钥
格式：—–BEGIN PRIVATE KEY—– … —–END PRIVATE KEY—–

重要：必须严格保密，仅服务器持有

TLS握手过程图解

ServerClientServerClient#mermaid-svg-sM8Vvbc2CROTnDJ8{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-sM8Vvbc2CROTnDJ8 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-sM8Vvbc2CROTnDJ8 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-sM8Vvbc2CROTnDJ8 .error-icon{fill:#552222;}#mermaid-svg-sM8Vvbc2CROTnDJ8 .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-sM8Vvbc2CROTnDJ8 .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-sM8Vvbc2CROTnDJ8 .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-sM8Vvbc2CROTnDJ8 .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-sM8Vvbc2CROTnDJ8 .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-sM8Vvbc2CROTnDJ8 .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-sM8Vvbc2CROTnDJ8 .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-sM8Vvbc2CROTnDJ8 .marker{fill:#333333;stroke:#333333;}#mermaid-svg-sM8Vvbc2CROTnDJ8 .marker.cross{stroke:#333333;}#mermaid-svg-sM8Vvbc2CROTnDJ8 svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-sM8Vvbc2CROTnDJ8 p{margin:0;}#mermaid-svg-sM8Vvbc2CROTnDJ8 .actor{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-sM8Vvbc2CROTnDJ8 text.actor>tspan{fill:black;stroke:none;}#mermaid-svg-sM8Vvbc2CROTnDJ8 .actor-line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-sM8Vvbc2CROTnDJ8 .innerArc{stroke-width:1.5;stroke-dasharray:none;}#mermaid-svg-sM8Vvbc2CROTnDJ8 .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:#333;}#mermaid-svg-sM8Vvbc2CROTnDJ8 .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:#333;}#mermaid-svg-sM8Vvbc2CROTnDJ8 #arrowhead path{fill:#333;stroke:#333;}#mermaid-svg-sM8Vvbc2CROTnDJ8 .sequenceNumber{fill:white;}#mermaid-svg-sM8Vvbc2CROTnDJ8 #sequencenumber{fill:#333;}#mermaid-svg-sM8Vvbc2CROTnDJ8 #crosshead path{fill:#333;stroke:#333;}#mermaid-svg-sM8Vvbc2CROTnDJ8 .messageText{fill:#333;stroke:none;}#mermaid-svg-sM8Vvbc2CROTnDJ8 .labelBox{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-sM8Vvbc2CROTnDJ8 .labelText,#mermaid-svg-sM8Vvbc2CROTnDJ8 .labelText>tspan{fill:black;stroke:none;}#mermaid-svg-sM8Vvbc2CROTnDJ8 .loopText,#mermaid-svg-sM8Vvbc2CROTnDJ8 .loopText>tspan{fill:black;stroke:none;}#mermaid-svg-sM8Vvbc2CROTnDJ8 .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-sM8Vvbc2CROTnDJ8 .note{stroke:#aaaa33;fill:#fff5ad;}#mermaid-svg-sM8Vvbc2CROTnDJ8 .noteText,#mermaid-svg-sM8Vvbc2CROTnDJ8 .noteText>tspan{fill:black;stroke:none;}#mermaid-svg-sM8Vvbc2CROTnDJ8 .activation0{fill:#f4f4f4;stroke:#666;}#mermaid-svg-sM8Vvbc2CROTnDJ8 .activation1{fill:#f4f4f4;stroke:#666;}#mermaid-svg-sM8Vvbc2CROTnDJ8 .activation2{fill:#f4f4f4;stroke:#666;}#mermaid-svg-sM8Vvbc2CROTnDJ8 .actorPopupMenu{position:absolute;}#mermaid-svg-sM8Vvbc2CROTnDJ8 .actorPopupMenuPanel{position:absolute;fill:#ECECFF;box-shadow:0px 8px 16px 0px rgba(0,0,0,0.2);filter:drop-shadow(3px 5px 2px rgb(0 0 0 / 0.4));}#mermaid-svg-sM8Vvbc2CROTnDJ8 .actor-man line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-sM8Vvbc2CROTnDJ8 .actor-man circle,#mermaid-svg-sM8Vvbc2CROTnDJ8 line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;stroke-width:2px;}#mermaid-svg-sM8Vvbc2CROTnDJ8 :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}TLS Handshake Protocol客户端验证流程安全通信通道建立完成ClientHello (支持的加密套件、随机数)ServerHello (选择的加密套件、随机数)Server Certificate (cert.pem)ServerHelloDone1. 使用ca.pem验证cert.pem签名2. 检查证书有效期3. 验证主机名匹配ClientKeyExchange (预主密钥，用cert.pem公钥加密)ChangeCipherSpecFinished (加密)使用key.pem解密预主密钥ChangeCipherSpecFinished (加密)加密的应用数据加密的应用数据

证书验证流程图

#mermaid-svg-BJJ1qUOz0aypQF1X{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-BJJ1qUOz0aypQF1X .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-BJJ1qUOz0aypQF1X .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-BJJ1qUOz0aypQF1X .error-icon{fill:#552222;}#mermaid-svg-BJJ1qUOz0aypQF1X .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-BJJ1qUOz0aypQF1X .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-BJJ1qUOz0aypQF1X .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-BJJ1qUOz0aypQF1X .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-BJJ1qUOz0aypQF1X .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-BJJ1qUOz0aypQF1X .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-BJJ1qUOz0aypQF1X .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-BJJ1qUOz0aypQF1X .marker{fill:#333333;stroke:#333333;}#mermaid-svg-BJJ1qUOz0aypQF1X .marker.cross{stroke:#333333;}#mermaid-svg-BJJ1qUOz0aypQF1X svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-BJJ1qUOz0aypQF1X p{margin:0;}#mermaid-svg-BJJ1qUOz0aypQF1X .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-BJJ1qUOz0aypQF1X .cluster-label text{fill:#333;}#mermaid-svg-BJJ1qUOz0aypQF1X .cluster-label span{color:#333;}#mermaid-svg-BJJ1qUOz0aypQF1X .cluster-label span p{background-color:transparent;}#mermaid-svg-BJJ1qUOz0aypQF1X .label text,#mermaid-svg-BJJ1qUOz0aypQF1X span{fill:#333;color:#333;}#mermaid-svg-BJJ1qUOz0aypQF1X .node rect,#mermaid-svg-BJJ1qUOz0aypQF1X .node circle,#mermaid-svg-BJJ1qUOz0aypQF1X .node ellipse,#mermaid-svg-BJJ1qUOz0aypQF1X .node polygon,#mermaid-svg-BJJ1qUOz0aypQF1X .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-BJJ1qUOz0aypQF1X .rough-node .label text,#mermaid-svg-BJJ1qUOz0aypQF1X .node .label text,#mermaid-svg-BJJ1qUOz0aypQF1X .image-shape .label,#mermaid-svg-BJJ1qUOz0aypQF1X .icon-shape .label{text-anchor:middle;}#mermaid-svg-BJJ1qUOz0aypQF1X .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-BJJ1qUOz0aypQF1X .rough-node .label,#mermaid-svg-BJJ1qUOz0aypQF1X .node .label,#mermaid-svg-BJJ1qUOz0aypQF1X .image-shape .label,#mermaid-svg-BJJ1qUOz0aypQF1X .icon-shape .label{text-align:center;}#mermaid-svg-BJJ1qUOz0aypQF1X .node.clickable{cursor:pointer;}#mermaid-svg-BJJ1qUOz0aypQF1X .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-BJJ1qUOz0aypQF1X .arrowheadPath{fill:#333333;}#mermaid-svg-BJJ1qUOz0aypQF1X .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-BJJ1qUOz0aypQF1X .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-BJJ1qUOz0aypQF1X .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-BJJ1qUOz0aypQF1X .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-BJJ1qUOz0aypQF1X .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-BJJ1qUOz0aypQF1X .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-BJJ1qUOz0aypQF1X .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-BJJ1qUOz0aypQF1X .cluster text{fill:#333;}#mermaid-svg-BJJ1qUOz0aypQF1X .cluster span{color:#333;}#mermaid-svg-BJJ1qUOz0aypQF1X div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-BJJ1qUOz0aypQF1X .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-BJJ1qUOz0aypQF1X rect.text{fill:none;stroke-width:0;}#mermaid-svg-BJJ1qUOz0aypQF1X .icon-shape,#mermaid-svg-BJJ1qUOz0aypQF1X .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-BJJ1qUOz0aypQF1X .icon-shape p,#mermaid-svg-BJJ1qUOz0aypQF1X .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-BJJ1qUOz0aypQF1X .icon-shape rect,#mermaid-svg-BJJ1qUOz0aypQF1X .image-shape rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-BJJ1qUOz0aypQF1X .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-BJJ1qUOz0aypQF1X .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-BJJ1qUOz0aypQF1X :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

签名有效

签名无效

在有效期内

已过期

匹配

不匹配

客户端收到服务器证书

证书链验证

获取根证书 ca.pem

提取服务器证书公钥

使用ca.pem公钥验证签名

检查证书有效期

验证失败: 连接终止

检查主机名匹配

证书验证成功

建立安全连接

开始加密通信

文件内容示例

ca.pem (CA证书)

—–BEGIN CERTIFICATE—–
MIIDQTCCAimgAwIBAgITBmyfz5m/jAo54vB4ikPmljZbyjANBgkqhkiG9w0BAQsF
…
[middle part of certificate]
…
—–END CERTIFICATE—–

cert.pem (服务器证书)

—–BEGIN CERTIFICATE—–
MIIDazCCAlOgAwIBAgIUYsjcJXZpNvB6MhSDwQQzXq5WJvMwDQYJKoZIhvcNAQEL
…
[middle part of certificate]
…
—–END CERTIFICATE—–

key.pem (私钥 – 示例格式)

—–BEGIN PRIVATE KEY—–
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC7VJTUtMYbUu7M
…
[encrypted private key data]
…
—–END PRIVATE KEY—–

实际使用示例

服务器端配置 (Node.js/Express)

const https = require('https');
const fs = require('fs');

const options = {
cert: fs.readFileSync('cert.pem'), // 服务器证书
key: fs.readFileSync('key.pem'), // 服务器私钥
ca: fs.readFileSync('ca.pem'), // CA证书（可选，用于客户端认证）
requestCert: false, // 是否要求客户端证书
rejectUnauthorized: true // 拒绝未授权连接
};

const server = https.createServer(options, (req, res) => {
res.writeHead(200);
res.end('Secure Connection Established');
});

server.listen(443);

客户端配置 (Node.js)

const https = require('https');
const fs = require('fs');

const options = {
hostname: 'example.com',
port: 443,
path: '/',
method: 'GET',
ca: fs.readFileSync('ca.pem'), // 用于验证服务器证书
cert: fs.readFileSync('client-cert.pem'), // 客户端证书（双向认证）
key: fs.readFileSync('client-key.pem') // 客户端私钥
};

const req = https.request(options, (res) => {
console.log('statusCode:', res.statusCode);
});

req.end();

安全要点

常见问题排查

通过正确配置和使用这三种证书文件，可以确保客户端和服务器之间建立安全的加密通信通道，防止中间人攻击和数据泄露。