RSA证书链验证

1、获得rsa证书链

2、验证原理

签名原理：

H=HASH(M)

C=H^d mod N

验签：

H’=C^e mod N

H’ = H

3、获取公钥

获取上级证书公钥，使用工具解析二级证书

得到数据：

0382010f003082010a0282010100c70e6c3f23937fcc70a59d20c30e533f7ec04ec29849ca47d523ef03348574c8a3022e465c0b7dc9889d4f8bf0f89c6c8c5535dbbff2b3eafbe356e74a46d91322ca36d59bc1a8e3964393f20cbce6f9e6e899c86348787f5736691a191d5ad1d47dc29cd47fe18012ae7aea88ea57d8ca0a0a3a1249a262197a0d24f737ebb473927b05239b12b5ceeb29dfa41402b901a5d4a69c436488def87efee3f51ee5fedca3a8e46631d94c25e918b9895909aee99d1c6d370f4a1e352028e2afd4218b01c445ad6e2b63ab926b610a4d20ed73ba7ccefe16b5db9f80f0d68b6cd908794a4f7865da92bcbe35f9b3c4f927804eff9652e60220e10773e95d2bbdb2f10203010001

解析数据：

d

得到N

c70e6c3f23937fcc70a59d20c30e533f7ec04ec29849ca47d523ef03348574c8a3022e465c0b7dc9889d4f8bf0f89c6c8c5535dbbff2b3eafbe356e74a46d91322ca36d59bc1a8e3964393f20cbce6f9e6e899c86348787f5736691a191d5ad1d47dc29cd47fe18012ae7aea88ea57d8ca0a0a3a1249a262197a0d24f737ebb473927b05239b12b5ceeb29dfa41402b901a5d4a69c436488def87efee3f51ee5fedca3a8e46631d94c25e918b9895909aee99d1c6d370f4a1e352028e2afd4218b01c445ad6e2b63ab926b610a4d20ed73ba7ccefe16b5db9f80f0d68b6cd908794a4f7865da92bcbe35f9b3c4f927804eff9652e60220e10773e95d2bbdb2f1

E:

010001

4、获取签名值

使用工具解析三级证书，在签名值域中截取上级证书的签名值

签名值：

a342942b15397861c8c144ff544fd0801abf9f94fd094484bbaa6981b46d6cd09f41c0aba59e10dc47b27daa4caf91ef7f70e8457f3442550ac669ab5b92cdd59fd24927600b853fb39320008d3f7b71b0e6ec7100063b682d0d618da4a936389c9bf7e4e14acb6b5d56abb6470877d59ee96d18f3c49d36e2d2e9fe729cc260bebd759f611642a9339848c829e97420eca833a07eca5c1b5f832fc347b3fecd2145f37628eb3419b9178117d19c7252ea6e3ad1024ced63a0e5e18c9111bf80ad88dee67e1037fdb8f60df38b9d875a10c884935229f4d07087af1e9f75dc16dc102c163d22eaa1f0c9fbbed8afe64d9acdd1ac62165c14108101e5284610c2

5、工具验证

得到结果H`：
01 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00 30 31 30 0D 06 09 60 86 48 01 65 03 04 02 01 05 00 04 20 AF D0 61 E0 0A 08 FF C1 B5 B8 B4 50 8F 70 C3 1E 9B FC 86 3C CD A7 0C AC A4 C5 CE D2 52 B9 68 5D

因为上图中，可以看到证书使用的签名算法为SHA256，故数据后32字节为哈希值

哈希值：

AFD061E00A08FFC1B5B8B4508F70C31E9BFC863CCDA70CACA4C5CED252B9685D

到这一步基本可以说明，证书链验证通过了，如果觉得不太能确认的话，可以通过对三级证书签名原文hash，验证是否同上述哈希值一致，一致则证明验证通过。

6、获取签名原文

得到签名原文：
30820928a003020102020c1198724f6674a3d621bfbea2300d06092a864886f70d01010b05003066310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d7361313c303a06035504031333476c6f62616c5369676e204f7267616e697a6174696f6e2056616c69646174696f6e204341202d20534841323536202d204732301e170d3232303232313038343230325a170d3232303830323031313630335a3081a7310b300906035504061302434e3110300e060355040813076265696a696e673110300e060355040713076265696a696e6731253023060355040b131c73657276696365206f7065726174696f6e206465706172746d656e7431393037060355040a13304265696a696e67204261696475204e6574636f6d20536369656e636520546563686e6f6c6f677920436f2e2c204c7464311230100603550403130962616964752e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100aa47cec86b2f1d70abcf8aba037f7470f51dfe80e2bf228d0d10ac9fd4febb1f594188ccd57fbdd3195e5e4623600859e3f00f26440ee18642e6c0562a0b1350efff5380318e13aa7c79b39d7b509fb6086f629cf20a064e0763728dce7922928a9ccc797dfc3b8b9f5946ee230a674653631c235ba87e1f0449bb0b94d05ea8030cbe11bae7517793edc052c6e4e7b0c26912b1bdc847ad2fef5e3139a607c49cc7a9af4fcbcfa17336c50f0b6d951dcc6d7986037655362905894e6a091caadc8783a43bf6f93decdbdf878fa1c8192ecc19a8988f2ace3db0363ad16588e5027b498da2ce2bea4c1391093c098fb32d827977b6a85431e006512aba29acd10203010001a38206aa308206a6300e0603551d0f0101ff0404030205a03081a006082b06010505070101048193308190304d06082b060105050730028641687474703a2f2f7365637572652e676c6f62616c7369676e2e636f6d2f6361636572742f67736f7267616e697a6174696f6e76616c73686132673272312e637274303f06082b060105050730018633687474703a2f2f6f637370322e676c6f62616c7369676e2e636f6d2f67736f7267616e697a6174696f6e76616c73686132673230560603551d20044f304d304106092b06010401a03201143034303206082b06010505070201162668747470733a2f2f7777772e676c6f62616c7369676e2e636f6d2f7265706f7369746f72792f3008060667810c01020230090603551d130402300030490603551d1f04423040303ea03ca03a8638687474703a2f2f63726c2e676c6f62616c7369676e2e636f6d2f67732f67736f7267616e697a6174696f6e76616c7368613267322e63726c308203610603551d110482035830820354820962616964752e636f6d8212636c69636b2e686d2e62616964752e636f6d8210636d2e706f732e62616964752e636f6d82106c6f672e686d2e62616964752e636f6d82147570646174652e70616e2e62616964752e636f6d8210776e2e706f732e62616964752e636f6d82082a2e39312e636f6d820b2a2e6169706167652e636e820c2a2e6169706167652e636f6d820d2a2e61706f6c6c6f2e6175746f820b2a2e62616964752e636f6d820e2a2e62616964756263652e636f6d82122a2e6261696475636f6e74656e742e636f6d820e2a2e62616964757063732e636f6d82112a2e62616964757374617469632e636f6d820e2a2e626169667562616f2e636f6d820f2a2e6263652e62616964752e636f6d820d2a2e626365686f73742e636f6d820b2a2e6264696d672e636f6d820e2a2e62647374617469632e636f6d820d2a2e6264746a7263762e636f6d82112a2e626a2e62616964756263652e636f6d820d2a2e636875616e6b652e636f6d82112a2e636c6f75642e62616964752e636f6d820b2a2e646c6e656c2e636f6d820b2a2e646c6e656c2e6f726782122a2e647565726f732e62616964752e636f6d82102a2e6579756e2e62616964752e636f6d82112a2e66616e79692e62616964752e636f6d82112a2e677a2e62616964756263652e636f6d82122a2e68616f3132332e62616964752e636f6d820c2a2e68616f3132332e636f6d820c2a2e68616f3232322e636f6d820c2a2e68616f6b616e2e636f6d820e2a2e696d2e62616964752e636f6d820f2a2e6d61702e62616964752e636f6d820f2a2e6d62642e62616964752e636f6d820c2a2e6d697063646e2e636f6d82102a2e6e6577732e62616964752e636f6d820b2a2e6e756f6d692e636f6d820f2a2e7061652e62616964752e636f6d82102a2e736166652e62616964752e636f6d820e2a2e736d617274617070732e636e820e2a2e73752e62616964752e636f6d820d2a2e7472757374676f2e636f6d82112a2e76642e62647374617469632e636f6d82122a2e7875657368752e62616964752e636f6d820b61706f6c6c6f2e6175746f820c626169667562616f2e636f6d820664777a2e636e820f6d63742e792e6e756f6d692e636f6d820c7777772e62616964752e636e82107777772e62616964752e636f6d2e636e301d0603551d250416301406082b0601050507030106082b06010505070302301f0603551d2304183016801496de61f1bd1c1629531cc0cc7d3b830040e61a7c301d0603551d0e041604141bba4b2a9d07786286645bff7f2973338029a12f3082017d060a2b06010401d6790204020482016d0482016901670076006f5376ac31f03119d89900a45115ff77151c11d902c10029068db2089a37d9130000017f1b71e6380000040300473045022100843d85bbe019fd70a98ddecf8bc4f56ff3d601397ca864ae713198e54c93027002201179dcab6868b9a677bc9a2366173ab16b43366ab38c5849984e2c035455284a0075002979bef09e393921f056739f63a577e5be577d9c600af8f94d5d265c255dc7840000017f1b71e63a000004030046304402200e2389e7ce535f33ec7e8e7e4688026dfb0c3a3a910727af38f9b11f73f6b22c0220500aeac81380d546951fcc258701c6ae020ad084bd9e7f8e8efef0b687dacd330076005581d4c2169036014aea0b9b573c53f0c0e43878702508172fa3aa1d0713d30c0000017f1b71e660000004030047304502205e67fc31a20466c48bfcfd119250bc028944240429ef1ce32faf8483a60a5dc7022100d7d1301a8176be2f8796693a4112590ad60cba2f9825bfc68005d0a17e860f3b

使用SHA256算法对签名原文计算哈希，检查是否一致

得到签名结果：

AFD061E00A08FFC1B5B8B4508F70C31E9BFC863CCDA70CACA4C5CED252B9685D

对比一致，证书链验证通过。