trust CA 证书不完整导致return code: 21 (unable to verify the first certificate)

最新推荐文章于 2024-10-27 21:24:06 发布

weixin_40455124

最新推荐文章于 2024-10-27 21:24:06 发布

阅读量2.8k

点赞数

分类专栏：架构 other 文章标签： trust CA first certificate verify

本文链接：https://blog.csdn.net/weixin_40455124/article/details/118500544

版权

架构同时被 2 个专栏收录

77 篇文章

订阅专栏

other

9 篇文章

订阅专栏

本文讨论了在HTTPS请求中遇到的证书不可信问题，特别是Self-signed CA的情况。同时，介绍了如何通过openssl s_client -showcerts -connect命令检测证书的完整性，正常情况下应显示完整的证书链。如果证书链不完整，可能会导致验证失败，如returncode:21。正确配置和验证证书链对于确保安全的HTTPS连接至关重要。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

Self-signed CA在https请求时候会返回证书不可信，而trust CA如果不是完整（三段模式）的证书，那么在使用代码进行https访问时候的时候，会返回：
return code: 21 (unable to verify the first certificate)

而web访问是没有问题。

如何检测是否完整，可以使用openssl s_client -showcerts -connect xxx.xxx.com:443 进行检测，以下为一个完整CA的示意

openssl s_client -showcerts -connect xxx.xxx.com:443
CONNECTED(00000003)
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
verify return:1
depth=1 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = GeoTrust RSA CA 2018
verify return:1
depth=0 C = HK, L = NAMES, O = XXXX COMPANY LITMIED, OU = IT, CN = xxx.xxx.com
verify return:1
---
Certificate chain
 0 s:/C=HK/L=NAMES/O=XXXX COMPANY LITMIED/OU=IT/CN=xxx.xxx.com
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=GeoTrust RSA CA 2018
-----BEGIN CERTIFICATE-----
MIIGiDCCBXCgAwIBAgIQBEk45aoynOBaYY9spdyEVzANBgkqhkiG9w0BAQsFADBe
MQswCQYDVQQGEwJVUzE
-----END CERTIFICATE-----
 1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=GeoTrust RSA CA 2018
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root CA
-----BEGIN CERTIFICATE-----
MIIEizCCA3OgAwIBAgIQBUb+GCP34ZQdo5/OFMRhczANBgkqhkiG9w0BAQsFADBh
MQswCQYDVQQGEwJVUzEVMBMGA1U 
B0AFsQ+DU0NCO+f78Xf7
-----END CERTIFICATE-----
 2 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root CA
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root CA
-----BEGIN CERTIFICATE-----
MIIDrzCCApegAwIBAgIQCDvgVpB 
-----END CERTIFICATE-----
---
Server certificate
subject=/C=HK/L=NAMES/O=XXXX COMPANY LITMIED/OU=IT/CN=xxx.xxx.com
issuer=/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=GeoTrust RSA CA 2018
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 4471 bytes and written 415 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: XXXXXXXXXXXXXXXXXXXX
    Session-ID-ctx: 
    Master-Key: XXXXXXXXXXXXXXXXXXXXXXXX
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    TLS session ticket lifetime hint: 3600 (seconds)
    TLS session ticket:
    0000 - 2c 47 b1 75 f6 18 a9 c9-10 90 c1 08 ba ed d7 ec   ,G.u............
    

    Start Time: 1625472287
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---

而异常的应该只有1段或者2段

-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----