x509 证书
本文分析 x509 的证书的颁发过程
我们使用 acme.sh 请求证书会得到如下文件
root@localhost:~/.acme.sh/domain.com_ecc# ls
ca.cer domain.com.cer domain.com.csr domain.com.key
fullchain.cer domain.com.conf domain.com.csr.conf
其中 .conf 是配置文件，不必理会
domain.com.key
是私钥文件，使用 openssl 查看如下
root@localhost:~/.acme.sh/domain.com_ecc# openssl pkey -in domain.com.key -text -noout
Private-Key: (256 bit)
priv:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx
pub:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx
ASN1 OID: prime256v1
NIST CURVE: P-256
可以看出来使用了椭圆曲线签名算法，椭圆是 P-256 参数固定 priv 部分是私钥，一个数字 pub 部分是公钥，一个坐标 椭圆曲线算法的第一步是 Q=dG G 是 P-256 固定的参数 d 是私钥 Q 是公钥坐标
domain.com.crt
root@localhost:~/.acme.sh/domain.com_ecc# openssl x509 -in domain.com.cer -text -noout
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx
Signature Algorithm: ecdsa-with-SHA384
Issuer: C = US, O = Let's Encrypt, CN = YE2
Validity
Not Before: Jan 01 00:00:00 2026 GMT
Not After : Apr 01 00:00:00 2026 GMT
Subject: CN = domain.com
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Public-Key: (256 bit)
pub:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx
ASN1 OID: prime256v1
NIST CURVE: P-256
X509v3 extensions:
X509v3 Key Usage: critical
Digital Signature
X509v3 Extended Key Usage:
TLS Web Server Authentication
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Subject Key Identifier:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx
X509v3 Authority Key Identifier:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx
Authority Information Access:
CA Issuers - URI:http://ye2.i.lencr.org/
X509v3 Subject Alternative Name:
DNS:domain.com
X509v3 Certificate Policies:
Policy: 2.23.140.1.2.1
X509v3 CRL Distribution Points:
Full Name:
URI:http://ye2.c.lencr.org/51.crl
CT Precertificate SCTs:
Signed Certificate Timestamp:
Version : v1 (0x0)
Log ID : xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx
Timestamp : Jan 01 00:00:00 2026 GMT
Extensions: none
Signature : ecdsa-with-SHA256
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx:xx:xx
Signed Certificate Timestamp:
Version : v1 (0x0)
Log ID : xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx
Timestamp : Jan 01 00:00:00 2026 GMT
Extensions: xx:xx:xx:xx:xx:xx:xx:xx
Signature : ecdsa-with-SHA256
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx:xx:xx
Signature Algorithm: ecdsa-with-SHA384
Signature Value:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx
开头和结尾的 Signature Algorithm: ecdsa-with-SHA384 说的都是一件事情，签名者给这个证书使用 sha384 算法加上 椭圆曲线数字签名算法签名，签名的结果在 Signature Value 里面 Issuer 显示了签名者 Validity 显示了证书有效期 Subject 和 X509v3 Subject Alternative Name 显示了域名 Subject Public Key Info 显示证书的公钥
ca.cer
有几个证书
root@localhost:~/.acme.sh/domain.com_ecc# openssl crl2pkcs7 -nocrl -certfile ca.cer | openssl pkcs7 -print
_certs -noout
subject=C = US, O = Let's Encrypt, CN = YE2
issuer=C = US, O = ISRG, CN = Root YE
subject=C = US, O = ISRG, CN = Root YE
issuer=C = US, O = Internet Security Research Group, CN = ISRG Root X2
subject=C = US, O = Internet Security Research Group, CN = ISRG Root X2
issuer=C = US, O = Internet Security Research Group, CN = ISRG Root X1
可以看出来签名的过程 ISRG Root X1 是位于系统库的自签名证书 位置在 /etc/ssl/certs/ISRG_Root_X1.pem
fullchain.cer
简单来说 fullchain = .cer + ca.cer
domain.com.csr
root@localhost:~/.acme.sh/domain.com_ecc# openssl req -in domain.com.csr -text -noout
Certificate Request:
Data:
Version: 1 (0x0)
Subject: CN = domain.com
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Public-Key: (256 bit)
pub:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx
ASN1 OID: prime256v1
NIST CURVE: P-256
Attributes:
Requested Extensions:
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 Subject Alternative Name:
DNS:domain.com
Signature Algorithm: ecdsa-with-SHA256
Signature Value:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx
自己生成的，并且用自己的私钥签名，交给 ca 证书，请求颁发证书