我有以下代碼來(lái)創(chuàng)建自簽名證書(shū)：SubjectAlternativeNameBuilder subjectAlternativeNameBuilder = new SubjectAlternativeNameBuilder();
subjectAlternativeNameBuilder.AddDnsName("TestSRV01);
X500DistinguishedName x500DistinguishedName = new X500DistinguishedName($"CN=Self-Signed-Test");
using (RSA rsa = RSA.Create(2048))
{
var certificateRequest = new CertificateRequest(x500DistinguishedName, rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
certificateRequest.CertificateExtensions.Add(new X509KeyUsageExtension(X509KeyUsageFlags.DataEncipherment | X509KeyUsageFlags.KeyEncipherment | X509KeyUsageFlags.DigitalSignature, false));
certificateRequest.CertificateExtensions.Add(new X509EnhancedKeyUsageExtension(new OidCollection { new Oid("2.5.29.32.0"), new Oid("1.3.6.1.5.5.7.3.1") }, false));
certificateRequest.CertificateExtensions.Add(subjectAlternativeNameBuilder.Build());
var certificate = certificateRequest.CreateSelfSigned(new DateTimeOffset(DateTime.UtcNow.AddDays(-1)), new DateTimeOffset(DateTime.UtcNow.AddDays(3650)));
return new X509Certificate2(certificate.Export( X509ContentType.Cert, pw), pw, X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.Exportable);
}我只添加服務(wù)器的 DNS 名稱，以避免綁定到當(dāng)前 IP 地址（測(cè)試機(jī)器在不同網(wǎng)絡(luò)中移動(dòng)）。事實(shí)證明，當(dāng)我從客戶端連接時(shí)，我需要使用 IP 地址（測(cè)試站點(diǎn)上的 DNS 解析不可靠）。不幸的是，SSL 連接失敗并顯示以下消息：（主機(jī)名 192.168.0.*** 未驗(yàn)證：證書(shū)：sha256/UuUOTTQTCb2wu************************ DN：CN=我無(wú)法將證書(shū)綁定到該地址，但也無(wú)法使用域名作為連接參數(shù)。我可以圍繞這個(gè)問(wèn)題創(chuàng)建一個(gè)可用的證書(shū)嗎？或者我應(yīng)該在計(jì)算機(jī)啟動(dòng)時(shí)修改證書(shū)值并將當(dāng)前 IP 地址添加到列表中SubjectAlternativeName？
如何在不同網(wǎng)絡(luò)上創(chuàng)建和使用基于 DNS 的自簽名證書(shū)
慕田峪9158850
2023-09-16 17:17:13
