Cryptography 证书哈希材料究竟应该是什么？验证x.509证书_Cryptography_Certificate_Ssl Certificate_X509certificate_Verify

Cryptography 证书哈希材料究竟应该是什么？验证x.509证书

cryptography certificate

Cryptography 证书哈希材料究竟应该是什么？验证x.509证书,cryptography,certificate,ssl-certificate,x509certificate,verify,Cryptography,Certificate,Ssl Certificate,X509certificate,Verify,所以散列材料是TBS证书字段。此字段值应为asn.1解码值还是asn.1编码值？id是“1.2.840.113549.1.1.5”还是“sha1RSA” TBSCertificate ::= SEQUENCE { version [0] EXPLICIT Version DEFAULT v1, serialNumber CertificateSerialNumber, signature Algor

所以散列材料是TBS证书字段。此字段值应为asn.1解码值还是asn.1编码值？id是“1.2.840.113549.1.1.5”还是“sha1RSA”

      TBSCertificate  ::=  SEQUENCE  {
    version         [0]  EXPLICIT Version DEFAULT v1,
    serialNumber         CertificateSerialNumber,
    signature            AlgorithmIdentifier,
    issuer               Name,
    validity             Validity,
    subject              Name,
    subjectPublicKeyInfo SubjectPublicKeyInfo,
    issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL,
                         -- If present, version MUST be v2 or v3
    subjectUniqueID [2]  IMPLICIT UniqueIdentifier OPTIONAL,
                         -- If present, version MUST be v2 or v3
    extensions      [3]  EXPLICIT Extensions OPTIONAL
                         -- If present, version MUST be v3
    }

如

对于签名，将要签名的数据使用ASN.1编码规则（DER）[X.690]进行编码。ASN.1 DER编码是每个元素的标记、长度、值编码系统

所以它应该是asn.1编码的值

对于签名算法，RFC5280在中指定了支持的算法。有3个其他RFC的参考资料

i、 e.RFC5280包含一个使用签名算法的自签名证书示例。

这是我自己的证书 `

这是我解密后的签名：

0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 纯散列：752D3360BC92E11322E1F1FA540B4A88E8C8B1F6F6==TBS证书散列应如下所示

我计算BASE64解码获取DER证书。然后过滤TBS证书和（字节码）sha1哈希。然后转换hex=752D3360BC92E11322E1F1FA540B4A88E8C8B1F6F6。谢谢@PEPO

所以asn.1编码的DER格式tbs证书字段应该散列。但是我的签名与该散列不匹配。第4.1.1.3节说，

signatureValue字段包含根据ASN.1 DER编码的tbsCertificate计算的数字签名。ASN.1 DER编码的tbsCertificate用作签名函数的输入。

您可能做错了：）。尝试使用打开相应的数据是bouncycastle sources.im在纯python上编写的CheckCertificate的一个示例。你能解释一下如何散列tbs证书字段吗。解密RSA：0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF003021300 906052B00E03021A050004140F83568D44CED9CFD0CD3D4EB6305B9BBCA0560C为最后20字节。所以我的证书哈希应该是0f83568d。。布拉布拉0560c