SSL 详细信息：检查基本限制

---

---

####<Nov 3, 2004 9:31:54 PM IST> <Debug> <TLS> <THE-ONE> <myserver> <main> <kernel identity> <> <000000> <SSLManager.getServerCertificate()>
####<Nov 3, 2004 9:31:55 PM IST> <Info> <Security> <THE-ONE> <myserver> <main> <kernel identity> <> <090515> <The certificate chain could not be completely checked for issues which could cause it to be rejected by a peer during SSL handshaking, no action is required unless peers are rejecting the certificate chain.>
####<Nov 3, 2004 9:31:55 PM IST> <Debug> <TLS> <THE-ONE> <myserver> <main> <kernel identity> <> <000000> <Server identity successfully loaded>
####<Nov 3, 2004 9:31:55 PM IST> <Debug> <TLS> <THE-ONE> <myserver> <main> <kernel identity> <> <000000> <SSLManager, getting trusted CAs from cmd line keystore: F:\WLS\bea70sp4\weblogic615\server\lib\cacerts>
####<Nov 3, 2004 9:31:55 PM IST> <Debug> <TLS> <THE-ONE> <myserver> <main> <kernel identity> <> <000000> <Trusted CA: Serial number: 0
Issuer:C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting, OU=Certification Services Division, CN=Thawte Personal Freemail CA, EMAIL=personal-freemail@thawte.com
Subject:C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting, OU=Certification Services Division, CN=Thawte Personal Freemail CA, EMAIL=personal-freemail@thawte.com
Not Valid Before:Mon Jan 01 05:30:00 IST 1996
Not Valid After:Fri Jan 01 05:29:59 IST 2021
Signature Algorithm:MD5withRSA
>
####<Nov 3, 2004 9:31:55 PM IST> <Debug> <TLS> <THE-ONE> <myserver> <main> <kernel identity> <> <000000> <Trusted CA: Serial number: 0
Issuer:C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting, OU=Certification Services Division, CN=Thawte Personal Basic CA, EMAIL=personal-basic@thawte.com
Subject:C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting, OU=Certification Services Division, CN=Thawte Personal Basic CA, EMAIL=personal-basic@thawte.com
Not Valid Before:Mon Jan 01 05:30:00 IST 1996
Not Valid After:Fri Jan 01 05:29:59 IST 2021
Signature Algorithm:MD5withRSA
>
####<Nov 3, 2004 9:31:55 PM IST> <Debug> <TLS> <THE-ONE> <myserver> <main> <kernel identity> <> <000000> <Trusted CA: Serial number: 69042098805081595651034369680212310004
Issuer:C=US, ST=MyState, L=MyTown, O=MyOrganization, OU=FOR TESTING ONLY, CN=CACERT
Subject:C=US, ST=MyState, L=MyTown, O=MyOrganization, OU=FOR TESTING ONLY, CN=CACERT
Not Valid Before:Fri Mar 22 01:42:27 IST 2002
Not Valid After:Wed Mar 23 01:42:27 IST 2022
Signature Algorithm:MD5withRSA
>
####<Nov 3, 2004 9:31:55 PM IST> <Debug> <TLS> <THE-ONE> <myserver> <main> <kernel identity> <> <000000> <Trusted CA: Serial number: 303889516662913207929516869807881060914
Issuer:C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
Subject:C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
Not Valid Before:Mon Jan 29 05:30:00 IST 1996
Not Valid After:Thu Jan 08 05:29:59 IST 2004
Signature Algorithm:MD2withRSA
>
####<Nov 3, 2004 9:31:55 PM IST> <Debug> <TLS> <THE-ONE> <myserver> <main> <kernel identity> <> <000000> <Trusted CA: Serial number: 0
Issuer:C=US, ST=California, L=San Francisco, O=BEA WebLogic, OU=Security, CN=Demo Certificate Authority Constraints, EMAIL=security@bea.com
Subject:C=US, ST=California, L=San Francisco, O=BEA WebLogic, OU=Security, CN=Demo Certificate Authority Constraints, EMAIL=security@bea.com
Not Valid Before:Sat Nov 02 01:32:11 IST 2002
Not Valid After:Tue Oct 17 01:32:11 IST 2006
Signature Algorithm:MD5withRSA
>

---

---

---

---

1. 打开 IE 浏览器
2. 转至“工具”->“Internet 选项”
3. 单击“内容”选项卡，然后单击“证书...”
4. 转至“中间证书颁发机构”选项卡并打开任意 Verisign 或 Thwate 证书
5. 转至“详细信息”选项卡并查出称为“基本限制”的字段

在某些浏览器中，如“Mozilla”，不会出现“基本限制”字段。但是，您可能会看到类似“Object Identifier(2 5 29 19)”的内容。不过，这与 IE 中的“基本限制”字段是相同的。

如果没有“基本限制”字段，则该 CA 证书缺少基本限制，使用此类 CA 证书将显示一条消息，内容为“The certificate chain received from peer contained a V3 CA certificate which was missing the basic constraints extension”

返回页首

控制证书验证
与 WebLogic Server 一起使用的所有 X509 V3 CA 证书均须将“基本限制”扩展定义为 CA，从而确保证书链中的所有证书都是由证书颁发机构签发的。缺省情况下，证书颁发机构的任何证书，如不满足此标准，均会被拒绝。但是，可以使用以下命令行参数来控制证书验证级别：

• Dweblogic.security.SSL.enforceConstraints=option

下面是 -Dweblogic.security.SSL.enforceConstraints 的选项：

• strong / true

此选项用于检查 CA 证书上的“基本限制”扩展是否定义为 CA。缺省情况下，会执行这个级别的验证。

• strict

此选项用于检查 CA 证书上的“基本限制”扩展是否定义为 CA 且设置为 CRITICAL。

• off

此选项会禁用限制检查。不提倡使用此选项（尤其是在“生产”服务器中），因为这会对安全造成威胁。

返回页首