msgid ""
msgstr ""
"Project-Id-Version: Chinese (Simplified Han script) (Boost Beast Translation "
"(zh_Hans))\n"
"Report-Msgid-Bugs-To: \n"
"POT-Creation-Date: 2026-07-25 16:04+0000\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: Chinese (Simplified Han script) <https://"
"insights.cppalliance.org/weblate/projects/boost-beast-documentation-zh_Hans/"
"doc-qbk-03-core-9-ssl-tls-certificate-qbk/zh_Hans/>\n"
"Language: zh_Hans\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"Plural-Forms: nplurals=1; plural=0;\n"
"X-Generator: Weblate 2026.5\n"

#. type: section title
#: 11
msgid "SSL/TLS Certificate"
msgstr "SSL/TLS 证书"

#. type: heading
#: 15
msgid "Certificate Authority"
msgstr "证书授权机构"

#. type: paragraph
#: 17
msgid ""
"A Certificate Authority (CA) is a trusted entity that signs digital "
"certificates, enabling users to verify their authenticity. Rather than "
"storing every individual certificate for each server (which would be "
"impractical due to the sheer volume and frequent renewals), users can store "
"a limited set of root certificates to authenticate server certificates as "
"needed."
msgstr ""
"证书授权机构（CA）是一种可信实体，负责对数字证书进行签名，以便用户验证其真实"
"性。由于服务器证书数量庞大且更新频繁，为每台服务器单独存储所有证书并不现实。"
"因此，用户只需存储有限数量的根证书，即可在需要时验证服务器证书。"

#. type: paragraph
#: 23
msgid ""
"Boost.Asio provides various methods for loading certificate authority "
"certificates:"
msgstr "Boost.Asio 提供多种加载证书授权机构证书的方法："

#. type: list
#: 26
msgid ""
"* [@boost:/doc/html/boost_asio/reference/ssl__context/"
"add_certificate_authority.html "
"`net::ssl::context::add_certificate_authority`]\n"
"* [@boost:/doc/html/boost_asio/reference/ssl__context/add_verify_path.html "
"`net::ssl::context::add_verify_path`]\n"
"* [@boost:/doc/html/boost_asio/reference/ssl__context/load_verify_file.html "
"`net::ssl::context::load_verify_file`]\n"
"* [@boost:/doc/html/boost_asio/reference/ssl__context/"
"set_default_verify_paths.html `net::ssl::context::set_default_verify_paths`]"
msgstr ""
"* [@boost:/doc/html/boost_asio/reference/ssl__context/"
"add_certificate_authority.html "
"`net::ssl::context::add_certificate_authority`]\n"
"* [@boost:/doc/html/boost_asio/reference/ssl__context/add_verify_path.html "
"`net::ssl::context::add_verify_path`]\n"
"* [@boost:/doc/html/boost_asio/reference/ssl__context/load_verify_file.html "
"`net::ssl::context::load_verify_file`]\n"
"* [@boost:/doc/html/boost_asio/reference/ssl__context/"
"set_default_verify_paths.html `net::ssl::context::set_default_verify_paths`]"

#. type: paragraph
#: 31
msgid ""
"It is important to set up peer verification so that the TLS/SSL handshake "
"fails if certificate verification is unsuccessful:"
msgstr "设置对端验证非常重要，这样当证书验证失败时，TLS/SSL 握手也会随之失败："

#. type: paragraph
#: 36
msgid ""
"A client must also verify that the hostname or IP address in the certificate "
"matches the expected one. The [@boost:/doc/html/boost_asio/reference/"
"ssl__host_name_verification.html `net::ssl::host_name_verification`] helper "
"function object can perform this verification according to the rules "
"described in RFC 6125:"
msgstr ""
"客户端还需验证证书中的主机名或 IP 地址是否与预期一致。[@boost:/doc/html/"
"boost_asio/reference/ssl__host_name_verification.html "
"`net::ssl::host_name_verification`] 这个辅助函数对象，可以按照 RFC 6125 描述"
"的规则来完成验证："

#. type: paragraph
#: 44
msgid ""
"A server can also request and verify a client certificate to authenticate "
"the client:"
msgstr "服务器也可以请求并验证客户端证书，以对客户端进行身份认证："

#. type: heading
#: 51
msgid "Server Certificate"
msgstr "服务器证书"

#. type: paragraph
#: 53
msgid ""
"A Server Certificate is a digital certificate that confirms a server's "
"identity as the legitimate destination for a client. It contains a "
"verifiable signature that ensures it was issued by a trusted certificate "
"authority (CA)."
msgstr ""
"服务器证书是一种数字证书，用于确认服务器身份是客户端的合法目的地。它包含可验"
"证的签名，用于确保证书由受信任的证书授权机构（CA）签发。"

#. type: paragraph
#: 57
msgid ""
"When a server certificate is issued by an intermediate certificate "
"authority, and the client lacks those intermediate certificates, the server "
"should provide all the relevant certificates to the client. This allows the "
"client to verify the final certificate in the chain against the root "
"certificate."
msgstr ""
"当服务器证书由中间证书授权机构签发，且客户端缺少这些中间证书时，服务器应向客"
"户端提供所有相关证书。这使得客户端能够根据根证书验证证书链中的最终证书。"

#. type: paragraph
#: 62
msgid ""
"The following Boost.Asio methods can be used for loading a certificate or a "
"certificate chain:"
msgstr "以下 Boost.Asio 方法可用于加载单个证书或证书链："

#. type: list
#: 65
msgid ""
"* [@boost:/doc/html/boost_asio/reference/ssl__context/use_certificate.html "
"`net::ssl::context::use_certificate`]\n"
"* [@boost:/doc/html/boost_asio/reference/ssl__context/"
"use_certificate_file.html `net::ssl::context::use_certificate_file`]\n"
"* [@boost:/doc/html/boost_asio/reference/ssl__context/"
"use_certificate_chain.html `net::ssl::context::use_certificate_chain`]\n"
"* [@boost:/doc/html/boost_asio/reference/ssl__context/"
"use_certificate_chain_file.html "
"`net::ssl::context::use_certificate_chain_file`]"
msgstr ""
"* [@boost:/doc/html/boost_asio/reference/ssl__context/use_certificate.html "
"`net::ssl::context::use_certificate`]\n"
"* [@boost:/doc/html/boost_asio/reference/ssl__context/"
"use_certificate_file.html `net::ssl::context::use_certificate_file`]\n"
"* [@boost:/doc/html/boost_asio/reference/ssl__context/"
"use_certificate_chain.html `net::ssl::context::use_certificate_chain`]\n"
"* [@boost:/doc/html/boost_asio/reference/ssl__context/"
"use_certificate_chain_file.html "
"`net::ssl::context::use_certificate_chain_file`]"

#. type: heading
#: 72
msgid "Client Certificate"
msgstr "客户端证书"

#. type: paragraph
#: 74
msgid ""
"A server can authenticate clients by requiring and verifying their "
"certificates, preventing access for those without a valid certificate and "
"private key. The server enforces this by modifying peer verification "
"settings:"
msgstr ""
"服务器可以通过要求并验证客户端证书来对客户端进行身份认证，从而阻止没有有效证"
"书和私钥的客户端访问。服务器通过修改对端验证设置来实施这一机制："

#. type: paragraph
#: 80
msgid ""
"If used, the necessary CA certificates must be loaded into the server's SSL "
"context to enable verification of the client's certificate."
msgstr ""
"若使用该机制，则需将必要的 CA 证书加载到服务器的 SSL 上下文中，以便能够验证客"
"户端的证书。"

#. type: heading
#: 85
msgid "Common Name and Subject Alternative Name"
msgstr "通用名称与主题备用名称"

#. type: paragraph
#: 87
msgid ""
"The Subject Alternative Name (SAN) is an extension in X.509 certificates "
"that allows multiple domain names, subdomains, or IP addresses to be "
"associated with a single SSL/TLS certificate. Before that it was the Common "
"Name field in the certificate subject which could contain a single hostname."
msgstr ""
"主题备用名称（SAN）是 X.509 证书中的一种扩展字段，允许将多个域名、子域名或 "
"IP 地址关联到同一张 SSL/TLS 证书上。在此之前，证书主题中的通用名称字段只能包"
"含单个主机名。"

#. type: paragraph
#: 93
msgid ""
"recommends that if a certificate includes a SAN dNSName field, the client "
"must ignore the subject CN field. Some modern browsers, such as Google "
"Chrome, check only the SAN section in an SSL/TLS certificate and reject "
"certificates that contain only the CN field."
msgstr ""
"该建议指出，如果证书中包含 SAN 的 dNSName 字段，客户端必须忽略主题 CN 字段。"
"某些现代浏览器（例如 Google Chrome）仅检查 SSL/TLS 证书中的 SAN 部分，并拒绝"
"仅包含 CN 字段的证书。"

#. type: heading
#: 100
msgid "Private Key"
msgstr "私钥"

#. type: paragraph
#: 102
msgid ""
"The private key of a certificate is required during the SSL/TLS handshake to "
"prove that the certificate's provider is its rightful owner"
msgstr ""
"证书的私钥在 SSL/TLS 握手过程中是必需的，用于证明证书的提供方是该证书的合法所"
"有者。"

#. type: paragraph
#: 105
msgid "The following Boost.Asio methods can be used for loading a private key:"
msgstr "以下 Boost.Asio 方法可用于加载私钥："

#. type: list
#: 107
msgid ""
"* [@boost:/doc/html/boost_asio/reference/ssl__context/use_private_key.html "
"`net::ssl::context::use_private_key`]\n"
"* [@boost:/doc/html/boost_asio/reference/ssl__context/"
"use_private_key_file.html `net::ssl::context::use_private_key_file`]\n"
"* [@boost:/doc/html/boost_asio/reference/ssl__context/"
"use_rsa_private_key.html `net::ssl::context::use_rsa_private_key`]\n"
"* [@boost:/doc/html/boost_asio/reference/ssl__context/"
"use_rsa_private_key_file.html `net::ssl::context::use_rsa_private_key_file`]"
msgstr ""
"* [@boost:/doc/html/boost_asio/reference/ssl__context/use_private_key.html "
"`net::ssl::context::use_private_key`]\n"
"* [@boost:/doc/html/boost_asio/reference/ssl__context/"
"use_private_key_file.html `net::ssl::context::use_private_key_file`]\n"
"* [@boost:/doc/html/boost_asio/reference/ssl__context/"
"use_rsa_private_key.html `net::ssl::context::use_rsa_private_key`]\n"
"* [@boost:/doc/html/boost_asio/reference/ssl__context/"
"use_rsa_private_key_file.html `net::ssl::context::use_rsa_private_key_file`]"

#. type: paragraph
#: 112
msgid ""
"If the private key is secured with a password, the [@boost:/doc/html/"
"boost_asio/reference/ssl__context/set_password_callback.html "
"net::ssl::context::set_password_callback] allows specifying a callable "
"object to retrieve the password."
msgstr ""
"如果私钥受密码保护，可以使用 [@boost:/doc/html/boost_asio/reference/"
"ssl__context/set_password_callback.html "
"net::ssl::context::set_password_callback] 设置一个可调用对象，用于获取该密码"
"。"

#. type: heading
#: 119
msgid "Self-Signed and Self-Issued Certificates"
msgstr "自签名证书与自颁发证书"

#. type: paragraph
#: 121
msgid ""
"A self-issued certificate is a certificate where the issuer and subject are "
"the same entity."
msgstr "自颁发证书是指证书的颁发者与主体为同一实体。"

#. type: paragraph
#: 124
msgid ""
"A self-signed certificate is a self-issued certificate in which the digital "
"signature can be verified using the public key within the certificate."
msgstr "自签名证书是一种自颁发证书，其数字签名可使用证书内的公钥进行验证。"

#. type: paragraph
#: 128
msgid ""
"Installing an untrusted, self-issued, or self-signed CA certificate poses a"
msgstr "安装不受信任、自颁发或自签名的 CA 证书会带来安全风险。"

#. type: heading
#: 137
msgid "Diffie-Hellman (DH) Parameters"
msgstr "Diffie-Hellman（DH）参数"

#. type: paragraph
#: 139
msgid ""
"Diffie-Hellman (DH) key exchange is a cryptographic protocol that allows two "
"parties to securely establish a shared secret over an insecure communication "
"channel. The key exchange process involves both parties agreeing on a set of "
"parameters, known as Diffie-Hellman parameters, which include a large prime "
"number `p` and a generator `g`. Since generating these parameters is a "
"computationally expensive task, a user might prefer to provide a precomputed "
"value at startup."
msgstr ""
"Diffie-Hellman（DH）密钥交换是一种密码学协议，允许双方在不安全的通信通道上安"
"全地建立共享密钥。该密钥交换过程涉及双方约定一组参数，即 Diffie-Hellman 参数"
"，其中包括一个大素数 `p` 和一个生成元 `g`。由于生成这些参数是一项计算开销较大"
"的任务，用户可能更倾向于在启动时提供预先计算好的值。"

#. type: paragraph
#: 147
msgid "The following Boost.Asio methods can be used for loading DH parameters:"
msgstr "以下 Boost.Asio 方法可用于加载 DH 参数："

#. type: list
#: 149
msgid ""
"* [@boost:/doc/html/boost_asio/reference/ssl__context/use_tmp_dh.html "
"`net::ssl::context::use_tmp_dh`]\n"
"* [@boost:/doc/html/boost_asio/reference/ssl__context/use_tmp_dh_file.html "
"`net::ssl::context::use_tmp_dh_file`]"
msgstr ""
"* [@boost:/doc/html/boost_asio/reference/ssl__context/use_tmp_dh.html "
"`net::ssl::context::use_tmp_dh`]\n"
"* [@boost:/doc/html/boost_asio/reference/ssl__context/use_tmp_dh_file.html "
"`net::ssl::context::use_tmp_dh_file`]"

#. type: paragraph
#: 152
msgid ""
"If no DH parameter is provided, OpenSSL will refuse to perform any handshake "
"that uses DHE-based cipher suites but will still work with other cipher "
"suites, such as those based on ECDHE."
msgstr ""
"如果未提供 DH 参数，OpenSSL 将拒绝执行任何使用基于 DHE 的加密套件的握手，但仍"
"可与其他加密套件（例如基于 ECDHE 的套件）正常工作。"

#. type: heading
#: 158
msgid "A Self-Issued Certificate Example"
msgstr "自颁发证书示例"

#. type: paragraph
#: 160
msgid ""
"In the following example, we will generate a self-signed CA certificate and "
"use it to issue both server and client certificates."
msgstr ""
"在以下示例中，将生成一个自签名的 CA 证书，并使用该证书来签发服务器证书和客户"
"端证书。"

#. type: list
#: 163
msgid "* Generate a CA certificate:"
msgstr "* 生成 CA 证书："

#. type: paragraph
#: 165
msgid ""
"``` openssl req -new -newkey rsa:4096 -keyout ca.key -x509 -out ca.crt -subj "
"\"/CN=localhost\" -days 365 ```"
msgstr ""
"``` openssl req -new -newkey rsa:4096 -keyout ca.key -x509 -out ca.crt -subj "
"\"/CN=localhost\" -days 365 ```"

#. type: list
#: 170
msgid "* Generate a Server CSR:"
msgstr "* 生成服务器证书签名请求（CSR）："

#. type: paragraph
#: 172
msgid ""
"``` openssl req -new -newkey rsa:4096 -keyout server.key -out server.csr -"
"subj \"/CN=localhost\" -addext \"subjectAltName=DNS:localhost,IP:127.0.0.1\" "
"```"
msgstr ""
"``` openssl req -new -newkey rsa:4096 -keyout server.key -out server.csr -"
"subj \"/CN=localhost\" -addext \"subjectAltName=DNS:localhost,IP:127.0.0.1\" "
"```"

#. type: list
#: 177
msgid "* Sign the Server CSR using our CA:"
msgstr "* Sign the Server CSR using our CA:"

#. type: paragraph
#: 179
msgid ""
"``` openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -"
"copy_extensions copy -days 365 -out server.crt ```"
msgstr ""
"``` openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -"
"copy_extensions copy -days 365 -out server.crt ```"

#. type: list
#: 184
msgid "* Generate a Client CSR:"
msgstr "* 生成客户端证书签名请求（CSR）："

#. type: paragraph
#: 186
msgid ""
"``` openssl req -new -newkey rsa:4096 -keyout client.key -out client.csr -"
"subj \"/CN=client.1\" ```"
msgstr ""
"``` openssl req -new -newkey rsa:4096 -keyout client.key -out client.csr -"
"subj \"/CN=client.1\" ```"

#. type: list
#: 191
msgid "* Sign the Client CSR using our CA:"
msgstr "* 使用 CA 对客户端 CSR 进行签名："

#. type: paragraph
#: 193
msgid ""
"``` openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -days 365 -out "
"client.crt ```"
msgstr ""
"``` openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -days 365 -out "
"client.crt ```"

#. type: list
#: 197
msgid "* Generate a DH parameters file:"
msgstr "* 生成 DH 参数文件："

#. type: paragraph
#: 199
msgid "``` openssl dhparam -out dh4096.pem 4096 ```"
msgstr "``` openssl dhparam -out dh4096.pem 4096 ```"

#. type: paragraph
#: 203
msgid "Server example: [path_link example/doc/ssl/server.cpp server.cpp]"
msgstr "服务器端示例：[path_link example/doc/ssl/server.cpp server.cpp]"

#. type: paragraph
#: 205
msgid ""
"Note that the server is configured in such a way that it requests and "
"verifies the client certificate. You can disable this by commenting out the "
"related line in the example."
msgstr ""
"注意，该服务器的配置方式要求对客户端证书进行请求和验证。如果需要禁用此功能，"
"可以注释掉示例中的相关代码行。"

#. type: paragraph
#: 209
msgid "You can test the server using this cURL command:"
msgstr "可以使用以下 cURL 命令测试该服务器："

#. type: paragraph
#: 211
msgid ""
"``` curl https://localhost:8080 --cacert ca.crt --cert client.crt --key "
"client.key ```"
msgstr ""
"``` curl https://localhost:8080 --cacert ca.crt --cert client.crt --key "
"client.key ```"

#. type: paragraph
#: 215
msgid ""
"Also, you can use the client example: [path_link example/doc/ssl/client.cpp "
"client.cpp]"
msgstr "此外，也可以使用客户端示例：[path_link example/doc/ssl/client.cpp client.cpp]"