Zen

Translation

type: list
* Sign the Client CSR using our CA:
22/350 · 35

Sign in to save translations.

English Chinese (Simplified Han script) Actions
Diffie-Hellman (DH) Parameters
Diffie-Hellman（DH）参数
Diffie-Hellman (DH) key exchange is a cryptographic protocol that allows two parties to securely establish a shared secret over an insecure communication channel. The key exchange process involves both parties agreeing on a set of parameters, known as Diffie-Hellman parameters, which include a large prime number `p` and a generator `g`. Since generating these parameters is a computationally expensive task, a user might prefer to provide a precomputed value at startup.
Diffie-Hellman（DH）密钥交换是一种密码学协议，允许双方在不安全的通信通道上安全地建立共享密钥。该密钥交换过程涉及双方约定一组参数，即 Diffie-Hellman 参数，其中包括一个大素数 `p` 和一个生成元 `g`。由于生成这些参数是一项计算开销较大的任务，用户可能更倾向于在启动时提供预先计算好的值。
The following Boost.Asio methods can be used for loading DH parameters:
以下 Boost.Asio 方法可用于加载 DH 参数：
* [@boost:/doc/html/boost_asio/reference/ssl__context/use_tmp_dh.html `net::ssl::context::use_tmp_dh`]
* [@boost:/doc/html/boost_asio/reference/ssl__context/use_tmp_dh_file.html `net::ssl::context::use_tmp_dh_file`]
* [@boost:/doc/html/boost_asio/reference/ssl__context/use_tmp_dh.html `net::ssl::context::use_tmp_dh`]
* [@boost:/doc/html/boost_asio/reference/ssl__context/use_tmp_dh_file.html `net::ssl::context::use_tmp_dh_file`]
If no DH parameter is provided, OpenSSL will refuse to perform any handshake that uses DHE-based cipher suites but will still work with other cipher suites, such as those based on ECDHE.
如果未提供 DH 参数，OpenSSL 将拒绝执行任何使用基于 DHE 的加密套件的握手，但仍可与其他加密套件（例如基于 ECDHE 的套件）正常工作。
A Self-Issued Certificate Example
自颁发证书示例
In the following example, we will generate a self-signed CA certificate and use it to issue both server and client certificates.
在以下示例中，将生成一个自签名的 CA 证书，并使用该证书来签发服务器证书和客户端证书。
* Generate a CA certificate:
* 生成 CA 证书：
``` openssl req -new -newkey rsa:4096 -keyout ca.key -x509 -out ca.crt -subj "/CN=localhost" -days 365 ```
``` openssl req -new -newkey rsa:4096 -keyout ca.key -x509 -out ca.crt -subj "/CN=localhost" -days 365 ```
* Generate a Server CSR:
* 生成服务器证书签名请求（CSR）：
``` openssl req -new -newkey rsa:4096 -keyout server.key -out server.csr -subj "/CN=localhost" -addext "subjectAltName=DNS:localhost,IP:127.0.0.1" ```
``` openssl req -new -newkey rsa:4096 -keyout server.key -out server.csr -subj "/CN=localhost" -addext "subjectAltName=DNS:localhost,IP:127.0.0.1" ```
* Sign the Server CSR using our CA:
* Sign the Server CSR using our CA:
``` openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -copy_extensions copy -days 365 -out server.crt ```
``` openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -copy_extensions copy -days 365 -out server.crt ```
* Generate a Client CSR:
* 生成客户端证书签名请求（CSR）：
``` openssl req -new -newkey rsa:4096 -keyout client.key -out client.csr -subj "/CN=client.1" ```
``` openssl req -new -newkey rsa:4096 -keyout client.key -out client.csr -subj "/CN=client.1" ```
* Sign the Client CSR using our CA:
* 使用 CA 对客户端 CSR 进行签名：
``` openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -days 365 -out client.crt ```
``` openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -days 365 -out client.crt ```
* Generate a DH parameters file:
* 生成 DH 参数文件：
``` openssl dhparam -out dh4096.pem 4096 ```
``` openssl dhparam -out dh4096.pem 4096 ```
Server example: [path_link example/doc/ssl/server.cpp server.cpp]
服务器端示例：[path_link example/doc/ssl/server.cpp server.cpp]
Note that the server is configured in such a way that it requests and verifies the client certificate. You can disable this by commenting out the related line in the example.
注意，该服务器的配置方式要求对客户端证书进行请求和验证。如果需要禁用此功能，可以注释掉示例中的相关代码行。
You can test the server using this cURL command:
可以使用以下 cURL 命令测试该服务器：
``` curl https://localhost:8080 --cacert ca.crt --cert client.crt --key client.key ```
``` curl https://localhost:8080 --cacert ca.crt --cert client.crt --key client.key ```
Also, you can use the client example: [path_link example/doc/ssl/client.cpp client.cpp]
此外，也可以使用客户端示例：[path_link example/doc/ssl/client.cpp client.cpp]
English Chinese (Simplified Han script) Actions
* Sign the Client CSR using our CA:
* 使用 CA 对客户端 CSR 进行签名：
A Server Certificate is a digital certificate that confirms a server's identity as the legitimate destination for a client. It contains a verifiable signature that ensures it was issued by a trusted certificate authority (CA).
服务器证书是一种数字证书，用于确认服务器身份是客户端的合法目的地。它包含可验证的签名，用于确保证书由受信任的证书授权机构（CA）签发。
Client Certificate
客户端证书
Common Name and Subject Alternative Name
通用名称与主题备用名称
A Certificate Authority (CA) is a trusted entity that signs digital certificates, enabling users to verify their authenticity. Rather than storing every individual certificate for each server (which would be impractical due to the sheer volume and frequent renewals), users can store a limited set of root certificates to authenticate server certificates as needed.
证书授权机构（CA）是一种可信实体，负责对数字证书进行签名，以便用户验证其真实性。由于服务器证书数量庞大且更新频繁，为每台服务器单独存储所有证书并不现实。因此，用户只需存储有限数量的根证书，即可在需要时验证服务器证书。
Server Certificate
服务器证书
The private key of a certificate is required during the SSL/TLS handshake to prove that the certificate's provider is its rightful owner
证书的私钥在 SSL/TLS 握手过程中是必需的，用于证明证书的提供方是该证书的合法所有者。
The following Boost.Asio methods can be used for loading a private key:
以下 Boost.Asio 方法可用于加载私钥：
* Sign the Server CSR using our CA:
* Sign the Server CSR using our CA:
It is important to set up peer verification so that the TLS/SSL handshake fails if certificate verification is unsuccessful:
设置对端验证非常重要，这样当证书验证失败时，TLS/SSL 握手也会随之失败：
The following Boost.Asio methods can be used for loading DH parameters:
以下 Boost.Asio 方法可用于加载 DH 参数：
Diffie-Hellman (DH) key exchange is a cryptographic protocol that allows two parties to securely establish a shared secret over an insecure communication channel. The key exchange process involves both parties agreeing on a set of parameters, known as Diffie-Hellman parameters, which include a large prime number `p` and a generator `g`. Since generating these parameters is a computationally expensive task, a user might prefer to provide a precomputed value at startup.
Diffie-Hellman（DH）密钥交换是一种密码学协议，允许双方在不安全的通信通道上安全地建立共享密钥。该密钥交换过程涉及双方约定一组参数，即 Diffie-Hellman 参数，其中包括一个大素数 `p` 和一个生成元 `g`。由于生成这些参数是一项计算开销较大的任务，用户可能更倾向于在启动时提供预先计算好的值。
A server can also request and verify a client certificate to authenticate the client:
服务器也可以请求并验证客户端证书，以对客户端进行身份认证：
Certificate Authority
证书授权机构
``` curl https://localhost:8080 --cacert ca.crt --cert client.crt --key client.key ```
``` curl https://localhost:8080 --cacert ca.crt --cert client.crt --key client.key ```

Loading…

User avatar Bstran

Translation changed
* Sign the Client CSR using our CA:
* Sign the Client CSR using our CA:使用 CA 对客户端 CSR 进行签名：
06/13/2026
User avatar Bstran

Translation changed
* Sign the Client CSR using our CA:
* Sign the Client CSR using our CA:
06/13/2026
User avatar admin

String added in the repository
* Sign the Client CSR using our CA:
* Sign the Client CSR using our CA:
06/05/2026
Browse all string changes

Glossary

English Chinese (Simplified Han script)
No related strings found in the glossary.

String information

Source string description
type: list
Unit identifier
59478
Source string location
string ID 191
String age
06/05/2026
Last updated
06/26/2026
Source string age
06/05/2026
Translation file QuickBook file
doc/qbk/03_core/9_ssl_tls_certificate_zh_Hans.qbk, string 44