Zen

Translation

type: paragraph
Server example: [path_link example/doc/ssl/server.cpp server.cpp]
56/650 · 65

Sign in to save translations.

English Chinese (Simplified Han script) Actions
If no DH parameter is provided, OpenSSL will refuse to perform any handshake that uses DHE-based cipher suites but will still work with other cipher suites, such as those based on ECDHE.
如果未提供 DH 参数，OpenSSL 将拒绝执行任何使用基于 DHE 的加密套件的握手，但仍可与其他加密套件（例如基于 ECDHE 的套件）正常工作。
A Self-Issued Certificate Example
自颁发证书示例
In the following example, we will generate a self-signed CA certificate and use it to issue both server and client certificates.
在以下示例中，将生成一个自签名的 CA 证书，并使用该证书来签发服务器证书和客户端证书。
* Generate a CA certificate:
* 生成 CA 证书：
``` openssl req -new -newkey rsa:4096 -keyout ca.key -x509 -out ca.crt -subj "/CN=localhost" -days 365 ```
``` openssl req -new -newkey rsa:4096 -keyout ca.key -x509 -out ca.crt -subj "/CN=localhost" -days 365 ```
* Generate a Server CSR:
* 生成服务器证书签名请求（CSR）：
``` openssl req -new -newkey rsa:4096 -keyout server.key -out server.csr -subj "/CN=localhost" -addext "subjectAltName=DNS:localhost,IP:127.0.0.1" ```
``` openssl req -new -newkey rsa:4096 -keyout server.key -out server.csr -subj "/CN=localhost" -addext "subjectAltName=DNS:localhost,IP:127.0.0.1" ```
* Sign the Server CSR using our CA:
* Sign the Server CSR using our CA:
``` openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -copy_extensions copy -days 365 -out server.crt ```
``` openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -copy_extensions copy -days 365 -out server.crt ```
* Generate a Client CSR:
* 生成客户端证书签名请求（CSR）：
``` openssl req -new -newkey rsa:4096 -keyout client.key -out client.csr -subj "/CN=client.1" ```
``` openssl req -new -newkey rsa:4096 -keyout client.key -out client.csr -subj "/CN=client.1" ```
* Sign the Client CSR using our CA:
* 使用 CA 对客户端 CSR 进行签名：
``` openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -days 365 -out client.crt ```
``` openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -days 365 -out client.crt ```
* Generate a DH parameters file:
* 生成 DH 参数文件：
``` openssl dhparam -out dh4096.pem 4096 ```
``` openssl dhparam -out dh4096.pem 4096 ```
Server example: [path_link example/doc/ssl/server.cpp server.cpp]
服务器端示例：[path_link example/doc/ssl/server.cpp server.cpp]
Note that the server is configured in such a way that it requests and verifies the client certificate. You can disable this by commenting out the related line in the example.
注意，该服务器的配置方式要求对客户端证书进行请求和验证。如果需要禁用此功能，可以注释掉示例中的相关代码行。
You can test the server using this cURL command:
可以使用以下 cURL 命令测试该服务器：
``` curl https://localhost:8080 --cacert ca.crt --cert client.crt --key client.key ```
``` curl https://localhost:8080 --cacert ca.crt --cert client.crt --key client.key ```
Also, you can use the client example: [path_link example/doc/ssl/client.cpp client.cpp]
此外，也可以使用客户端示例：[path_link example/doc/ssl/client.cpp client.cpp]
English Chinese (Simplified Han script) Actions
* [@boost:/doc/html/boost_asio/reference/ssl__context/use_certificate.html `net::ssl::context::use_certificate`]
* [@boost:/doc/html/boost_asio/reference/ssl__context/use_certificate_file.html `net::ssl::context::use_certificate_file`]
* [@boost:/doc/html/boost_asio/reference/ssl__context/use_certificate_chain.html `net::ssl::context::use_certificate_chain`]
* [@boost:/doc/html/boost_asio/reference/ssl__context/use_certificate_chain_file.html `net::ssl::context::use_certificate_chain_file`]
* [@boost:/doc/html/boost_asio/reference/ssl__context/use_certificate.html `net::ssl::context::use_certificate`]
* [@boost:/doc/html/boost_asio/reference/ssl__context/use_certificate_file.html `net::ssl::context::use_certificate_file`]
* [@boost:/doc/html/boost_asio/reference/ssl__context/use_certificate_chain.html `net::ssl::context::use_certificate_chain`]
* [@boost:/doc/html/boost_asio/reference/ssl__context/use_certificate_chain_file.html `net::ssl::context::use_certificate_chain_file`]
A server can authenticate clients by requiring and verifying their certificates, preventing access for those without a valid certificate and private key. The server enforces this by modifying peer verification settings:
服务器可以通过要求并验证客户端证书来对客户端进行身份认证，从而阻止没有有效证书和私钥的客户端访问。服务器通过修改对端验证设置来实施这一机制：
If used, the necessary CA certificates must be loaded into the server's SSL context to enable verification of the client's certificate.
若使用该机制，则需将必要的 CA 证书加载到服务器的 SSL 上下文中，以便能够验证客户端的证书。
* [@boost:/doc/html/boost_asio/reference/ssl__context/use_private_key.html `net::ssl::context::use_private_key`]
* [@boost:/doc/html/boost_asio/reference/ssl__context/use_private_key_file.html `net::ssl::context::use_private_key_file`]
* [@boost:/doc/html/boost_asio/reference/ssl__context/use_rsa_private_key.html `net::ssl::context::use_rsa_private_key`]
* [@boost:/doc/html/boost_asio/reference/ssl__context/use_rsa_private_key_file.html `net::ssl::context::use_rsa_private_key_file`]
* [@boost:/doc/html/boost_asio/reference/ssl__context/use_private_key.html `net::ssl::context::use_private_key`]
* [@boost:/doc/html/boost_asio/reference/ssl__context/use_private_key_file.html `net::ssl::context::use_private_key_file`]
* [@boost:/doc/html/boost_asio/reference/ssl__context/use_rsa_private_key.html `net::ssl::context::use_rsa_private_key`]
* [@boost:/doc/html/boost_asio/reference/ssl__context/use_rsa_private_key_file.html `net::ssl::context::use_rsa_private_key_file`]
Self-Signed and Self-Issued Certificates
自签名证书与自颁发证书
A self-issued certificate is a certificate where the issuer and subject are the same entity.
自颁发证书是指证书的颁发者与主体为同一实体。
Installing an untrusted, self-issued, or self-signed CA certificate poses a
安装不受信任、自颁发或自签名的 CA 证书会带来安全风险。
Diffie-Hellman (DH) Parameters
Diffie-Hellman（DH）参数
* [@boost:/doc/html/boost_asio/reference/ssl__context/use_tmp_dh.html `net::ssl::context::use_tmp_dh`]
* [@boost:/doc/html/boost_asio/reference/ssl__context/use_tmp_dh_file.html `net::ssl::context::use_tmp_dh_file`]
* [@boost:/doc/html/boost_asio/reference/ssl__context/use_tmp_dh.html `net::ssl::context::use_tmp_dh`]
* [@boost:/doc/html/boost_asio/reference/ssl__context/use_tmp_dh_file.html `net::ssl::context::use_tmp_dh_file`]
If no DH parameter is provided, OpenSSL will refuse to perform any handshake that uses DHE-based cipher suites but will still work with other cipher suites, such as those based on ECDHE.
如果未提供 DH 参数，OpenSSL 将拒绝执行任何使用基于 DHE 的加密套件的握手，但仍可与其他加密套件（例如基于 ECDHE 的套件）正常工作。
* Generate a Server CSR:
* 生成服务器证书签名请求（CSR）：
``` openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -copy_extensions copy -days 365 -out server.crt ```
``` openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -copy_extensions copy -days 365 -out server.crt ```
``` openssl req -new -newkey rsa:4096 -keyout client.key -out client.csr -subj "/CN=client.1" ```
``` openssl req -new -newkey rsa:4096 -keyout client.key -out client.csr -subj "/CN=client.1" ```
``` openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -days 365 -out client.crt ```
``` openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -days 365 -out client.crt ```
``` openssl dhparam -out dh4096.pem 4096 ```
``` openssl dhparam -out dh4096.pem 4096 ```
Server example: [path_link example/doc/ssl/server.cpp server.cpp]
服务器端示例：[path_link example/doc/ssl/server.cpp server.cpp]
Note that the server is configured in such a way that it requests and verifies the client certificate. You can disable this by commenting out the related line in the example.
注意，该服务器的配置方式要求对客户端证书进行请求和验证。如果需要禁用此功能，可以注释掉示例中的相关代码行。
Also, you can use the client example: [path_link example/doc/ssl/client.cpp client.cpp]
此外，也可以使用客户端示例：[path_link example/doc/ssl/client.cpp client.cpp]
recommends that if a certificate includes a SAN dNSName field, the client must ignore the subject CN field. Some modern browsers, such as Google Chrome, check only the SAN section in an SSL/TLS certificate and reject certificates that contain only the CN field.
该建议指出，如果证书中包含 SAN 的 dNSName 字段，客户端必须忽略主题 CN 字段。某些现代浏览器（例如 Google Chrome）仅检查 SSL/TLS 证书中的 SAN 部分，并拒绝仅包含 CN 字段的证书。
Private Key
私钥
Boost.Asio provides various methods for loading certificate authority certificates:
Boost.Asio 提供多种加载证书授权机构证书的方法：
The Subject Alternative Name (SAN) is an extension in X.509 certificates that allows multiple domain names, subdomains, or IP addresses to be associated with a single SSL/TLS certificate. Before that it was the Common Name field in the certificate subject which could contain a single hostname.
主题备用名称（SAN）是 X.509 证书中的一种扩展字段，允许将多个域名、子域名或 IP 地址关联到同一张 SSL/TLS 证书上。在此之前，证书主题中的通用名称字段只能包含单个主机名。

Loading…

User avatar Bstran

Translation changed
Server example: [path_link example/doc/ssl/server.cpp server.cpp]
Server example: 服务器端示例：[path_link example/doc/ssl/server.cpp server.cpp]
06/13/2026
User avatar admin

String added in the repository
Server example: [path_link example/doc/ssl/server.cpp server.cpp]
Server example: [path_link example/doc/ssl/server.cpp server.cpp]
06/05/2026
Browse all string changes

Glossary

English Chinese (Simplified Han script)
No related strings found in the glossary.

String information

Source string description
type: paragraph
Unit identifier
59482
Source string location
string ID 203
String age
06/05/2026
Last updated
06/26/2026
Source string age
06/05/2026
Translation file QuickBook file
doc/qbk/03_core/9_ssl_tls_certificate_zh_Hans.qbk, string 48