Zen

Translation

type: paragraph
Note that the server is configured in such a way that it requests and verifies the client certificate. You can disable this by commenting out the related line in the example.
174/1740 · 174

Sign in to save translations.

English Chinese (Simplified Han script) Actions
A Self-Issued Certificate Example
A Self-Issued Certificate Example
In the following example, we will generate a self-signed CA certificate and use it to issue both server and client certificates.
In the following example, we will generate a self-signed CA certificate and use it to issue both server and client certificates.
* Generate a CA certificate:
* Generate a CA certificate:
``` openssl req -new -newkey rsa:4096 -keyout ca.key -x509 -out ca.crt -subj "/CN=localhost" -days 365 ```
``` openssl req -new -newkey rsa:4096 -keyout ca.key -x509 -out ca.crt -subj "/CN=localhost" -days 365 ```
* Generate a Server CSR:
* Generate a Server CSR:
``` openssl req -new -newkey rsa:4096 -keyout server.key -out server.csr -subj "/CN=localhost" -addext "subjectAltName=DNS:localhost,IP:127.0.0.1" ```
``` openssl req -new -newkey rsa:4096 -keyout server.key -out server.csr -subj "/CN=localhost" -addext "subjectAltName=DNS:localhost,IP:127.0.0.1" ```
* Sign the Server CSR using our CA:
* Sign the Server CSR using our CA:
``` openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -copy_extensions copy -days 365 -out server.crt ```
``` openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -copy_extensions copy -days 365 -out server.crt ```
* Generate a Client CSR:
* Generate a Client CSR:
``` openssl req -new -newkey rsa:4096 -keyout client.key -out client.csr -subj "/CN=client.1" ```
``` openssl req -new -newkey rsa:4096 -keyout client.key -out client.csr -subj "/CN=client.1" ```
* Sign the Client CSR using our CA:
* Sign the Client CSR using our CA:
``` openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -days 365 -out client.crt ```
``` openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -days 365 -out client.crt ```
* Generate a DH parameters file:
* Generate a DH parameters file:
``` openssl dhparam -out dh4096.pem 4096 ```
``` openssl dhparam -out dh4096.pem 4096 ```
Server example: [path_link example/doc/ssl/server.cpp server.cpp]
Server example: [path_link example/doc/ssl/server.cpp server.cpp]
Note that the server is configured in such a way that it requests and verifies the client certificate. You can disable this by commenting out the related line in the example.
Note that the server is configured in such a way that it requests and verifies the client certificate. You can disable this by commenting out the related line in the example.
You can test the server using this cURL command:
You can test the server using this cURL command:
``` curl https://localhost:8080 --cacert ca.crt --cert client.crt --key client.key ```
``` curl https://localhost:8080 --cacert ca.crt --cert client.crt --key client.key ```
Also, you can use the client example: [path_link example/doc/ssl/client.cpp client.cpp]
Also, you can use the client example: [path_link example/doc/ssl/client.cpp client.cpp]
English Chinese (Simplified Han script) Actions
``` openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -copy_extensions copy -days 365 -out server.crt ```
``` openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -copy_extensions copy -days 365 -out server.crt ```
* Generate a Client CSR:
* Generate a Client CSR:
``` openssl req -new -newkey rsa:4096 -keyout client.key -out client.csr -subj "/CN=client.1" ```
``` openssl req -new -newkey rsa:4096 -keyout client.key -out client.csr -subj "/CN=client.1" ```
* Sign the Client CSR using our CA:
* Sign the Client CSR using our CA:
``` openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -days 365 -out client.crt ```
``` openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -days 365 -out client.crt ```
* Generate a DH parameters file:
* Generate a DH parameters file:
``` openssl dhparam -out dh4096.pem 4096 ```
``` openssl dhparam -out dh4096.pem 4096 ```
Server example: [path_link example/doc/ssl/server.cpp server.cpp]
Server example: [path_link example/doc/ssl/server.cpp server.cpp]
Note that the server is configured in such a way that it requests and verifies the client certificate. You can disable this by commenting out the related line in the example.
Note that the server is configured in such a way that it requests and verifies the client certificate. You can disable this by commenting out the related line in the example.
You can test the server using this cURL command:
You can test the server using this cURL command:
``` curl https://localhost:8080 --cacert ca.crt --cert client.crt --key client.key ```
``` curl https://localhost:8080 --cacert ca.crt --cert client.crt --key client.key ```
Also, you can use the client example: [path_link example/doc/ssl/client.cpp client.cpp]
Also, you can use the client example: [path_link example/doc/ssl/client.cpp client.cpp]
recommends that if a certificate includes a SAN dNSName field, the client must ignore the subject CN field. Some modern browsers, such as Google Chrome, check only the SAN section in an SSL/TLS certificate and reject certificates that contain only the CN field.
recommends that if a certificate includes a SAN dNSName field, the client must ignore the subject CN field. Some modern browsers, such as Google Chrome, check only the SAN section in an SSL/TLS certificate and reject certificates that contain only the CN field.
Private Key
Private Key
The private key of a certificate is required during the SSL/TLS handshake to prove that the certificate's provider is its rightful owner
The private key of a certificate is required during the SSL/TLS handshake to prove that the certificate's provider is its rightful owner
The following Boost.Asio methods can be used for loading a private key:
The following Boost.Asio methods can be used for loading a private key:
SSL/TLS Certificate
SSL/TLS Certificate
Certificate Authority
Certificate Authority
A Certificate Authority (CA) is a trusted entity that signs digital certificates, enabling users to verify their authenticity. Rather than storing every individual certificate for each server (which would be impractical due to the sheer volume and frequent renewals), users can store a limited set of root certificates to authenticate server certificates as needed.
A Certificate Authority (CA) is a trusted entity that signs digital certificates, enabling users to verify their authenticity. Rather than storing every individual certificate for each server (which would be impractical due to the sheer volume and frequent renewals), users can store a limited set of root certificates to authenticate server certificates as needed.
Boost.Asio provides various methods for loading certificate authority certificates:
Boost.Asio provides various methods for loading certificate authority certificates:
* [@boost:/doc/html/boost_asio/reference/ssl__context/add_certificate_authority.html `net::ssl::context::add_certificate_authority`]
* [@boost:/doc/html/boost_asio/reference/ssl__context/add_verify_path.html `net::ssl::context::add_verify_path`]
* [@boost:/doc/html/boost_asio/reference/ssl__context/load_verify_file.html `net::ssl::context::load_verify_file`]
* [@boost:/doc/html/boost_asio/reference/ssl__context/set_default_verify_paths.html `net::ssl::context::set_default_verify_paths`]
* [@boost:/doc/html/boost_asio/reference/ssl__context/add_certificate_authority.html `net::ssl::context::add_certificate_authority`]
* [@boost:/doc/html/boost_asio/reference/ssl__context/add_verify_path.html `net::ssl::context::add_verify_path`]
* [@boost:/doc/html/boost_asio/reference/ssl__context/load_verify_file.html `net::ssl::context::load_verify_file`]
* [@boost:/doc/html/boost_asio/reference/ssl__context/set_default_verify_paths.html `net::ssl::context::set_default_verify_paths`]
It is important to set up peer verification so that the TLS/SSL handshake fails if certificate verification is unsuccessful:
It is important to set up peer verification so that the TLS/SSL handshake fails if certificate verification is unsuccessful:
A client must also verify that the hostname or IP address in the certificate matches the expected one. The [@boost:/doc/html/boost_asio/reference/ssl__host_name_verification.html `net::ssl::host_name_verification`] helper function object can perform this verification according to the rules described in RFC 6125:
A client must also verify that the hostname or IP address in the certificate matches the expected one. The [@boost:/doc/html/boost_asio/reference/ssl__host_name_verification.html `net::ssl::host_name_verification`] helper function object can perform this verification according to the rules described in RFC 6125:

Loading…

User avatar admin

String added in the repository
Note that the server is configured in such a way that it requests and verifies the client certificate. You can disable this by commenting out the related line in the example.
Note that the server is configured in such a way that it requests and verifies the client certificate. You can disable this by commenting out the related line in the example.
06/05/2026
Browse all string changes

Things to check

Unchanged translation

Source and translation are identical.

Reset

Glossary

English Chinese (Simplified Han script)
No related strings found in the glossary.

String information

Source string description
type: paragraph
Unit identifier
59483
Source string location
string ID 205
String age
06/05/2026
Last updated
06/05/2026
Source string age
06/05/2026
Translation file QuickBook file
doc/qbk/03_core/9_ssl_tls_certificate_zh_Hans.qbk, string 49