证书里面的签名算法

Question

生成 RSA private key

openssl genrsa -des -out ca-key.pem 4096

生成证书

openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem

查看证书

openssl x509 -in ca.pem -noout -text

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            9d:cb:7d:0f:87:50:cc:17
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=cn, ST=sh, L=sj, O=jt, OU=fe, CN=wen
        Validity
            Not Before: Jul 14 12:32:59 2021 GMT
            Not After : Jul 14 12:32:59 2022 GMT
        Subject: C=cn, ST=sh, L=sj, O=jt, OU=fe, CN=wen
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Modulus:
                    00:ea:ba:27:eb:cf:08:41:63:bd:a0:62:ca:d4:c6:
                    .............................................
                    a6:e7:29
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                C6:00:BD:81:14:07:53:41:F0:28:17:22:C0:D9:AE:AF:35:BA:9E:D2
            X509v3 Authority Key Identifier: 
                keyid:C6:00:BD:81:14:07:53:41:F0:28:17:22:C0:D9:AE:AF:35:BA:9E:D2

            X509v3 Basic Constraints: 
                CA:TRUE
    Signature Algorithm: sha256WithRSAEncryption
         e9:47:6b:87:f4:e3:82:f2:02:08:3f:14:e2:b1:73:7f:af:a8:
         ......................................................

为什么结果里面出现两次 Signature Algorithm: sha256WithRSAEncryption

Answer 1

RFC 5280 里对 x509 证书的语法描述：

Certificate  ::=  SEQUENCE  {
        tbsCertificate       TBSCertificate,       // 里面包含第一个 AlgorithmIdentifier
        signatureAlgorithm   AlgorithmIdentifier,  // 这是第二个 AlgorithmIdentifier
        signatureValue       BIT STRING  }         // 这是签名值

TBSCertificate  ::=  SEQUENCE  {
        version         [0]  EXPLICIT Version DEFAULT v1,
        serialNumber         CertificateSerialNumber,
        signature            AlgorithmIdentifier, //  第一个 AlgorithmIdentifier
        issuer               Name,
        validity             Validity,
        subject              Name,
        subjectPublicKeyInfo SubjectPublicKeyInfo,
        issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL,
                             -- If present, version MUST be v2 or v3
        subjectUniqueID [2]  IMPLICIT UniqueIdentifier OPTIONAL,
                             -- If present, version MUST be v2 or v3
        extensions      [3]  EXPLICIT Extensions OPTIONAL
                             -- If present, version MUST be v3
}

在 4.1.2.3 和 4.1.1.2 讲到这两个 signatureAlgorithm 必须是一样的。

似乎是多余了，可能是用来防止一些特殊的攻击。