MQTT研究之EMQ：【CoAP協議的ECC證書研究】

今天研究的內容，是CoAP這個協議在EMQ消息隊列的支持，CoAP是一個受限資源的協議，基於UDP實現的多用於物聯網環境的通訊協議。相關介紹很少說，能夠看RFC。

CoAP協議下，基於DTLS通訊，一樣由於協議的產生背景緣由，因此，對祕鑰大小有有一些要求，儘可能的小，因此ECC（橢圓曲線）祕鑰算法成爲了首先，比RSA祕鑰短不少，可是加密安全強度不比RSA對應較長的祕鑰安全性低。因此，EC加密算法研究成爲了本博文的重點，另外，CoAP的證書中籤名算法，也是有所限制的，用的是ECDSA，由於簽名算法和祕鑰加密算法是對應着工做的。

 

相關驗證邏輯，能夠基於CoAP的開發工具Californium的java三件套（core，connector，scandium），能夠用證書進行驗證。

 

《一》. 下面看看基於OpenSSL工具建立EC證書的過程

[root@tkwh-kfcs-app2 coaps]# openssl ecparam -out coapCA.key -name secp521r1 -genkey
[root@tkwh-kfcs-app2 coaps]# openssl req -new -key coapCA.key -out coapCA.csr
[root@tkwh-kfcs-app2 coaps]# openssl x509 -req -days 365 -in coapCA.csr -signkey coapCA.key -out coapCA.crt

[root@tkwh-kfcs-app2 coaps]# openssl ecparam -out coapApp.key -name secp521r1 -genkey
[root@tkwh-kfcs-app2 coaps]# openssl req -new -key coapApp.key -out coapApp.csr
[root@tkwh-kfcs-app2 coaps]# openssl x509 -req -days 365 -in coapApp.csr -signkey coapApp.key -out coapApp.crt

 從這個指令過程看，證書建立的步驟，EC算法和RSA算法沒有什麼太大的區別，也是三步走（1. 自簽名根證書，2.生成CSR證書籤名請求，3.生成對應目標證書）

 

《二》下面基於JAVA原生JDK的工具建立ECC的證書全流程進行分享，直接上相關的代碼，但願能給到相關朋友一些幫助，有什麼不清楚，能夠參考我前面的博文，關於RSA證書的建立過程。

1.建立祕鑰對

/**
     * algo: e.g. ECC
     * signAlgo: e.g. secp256r1
     * @param algo
     * @param signAlgo
     * @return
     */
    public static KeyPair getKeyPair(String algo, String signAlgo) {
        KeyPairGenerator keyPairGenerator = null;
        try {
            keyPairGenerator = KeyPairGenerator.getInstance(algo);
            ECGenParameterSpec ecGenParameterSpec = new ECGenParameterSpec(signAlgo);
            keyPairGenerator.initialize(ecGenParameterSpec, new SecureRandom());
            KeyPair keyPair = keyPairGenerator.generateKeyPair();
            return keyPair;
        } catch (NoSuchAlgorithmException e) {
            e.printStackTrace();
        } catch (InvalidAlgorithmParameterException e) {
            e.printStackTrace();
        }
        return null;
    }

2.建立自簽名證書（CA）

/**
     * 生成自簽名證書
     *
     * @param publicKey 公鑰對象
     * @param privateKey 私鑰對象
     * @param subj 證書主體描述信息
     * @param notBefore 有效期起始日期
     * @param validDays 有效期長度
     * @return
     * @throws Exception
     */
    public static X509Certificate createRootCert(PublicKey publicKey, PrivateKey privateKey, String subj, Date notBefore, long validDays) throws Exception{

        String algo = "SHA256WITHECDSA";
        try {
            //證書擁有者subject的描述name
            sun.security.x509.X500Name subject = new sun.security.x509.X500Name(subj);

            CertificateExtensions certExts = new CertificateExtensions();
            certExts.set(SubjectKeyIdentifierExtension.NAME, new SubjectKeyIdentifierExtension((new KeyIdentifier(publicKey)).getIdentifier()));
            certExts.set(AuthorityKeyIdentifierExtension.NAME, new AuthorityKeyIdentifierExtension(new KeyIdentifier(publicKey), null, null));
            //設置是否根證書
            BasicConstraintsExtension bce = new BasicConstraintsExtension(true, -1);
            certExts.set(BasicConstraintsExtension.NAME, new BasicConstraintsExtension(false, bce.getExtensionValue()));

            //配置證書的有效期,並生成根證書（自簽名證書）
            X509CertInfo x509CertInfo = new X509CertInfo();
            //設置證書的版本號
            x509CertInfo.set(X509CertInfo.VERSION, new CertificateVersion(CertificateVersion.V3));

            AlgorithmId algorithmId = AlgorithmId.get(algo);
            x509CertInfo.set(X509CertInfo.ALGORITHM_ID, new CertificateAlgorithmId(algorithmId));

            //設置證書的簽發者信息
            x509CertInfo.set(X509CertInfo.ISSUER, subject);

            //設置證書的擁有者信息
            x509CertInfo.set(X509CertInfo.SUBJECT, subject);

            //設置證書的序列號，基於當前時間計算
            x509CertInfo.set(X509CertInfo.SERIAL_NUMBER, new CertificateSerialNumber((int) (System.currentTimeMillis() / 1000L)));

            //設置證書的公鑰
            x509CertInfo.set(X509CertInfo.KEY, new CertificateX509Key(publicKey));

            //設置證書有效期
            Date endDate = new Date(notBefore.getTime() + validDays * 24 * 60 * 60 * 1000L);
            CertificateValidity cv = new CertificateValidity(notBefore, endDate);
            x509CertInfo.set(X509CertInfo.VALIDITY, cv);

            x509CertInfo.set(CertificateExtensions.NAME, certExts);

            X509CertImpl cert = new X509CertImpl(x509CertInfo);
            try {
                cert.sign(privateKey, algo);
            } catch (InvalidKeyException | CertificateException | NoSuchAlgorithmException | NoSuchProviderException | SignatureException e3) {
                e3.printStackTrace();
            }

            return cert;

        } catch (NoSuchAlgorithmException e) {
            e.printStackTrace();
        }  catch (CertificateException e) {
            e.printStackTrace();
        } catch (IOException e) {
            e.printStackTrace();
        } catch (Exception e) {
            e.printStackTrace();
        }

        return null;
    }

3.建立用戶證書（用2中的證書籤發客戶證書）

/**
     * 基於根證書籤發客戶證書（非CA證書），即intermediate certificate
     *
     * @param ca 根證書文件對象
     * @param caKey 根證書對應的私鑰
     * @param publicKey 待簽發證書的公鑰
     * @param subj 待簽發證書的主體描述信息
     * @param notBefore 證書有效期起點
     * @param validDays 證書有效期長度
     * @param sginAlgo 證書籤名算法
     * @return
     */
    public static X509Certificate createUserCert(X509Certificate ca, PrivateKey caKey, PublicKey publicKey, String subj, Date notBefore, long validDays, String sginAlgo)  {

        //獲取ca證書
        X509Certificate caCert = ca;

        X509CertInfo x509CertInfo = new X509CertInfo();

        try {
            //設置證書的版本號
            x509CertInfo.set(X509CertInfo.VERSION, new CertificateVersion(CertificateVersion.V3));

            //設置證書的序列號，基於當前時間計算
            x509CertInfo.set(X509CertInfo.SERIAL_NUMBER, new CertificateSerialNumber((int) (System.currentTimeMillis() / 1000L)));

            /**
             * 下面這個設置算法ID的代碼，是錯誤的，會致使證書驗證失敗，可是報錯不是很明確。 若將生成的證書存爲keystore，讓後keytool轉換
             * 會出現異常。
             *
             * 重點： AlgorithmId的參數設置要和後面的證書籤名中用到的算法信息一致。
             */
            AlgorithmId algorithmId = AlgorithmId.get(sginAlgo);
            x509CertInfo.set(X509CertInfo.ALGORITHM_ID, new CertificateAlgorithmId(algorithmId));

            //設置證書的簽發者信息
            sun.security.x509.X500Name issuer = new sun.security.x509.X500Name(caCert.getIssuerX500Principal().toString());
            x509CertInfo.set(X509CertInfo.ISSUER, issuer);

            //設置證書的擁有者信息
            sun.security.x509.X500Name subject = new sun.security.x509.X500Name(subj);
            x509CertInfo.set(X509CertInfo.SUBJECT, subject);

            //設置證書的公鑰
            x509CertInfo.set(X509CertInfo.KEY, new CertificateX509Key(publicKey));

            //設置證書有效期
            Date endDate = new Date(notBefore.getTime() + validDays * 24 * 60 * 60 * 1000L);
            CertificateValidity cv = new CertificateValidity(notBefore, endDate);
            x509CertInfo.set(X509CertInfo.VALIDITY, cv);

            CertificateExtensions exts = new CertificateExtensions();

            exts.set(SubjectKeyIdentifierExtension.NAME, new SubjectKeyIdentifierExtension((new KeyIdentifier(publicKey)).getIdentifier()));
            exts.set(AuthorityKeyIdentifierExtension.NAME, new AuthorityKeyIdentifierExtension(new KeyIdentifier(ca.getPublicKey()), null, null));
            exts.set(BasicConstraintsExtension.NAME, new BasicConstraintsExtension(false,false,-1));
            x509CertInfo.set(CertificateExtensions.NAME, exts);

        } catch (CertificateException cee) {
            cee.printStackTrace();
        } catch (IOException eio) {
            eio.printStackTrace();
        } catch (NoSuchAlgorithmException e) {
            e.printStackTrace();
        }

        // 獲取CA私鑰
        PrivateKey caPrivateKey = caKey;
        //用CA的私鑰給當前證書進行簽名，獲取最終的下游證書（證書鏈的下一節點）
        X509CertImpl cert = new X509CertImpl(x509CertInfo);
        try {
            cert.sign(caPrivateKey, sginAlgo);
        } catch (InvalidKeyException | CertificateException | NoSuchAlgorithmException | NoSuchProviderException | SignatureException e3) {
            e3.printStackTrace();
        }
        return cert;
    }

 

4. 證書的導出和導入相關方法

/**
     * 導出ECC私鑰文件存入文件，PEM格式，PKCS#8編碼
     * @param privateKey
     * @param keyPath
     * @throws Exception
     */
    public static void savePrivateKeyAsPEM(PrivateKey privateKey, String keyPath) throws Exception {
        String content = Base64Util.encode(privateKey.getEncoded());
        File file = new File(keyPath);
        try (RandomAccessFile randomAccessFile = new RandomAccessFile(file, "rw")) {
            randomAccessFile.write(BEGIN_EC_PRIVATE_KEY.getBytes());
            randomAccessFile.write(NEW_LINE.getBytes());
            int i = 0;
            for (; i<(content.length() - (content.length() % 64)); i+=64) {
                randomAccessFile.write(content.substring(i, i + 64).getBytes());
                randomAccessFile.write(NEW_LINE.getBytes());
            }

            randomAccessFile.write(content.substring(i).getBytes());
            randomAccessFile.write(NEW_LINE.getBytes());

            randomAccessFile.write(END_EC_PRIVATE_KEY.getBytes());
        }
    }

/**
     * 導出ECC公鑰文件存入文件，PEM格式，PKCS#8編碼
     * 
     * @param publicKey
     * @param name
     * @throws Exception
     */
    public static void savePublicKeyAsPEM(PublicKey publicKey, String name) throws Exception {
        String content = Base64Util.encode(publicKey.getEncoded());
        File file = new File(name);
        try (RandomAccessFile randomAccessFile = new RandomAccessFile(file, "rw")) {
            randomAccessFile.write(BEGIN_EC_PUBLIC_KEY.getBytes());
            randomAccessFile.write(NEW_LINE.getBytes());
            int i = 0;
            for (; i<(content.length() - (content.length() % 64)); i+=64) {
                randomAccessFile.write(content.substring(i, i + 64).getBytes());
                randomAccessFile.write(NEW_LINE.getBytes());
            }

            randomAccessFile.write(content.substring(i).getBytes());
            randomAccessFile.write(NEW_LINE.getBytes());

            randomAccessFile.write(END_EC_PUBLIC_KEY.getBytes());
        }
    }

這裏須要說明的是，寫入文件後，文件格式中的頭部和尾部信息以下：

private static final String BEGIN_EC_PRIVATE_KEY = "-----BEGIN PRIVATE KEY-----";
private static final String END_EC_PRIVATE_KEY = "-----END PRIVATE KEY-----";
private static final String BEGIN_EC_PUBLIC_KEY = "-----BEGIN PUBLIC KEY-----";
private static final String END_EC_PUBLIC_KEY = "-----END PUBLIC KEY-----";

 

用OPENSSL建立的EC證書私鑰，默認狀況下會含有EC PARAMETERS的描述，這個部分，JAVA生成過程當中，目前沒有弄清楚，如何能作到和OPENSSL同樣，不過，不考慮EC PARAMETERS部分，整個證書運行邏輯沒有問題。（如有知道的博友，能夠給我留言，告知我JAVA代碼如何實現openssl生成的EC證書私鑰模式的文件），下面給予一個對比，OPENSSL的EC私鑰內容和用上述JAVA生成的EC私鑰內容：

OPENSSL（PKCS#1編碼）：

openssl ecparam -out coapApp.key -name secp521r1 -genkey

-----BEGIN EC PARAMETERS-----
BgUrgQQAIw==
-----END EC PARAMETERS-----
-----BEGIN EC PRIVATE KEY-----
MIHcAgEBBEIBHpCev79KIY4T9lMyheMD9A+kXUXxmhbTdQO+bA9PCeLeXpUuHiPU
dgJ31MjWYBe/5lr9Vr9kwZ20CAErIPDgttCgBwYFK4EEACOhgYkDgYYABAGhKHT6
J6aihJyNgjdGNDP2yaCGDZjmuQw2JIs9l0C27B6KHytxOV5qZfvA80s8kq/a1FBn
lUlHHjsEaVi20wWTmAFMgs75xAU+VjXEU9i03GaQuwC73mySAHWPWVQXmFu0b+Bz
wfvBf8so3Qew054UFbmg1zvcjZM0rBhn6GZtp7LOZw==
-----END EC PRIVATE KEY-----

查看具體內容：

[root@ws2 opt]# openssl ec -in coapApp.key -noout -text
read EC key
Private-Key: (521 bit)
priv:
    01:1e:90:9e:bf:bf:4a:21:8e:13:f6:53:32:85:e3:
    03:f4:0f:a4:5d:45:f1:9a:16:d3:75:03:be:6c:0f:
    4f:09:e2:de:5e:95:2e:1e:23:d4:76:02:77:d4:c8:
    d6:60:17:bf:e6:5a:fd:56:bf:64:c1:9d:b4:08:01:
    2b:20:f0:e0:b6:d0
pub: 
    04:01:a1:28:74:fa:27:a6:a2:84:9c:8d:82:37:46:
    34:33:f6:c9:a0:86:0d:98:e6:b9:0c:36:24:8b:3d:
    97:40:b6:ec:1e:8a:1f:2b:71:39:5e:6a:65:fb:c0:
    f3:4b:3c:92:af:da:d4:50:67:95:49:47:1e:3b:04:
    69:58:b6:d3:05:93:98:01:4c:82:ce:f9:c4:05:3e:
    56:35:c4:53:d8:b4:dc:66:90:bb:00:bb:de:6c:92:
    00:75:8f:59:54:17:98:5b:b4:6f:e0:73:c1:fb:c1:
    7f:cb:28:dd:07:b0:d3:9e:14:15:b9:a0:d7:3b:dc:
    8d:93:34:ac:18:67:e8:66:6d:a7:b2:ce:67
ASN1 OID: secp521r1
NIST CURVE: P-521

 

JAVA（PKCS#8編碼）：

ECGenParameterSpec ecGenParameterSpec = new ECGenParameterSpec(「secp256r1」);

-----BEGIN PRIVATE KEY-----
MEECAQAwEwYHKoZIzj0CAQYIKoZIzj0DAQcEJzAlAgEBBCAoWE90so3R0wAj/kWS
p43qZEHS2WcdZZAehpPtfZyV6A==
-----END PRIVATE KEY-----

查看具體內容：

[root@ws2 opt]# openssl ec -in eccDevCertPem.key -noout -text
read EC key
Private-Key: (256 bit)
priv:
    28:58:4f:74:b2:8d:d1:d3:00:23:fe:45:92:a7:8d:
    ea:64:41:d2:d9:67:1d:65:90:1e:86:93:ed:7d:9c:
    95:e8
pub: 
    04:af:74:c5:4f:53:69:76:51:0d:c7:0a:9d:36:62:
    f0:4c:ab:f1:42:5c:cf:68:28:e8:9c:c7:13:b4:61:
    b0:a9:52:2a:66:57:2e:35:fe:92:dc:1c:8f:c9:cb:
    fa:2f:88:6a:bb:c3:54:d2:3d:34:ad:d5:9c:20:f5:
    1d:1e:9d:87:3b
ASN1 OID: prime256v1
NIST CURVE: P-256

 

5. JAVA建立證書的DEMO

public void fromZeroToStart() throws Exception {
        String subjCA = "OU=TaiKang,O=TKCloud,L=Wuhan,ST=Hubei,C=CN,CN=IOT_" + "ECC_CA";
        String subjSVR = "OU=TaiKang,O=TKCloud,L=Wuhan,ST=Hubei,C=CN,CN=" + "10.95.197.8";
        String subjDev = "OU=TaiKang,O=TKCloud,L=Wuhan,ST=Hubei,C=CN,CN=IOT_" + "Device";

        KeyPair eccCaKey = CertUtils.getKeyPair("EC", "secp256r1");
        KeyPair eccEmKey = CertUtils.getKeyPair("EC", "secp256r1");
        KeyPair eccDvKey = CertUtils.getKeyPair("EC", "secp256r1");

        //自簽發根證書
        Date notBefore = new Date();
        X509Certificate crt = CertUtils.createRootCert(eccCaKey.getPublic(), eccCaKey.getPrivate(), subjCA, notBefore,365, SIGN_ALGO);
//根證書籤發生成實體證書
        X509Certificate eccEmqCert = CertUtils.createUserCert(crt, eccCaKey.getPrivate(), eccEmKey.getPublic(), subjSVR, notBefore, 365, SIGN_ALGO);
//寫入證書到文件
        SSLUtils.exportPemCrtFile(crt.getEncoded(),basePath + "eccRootCert.crt");
        SSLUtils.exportDerKeyFile(eccCaKey.getPrivate().getEncoded(),basePath + "eccRootCert.key");
        SSLUtils.savePrivateKeyAsPEM(eccCaKey.getPrivate(), basePath + "eccRootCertPem.key");
        SSLUtils.exportPemCrtFile(eccEmqCert.getEncoded(),basePath + "eccEmqCert.crt");
        SSLUtils.exportDerKeyFile(eccEmKey.getPrivate().getEncoded(),basePath + "eccEmqCert.key");
        SSLUtils.savePrivateKeyAsPEM(eccEmKey.getPrivate(), basePath + "eccEmqCertPem.key");
    }

 

6. 遇到的小麻煩

1）證書的有效時間和驗證服務器的時間不一樣步致使異常

[root@mq2 ecc]# openssl verify -CAfile eccRootCert.crt eccEmqCert.crt 
eccEmqCert.crt: CN = IOT_ECC_CA, C = CN, ST = Hubei, L = Wuhan, O = TKCloud, OU = TaiKang
error 9 at 1 depth lookup:certificate is not yet valid

等一會後，一樣的證書，一樣的操做，就能夠了（生成的證書裏面設置的有效時間範圍，和當前驗證操做，即執行openssl的服務的時間沒有同步，服務器時間慢了點）

[root@mq2 ecc]# openssl verify -CAfile eccRootCert.crt eccEmqCert.crt 
eccEmqCert.crt: OK

 

[root@ws2 ecc]# mosquitto_pub -d -h 10.95.197.8 -p 8883 -t taikang/rulee -i client18 --cafile /opt/ecc/eccRootCert.crt --cert /opt/ecc/eccDevCert.crt --key /opt/ecc/eccDevCertPem.key -u shihuc -P shihuc -m "are you ok, emqttd"
Client client18 sending CONNECT
OpenSSL Error: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed
Error: A TLS error occurred.

上述錯誤信息，也是證書的有效時間和服務器時間不一樣步，參照上面的錯誤。

 

2）openssl的版本不一樣致使的查看證書出現異常

[root@mq2 ecc]# openssl x509 -in eccRootCert.crt -noout -text           
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1556080738 (0x5cbfe862)
    Signature Algorithm: ecdsa-with-SHA256
        Issuer: CN=IOT_ECC_CA, C=CN, ST=Hubei, L=Wuhan, O=TKCloud, OU=TaiKang
        Validity
            Not Before: Apr 24 04:38:58 2019 GMT
            Not After : Apr 23 04:38:58 2020 GMT
        Subject: CN=IOT_ECC_CA, C=CN, ST=Hubei, L=Wuhan, O=TKCloud, OU=TaiKang
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub: 
                    04:65:49:e6:46:8d:28:b2:49:d2:45:26:04:f9:d5:
                    b3:f4:84:f9:38:2e:ad:43:d1:14:92:af:ad:c3:0a:
                    3c:35:21:f3:25:39:85:41:a9:b9:51:d7:b3:20:6b:
                    5d:09:23:c6:66:b5:22:f3:fb:dd:a6:1c:74:43:19:
                    c1:b0:50:5c:44
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Authority Key Identifier: 
                keyid:0F:62:52:44:B1:7F:AA:23:BE:55:70:E3:05:F1:0F:EE:96:CB:C1:E9

            X509v3 Basic Constraints: 
                CA:TRUE
            X509v3 Subject Key Identifier: 
                0F:62:52:44:B1:7F:AA:23:BE:55:70:E3:05:F1:0F:EE:96:CB:C1:E9
    Signature Algorithm: ecdsa-with-SHA256
         30:44:02:20:02:f5:d5:3b:59:8a:42:af:c7:9a:15:06:f9:4b:
         03:09:0d:bb:28:59:dc:eb:91:38:65:99:64:45:91:33:2d:d5:
         02:20:51:f6:c3:ff:8e:76:32:cd:f2:a9:a9:23:18:37:d3:0a:
         18:9a:94:94:16:00:b4:fc:7c:cc:11:e8:99:18:81:21 [root@mq2 ecc]# openssl version OpenSSL 1.0.2k-fips 26 Jan 2017

同一個證書，在另一個服務器上查看：

[root@tkwh-kfcs-app2 java]# openssl x509 -in eccRootCert.crt -noout -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1556066987 (0x5cbfb2ab)
    Signature Algorithm: ecdsa-with-SHA256
        Issuer: CN=IOT_ECC_CA, C=CN, ST=Hubei, L=Wuhan, O=TKCloud, OU=TaiKang
        Validity
            Not Before: Apr 24 00:49:35 2019 GMT
            Not After : Apr 23 00:49:35 2020 GMT
        Subject: CN=IOT_ECC_CA, C=CN, ST=Hubei, L=Wuhan, O=TKCloud, OU=TaiKang
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
            Unable to load Public Key
139880214046624:error:100AE081:elliptic curve routines:EC_GROUP_new_by_curve_name:unknown group:ec_curve.c:371: 139880214046624:error:100D7010:elliptic curve routines:ECKEY_PUB_DECODE:EC lib:ec_ameth.c:206: 139880214046624:error:0B07707D:x509 certificate routines:X509_PUBKEY_get:public key decode error:x_pubkey.c:164:
        X509v3 extensions:
            X509v3 Authority Key Identifier: 
                keyid:06:67:AB:58:41:C5:DA:BD:23:73:9C:BA:E5:45:79:28:73:1C:E2:AF

            X509v3 Basic Constraints: 
                CA:TRUE
            X509v3 Subject Key Identifier: 
                06:67:AB:58:41:C5:DA:BD:23:73:9C:BA:E5:45:79:28:73:1C:E2:AF
    Signature Algorithm: ecdsa-with-SHA256
         30:44:02:20:5e:f6:fa:30:42:6f:20:1e:f6:34:1f:66:2c:a3:
         c7:a8:25:27:a1:8f:83:73:96:23:f2:e4:0d:e5:4b:a8:d2:a5:
         02:20:4c:6f:8b:2b:d4:5d:23:b3:fd:ba:3e:18:66:30:69:dc:
         48:f5:a9:88:7e:2f:e8:e9:7b:7b:4c:85:e0:bc:d5:01
[root@tkwh-kfcs-app2 java]# openssl version
OpenSSL 1.0.1e-fips 11 Feb 2013 

 

好了，到這裏，ECC證書建立和基本的驗證過程，到此結束，有相關需求或者探討的，能夠關注個人博客，一塊兒深刻。