Android 应用程序的“./META-INF/CERT.RSA”文件中包含什么？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/22494486/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
What is contained in "./META-INF/CERT.RSA" file for an Android app?
提问by user3361508
I am new to cryptography certificate and am trying to figure out the components of "CERT.RSA" file under "./META-INF" folder for an Android application.
我是密码学证书的新手，正在尝试找出 Android 应用程序“./META-INF”文件夹下“CERT.RSA”文件的组件。
To my understanding, "CERT.RSA" is used to verify the signiture of "CERT.SF" file under the same directory. It should consist of the certificate meta info (subject, issuer, Series number, etc.), the signature of "CERT.SF" signed by developers private key, and the public key used to verify the signature.
据我了解，“CERT.RSA”用于验证同一目录下“CERT.SF”文件的签名。它应该由证书元信息（主题、颁发者、序列号等）、开发者私钥签署的“CERT.SF”签名和用于验证签名的公钥组成。
How can I derive the above components from "CERT.RSA" file? Especially, how can I retrieve the public key from the "CERT.RSA"?
如何从“CERT.RSA”文件中导出上述组件？特别是，如何从“CERT.RSA”中检索公钥？
I tried to use the following commands to reveal signing certificate. When people talk about signing certificate, is it (the following output) the public keys or the signed signature?
我尝试使用以下命令来显示签名证书。当人们谈论签名证书时，是（以下输出）公钥还是签名签名？
>> openssl pkcs7 -inform DER -print_certs -out cert.pem -in CERT.RSA
>> cat cert.pem
subject=/C=SE/ST=Kista/L=Kista/O=Javsym/OU=Mobile Visuals/CN=Eyvind Almqvist
issuer=/C=SE/ST=Kista/L=Kista/O=Javsym/OU=Mobile Visuals/CN=Eyvind Almqvist
-----BEGIN CERTIFICATE-----
MIICWzCCAcSgAwIBAgIETVPFgjANBgkqhkiG9w0BAQUFADBxMQswCQYDVQQGEwJT
RTEOMAwGA1UECBMFS2lzdGExDjAMBgNVBAcTBUtpc3RhMQ8wDQYDVQQKEwZKYXZz
eW0xFzAVBgNVBAsTDk1vYmlsZSBWaXN1YWxzMRgwFgYDVQQDEw9FeXZpbmQgQWxt
cXZpc3QwIBcNMTEwMjEwMTEwMTIyWhgPMjA2MTAxMjgxMTAxMjJaMHExCzAJBgNV
BAYTAlNFMQ4wDAYDVQQIEwVLaXN0YTEOMAwGA1UEBxMFS2lzdGExDzANBgNVBAoT
BkphdnN5bTEXMBUGA1UECxMOTW9iaWxlIFZpc3VhbHMxGDAWBgNVBAMTD0V5dmlu
ZCBBbG1xdmlzdDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAjwLlwflQ2zoC
1EeCkICSqYTSkdv6Xj0YCqoQsuLJw0pwDbz5qRos61Ub0ZxWCa4TfXu1NJmuD4j+
LwQYvAR6JO985y4zjH1Ee5qZmHDC5yoSRko6P8B4KfmBm8E8CryhUjN7vNLUfG2o
XrmXK+g5KKTx3wzWlb4+AdAS7/NlDVkCAwEAATANBgkqhkiG9w0BAQUFAAOBgQAS
CxdfvR/LHPlULkCsoGw9/Q2ZhsTlPr7fZw32sef9vnz1hqd6iMDsLC2c34yRVJfb
t6dZCVO9/gWMURIZ7NmT36uBFAUB+XkGK+5/ot3YEJicEwmk/Nvj1Tzo3PjBX3ZD
lLBpEPgc3IUOhgMyzDR+ytgFlH0MkDps6FApunUpiQ==
-----END CERTIFICATE-----
By using the following command, I could get the meta info of this certificate:
通过使用以下命令，我可以获得此证书的元信息：
>> keytool -printcert -file CERT.RSA
Owner: CN=Eyvind Almqvist, OU=Mobile Visuals, O=Javsym, L=Kista, ST=Kista, C=SE
Issuer: CN=Eyvind Almqvist, OU=Mobile Visuals, O=Javsym, L=Kista, ST=Kista, C=SE
Serial number: 4d53c582
Valid from: Thu Feb 10 06:01:22 EST 2011 until: Fri Jan 28 06:01:22 EST 2061
Certificate fingerprints:
MD5: 58:94:63:63:C1:ED:4C:02:CE:90:CE:64:DA:D7:4A:E4
SHA1: 17:5C:44:E3:A6:1A:F2:4F:A5:78:6E:C7:F0:42:4C:AD:E6:F5:CA:DF
Signature algorithm name: SHA1withRSA Version: 3
Is there other tools/commands I can use to get more complete info from "CERT.RSA"?
我可以使用其他工具/命令从“CERT.RSA”获取更完整的信息吗？
Thanks a lot for any inputs!
非常感谢您的任何投入！
采纳答案by g.anzalone
once you have the cert.pem file you can get the public key by using the following command:
获得 cert.pem 文件后，您可以使用以下命令获取公钥：
openssl x509 -in cert.pem -noout -text
openssl x509 -in cert.pem -noout -text
Regards,
问候，
Giuseppe
约瑟夫
回答by Ted
If you only want to get the part of public-key out of the CERT.RSA file, you can try out the following method:
如果您只想从 CERT.RSA 文件中取出公钥部分，您可以尝试以下方法：
- convert CERT.RSA to a standard pem file:
- 将 CERT.RSA 转换为标准 pem 文件：
openssl pkcs7 -in CERT.RSA -inform DER -print_certs -out cert.pem
openssl pkcs7 -in CERT.RSA -inform DER -print_certs -out cert.pem
- get public key from the pem file:
- 从 pem 文件中获取公钥：
openssl x509 -in cert.pem -pubkey -noout
openssl x509 -in cert.pem -pubkey -noout
回答by zerocool
this should solve your problem
这应该可以解决您的问题
openssl pkcs7 -inform DER -in CERT.RSA -noout -print_certs
回答by hanzhen
- convert CERT.RSA to a standard pem file:
- 将 CERT.RSA 转换为标准 pem 文件：
openssl pkcs7 -in CERT.RSA -inform DER -print_certs -out cert.pem
openssl pkcs7 -in CERT.RSA -inform DER -print_certs -out cert.pem
- get public key from the pem file:
- 从 pem 文件中获取公钥：
openssl x509 -in cert.pem -pubkey -noout
openssl x509 -in cert.pem -pubkey -noout
- save the public key into cert_pub.pem and signed info sign_info file
- 将公钥保存到 cert_pub.pem 和签名信息 sign_info 文件中
openssl x509 -noout -text -in cert.pem
openssl x509 -noout -text -in cert.pem
- verify the hash
- 验证哈希
openssl rsautl -verify -inkey cert_pub.pem -pubin -in sign_info -hexdump -raw
openssl dgst -sha256 CERT.RSA
openssl rsautl -verify -inkey cert_pub.pem -pubin -in sign_info -hexdump -raw
openssl dgst -sha256 CERT.RSA
but, oh no, is not match!!!
但是，哦不，不匹配！！！
