ECDSA证书可以有RSA签名吗？

Posted 2021-04-19

我需要有关ECDSA证书的信息。据我所知，ECDSA证书应该包含ECDSA签名，但我看到Facebook和谷歌服务器证书都有带有RSA签名的ECDSA证书。是否可以获得带有RSA签名的ECDSA证书？

答案

证书的签名由发行者使用发行者的密钥创建。因此，如果证书A内部具有ECC密钥（即ECDSA证书），但发行者B具有RSA密钥，则A的签名将是RSA签名，因为这是发行者用于签名的。

例如，在facebook.com的情况下，证书本身具有ECC密钥，但发行者证书DigiCert SHA2 High Assurance Server CA具有RSA密钥。因为facebook证书的签名是由发行者用发行者密钥完成的，所以它也必须使用RSA。

另一答案

Steffen的答案对于X.509标准是正确的，许多基于标准SSL库的浏览器都支持这种情况。然而，在这个粗糙的现实世界中，我发现一些设备拒绝具有RSA签名的ECDSA证书，并且使用TLS 1.2协商。

我认为原因是这些设备的作者遵循RFC-4492，（**是我的）

2.2.  ECDHE_ECDSA
In ECDHE_ECDSA, the server's certificate **MUST** contain an ECDSA-
capable public key and **be signed with ECDSA.**

The server sends its ephemeral ECDH public key and a specification of
the corresponding curve in the ServerKeyExchange message.  These
parameters MUST be signed with ECDSA using the private key
corresponding to the public key in the server's Certificate.

虽然RFC-5246，TLS1.2，放宽了这个限制。 （** 是我的）：

7.4.4.  Certificate Request
...
If the client provided a "signature_algorithms" extension, then all
certificates provided by the server MUST be signed by a
hash/signature algorithm pair that appears in that extension. **Note
that this implies that a certificate containing a key for one
signature algorithm MAY be signed using a different signature
algorithm (for instance, an RSA key signed with a DSA key).  This is
a departure from TLS 1.1, which required that the algorithms be the
same.**  Note that this also implies that the DH_DSS, DH_RSA,
ECDH_ECDSA, and ECDH_RSA key exchange algorithms do not restrict the
algorithm used to sign the certificate.  Fixed DH certificates MAY be
signed with any hash/signature algorithm pair appearing in the
extension.  The names DH_DSS, DH_RSA, ECDH_ECDSA, and ECDH_RSA are
historical.

因此要注意这样的设备存在。