查看已颁发的证书

本页面介绍了如何使用 Google Cloud 控制台查看已颁发的证书， Google Cloud CLI 和 Cloud 客户端库。

查看已颁发的证书

控制台

  1. 在 Google Cloud 控制台中，前往 Certificate Authority Service 页面。

    前往 Certificate Authority Service

  2. 点击 CA 管理员标签页。

  3. 在证书授权机构页面上，点击 CA 的名称。

  4. 在证书授权机构详情页面底部，点击查看已颁发的证书以查看 CA 颁发的证书列表。

    所有证书页面上会显示证书列表。显示的详细信息包括证书的状态、颁发 CA、包含 CA 的 CA 池、证书的到期日期等。

gcloud

如需列出 CA 池中的特定 CA 颁发的所有证书，请使用以下 gcloud 命令：

gcloud privateca certificates list --issuer-pool ISSUER_POOL --ca CA_NAME

如需详细了解 gcloud privateca certificates list 命令，请参阅 gcloud privatecacertificate list。

如需列出给定位置中所有 CA 的所有证书，请使用以下 gcloud 命令：

gcloud privateca certificates list --location LOCATION

Go

如需向 CA Service 进行身份验证，请设置应用默认凭据。 如需了解详情，请参阅为本地开发环境设置身份验证。 

import (
	"context"
	"fmt"
	"io"

	privateca "cloud.google.com/go/security/privateca/apiv1"
	"cloud.google.com/go/security/privateca/apiv1/privatecapb"
	"google.golang.org/api/iterator"
)

// List Certificates present in the given CA pool.
func listCertificates(
	w io.Writer,
	projectId string,
	location string,
	caPoolId string) error {
	// projectId := "your_project_id"
	// location := "us-central1"		// For a list of locations, see: https://cloud.google.com/certificate-authority-service/docs/locations.
	// caPoolId := "ca-pool-id"			// The CA Pool id in which the certificate exists.

	ctx := context.Background()
	caClient, err := privateca.NewCertificateAuthorityClient(ctx)
	if err != nil {
		return fmt.Errorf("NewCertificateAuthorityClient creation failed: %w", err)
	}
	defer caClient.Close()

	fullCaName := fmt.Sprintf("projects/%s/locations/%s/caPools/%s", projectId, location, caPoolId)

	// Create the ListCertificatesRequest.
	// See https://pkg.go.dev/cloud.google.com/go/security/privateca/apiv1/privatecapb#ListCertificatesRequest.
	req := &privatecapb.ListCertificatesRequest{Parent: fullCaName}

	it := caClient.ListCertificates(ctx, req)
	for {
		resp, err := it.Next()
		if err == iterator.Done {
			break
		}
		if err != nil {
			return fmt.Errorf("unable to get the list of cerficates: %w", err)
		}

		fmt.Fprintf(w, " - %s (common name: %s)", resp.Name,
			resp.CertificateDescription.SubjectDescription.Subject.CommonName)
	}

	return nil
}

Java

如需向 CA 服务进行身份验证，请设置应用默认凭据。 如需了解详情，请参阅为本地开发环境设置身份验证。 


import com.google.cloud.security.privateca.v1.CaPoolName;
import com.google.cloud.security.privateca.v1.Certificate;
import com.google.cloud.security.privateca.v1.CertificateAuthorityServiceClient;
import java.io.IOException;

public class ListCertificates {

  public static void main(String[] args) throws IOException {
    // TODO(developer): Replace these variables before running the sample.
    // location: For a list of locations, see:
    // https://cloud.google.com/certificate-authority-service/docs/locations
    // poolId: Id of the CA pool which contains the certificates to be listed.
    String project = "your-project-id";
    String location = "ca-location";
    String poolId = "ca-pool-id";
    listCertificates(project, location, poolId);
  }

  // List Certificates present in the given CA pool.
  public static void listCertificates(String project, String location, String poolId)
      throws IOException {
    // Initialize client that will be used to send requests. This client only needs to be created
    // once, and can be reused for multiple requests. After completing all of your requests, call
    // the `certificateAuthorityServiceClient.close()` method on the client to safely
    // clean up any remaining background resources.
    try (CertificateAuthorityServiceClient certificateAuthorityServiceClient =
        CertificateAuthorityServiceClient.create()) {

      CaPoolName caPool =
          CaPoolName.newBuilder()
              .setProject(project)
              .setLocation(location)
              .setCaPool(poolId)
              .build();

      // Retrieve and print the certificate names.
      System.out.println("Available certificates: ");
      for (Certificate certificate :
          certificateAuthorityServiceClient.listCertificates(caPool).iterateAll()) {
        System.out.println(certificate.getName());
      }
    }
  }
}

Python

如需向 CA 服务进行身份验证，请设置应用默认凭据。 如需了解详情，请参阅为本地开发环境设置身份验证。 


import google.cloud.security.privateca_v1 as privateca_v1


def list_certificates(
    project_id: str,
    location: str,
    ca_pool_name: str,
) -> None:
    """
    List Certificates present in the given CA pool.

    Args:
        project_id: project ID or project number of the Cloud project you want to use.
        location: location you want to use. For a list of locations, see: https://cloud.google.com/certificate-authority-service/docs/locations.
        ca_pool_name: name of the CA pool which contains the certificates to be listed.
    """

    caServiceClient = privateca_v1.CertificateAuthorityServiceClient()

    ca_pool_path = caServiceClient.ca_pool_path(project_id, location, ca_pool_name)

    # Retrieve and print the certificate names.
    print(f"Available certificates in CA pool {ca_pool_name}:")
    for certificate in caServiceClient.list_certificates(parent=ca_pool_path):
        print(certificate.name)

查看单个证书的详细信息

控制台

  1. 在 Google Cloud 控制台中，前往 Certificate Authority Service 页面。

    前往 Certificate Authority Service

  2. 在 CA Manager 标签页下，选择您的目标 CA。

  3. 点击 CA 名称。

  4. 在证书授权机构详细信息页面底部，点击查看已颁发的证书以查看已颁发的证书的列表。

  5. 在与要下载的证书对应的操作列中，点击 。

  6. 在下载下，点击证书。您可以下载 证书链（点击证书链）。

gcloud

如需查看证书的完整说明，请运行以下命令：

gcloud privateca certificates describe CERT_NAME \
    --issuer-pool POOL_ID

如需详细了解 gcloud privateca certificates describe 命令，请参阅 gcloud privatecacertificate describe。

如需将 PEM 编码的 X.509 证书链导出到文件，请运行以下命令：

gcloud privateca certificates export CERT_NAME \
    --issuer-pool POOL_ID \
    --include-chain \
    --output-file certificate-file

如需详细了解 gcloud privateca certificates export 命令，请参阅 gcloud privateca 证书导出。

证书的所有权证明

私钥的所有权证明可确保 包含该证书的私钥。CA 服务 仅当请求者提供 PKCS #10 CSR 时，才检查所有权证明 根据 RFC 2986 标准。 系统不会强制执行其他形式的证书请求（例如通过 CertificateConfig 的请求）的所有权证明。

接受证书的客户端应用需负责确保 则验证证书持有者是否拥有 证书。在颁发证书期间强制执行所有权证明检查是一种纵深防御措施，可防止客户端行为异常。存在 无论 CA 是否检查所有权证明， 构成安全漏洞。

后续步骤