查看已颁发的证书

本页介绍了如何使用 Google Cloud 控制台、Google Cloud CLI 和 Cloud 客户端库查看已颁发的证书。

您只能查看企业级 CA 颁发的证书。

查看已颁发的证书

控制台

1. 在 Google Cloud 控制台中，前往 Certificate Authority Service 页面。

   前往 Certificate Authority Service

2. 点击 CA 管理器标签页。

3. 在证书授权机构页面上，点击 CA 的名称。

4. 在证书授权机构详情页面底部，点击查看已颁发的证书以查看 CA 颁发的证书列表。

   所有证书页面上会显示证书列表。显示的详细信息包括证书的状态、颁发 CA、包含 CA 的 CA 池、证书的到期日期等。

gcloud

如需列出 CA 池中特定 CA 颁发的所有证书，请使用以下 gcloud 命令：

gcloud privateca certificates list --issuer-pool ISSUER_POOL --issuer-location ISSUER_LOCATION --ca CA_NAME

如需详细了解 gcloud privateca certificates list 命令，请参阅 gcloud privateca 证书列表。

如需列出给定位置中所有 CA 的所有证书，请使用以下 gcloud 命令：

gcloud privateca certificates list --location LOCATION

注意 ：Google Cloud CLI 不支持跨区域列出证书。使用 Google Cloud 控制台查看项目中的所有证书。

Go

如需向 CA Service 进行身份验证，请设置应用默认凭据。 如需了解详情，请参阅为本地开发环境设置身份验证。

import (
	"context"
	"fmt"
	"io"

	privateca "cloud.google.com/go/security/privateca/apiv1"
	"cloud.google.com/go/security/privateca/apiv1/privatecapb"
	"google.golang.org/api/iterator"
)

// List Certificates present in the given CA pool.
func listCertificates(
	w io.Writer,
	projectId string,
	location string,
	caPoolId string) error {
	// projectId := "your_project_id"
	// location := "us-central1"		// For a list of locations, see: https://cloud.google.com/certificate-authority-service/docs/locations.
	// caPoolId := "ca-pool-id"			// The CA Pool id in which the certificate exists.

	ctx := context.Background()
	caClient, err := privateca.NewCertificateAuthorityClient(ctx)
	if err != nil {
		return fmt.Errorf("NewCertificateAuthorityClient creation failed: %w", err)
	}
	defer caClient.Close()

	fullCaName := fmt.Sprintf("projects/%s/locations/%s/caPools/%s", projectId, location, caPoolId)

	// Create the ListCertificatesRequest.
	// See https://pkg.go.dev/cloud.google.com/go/security/privateca/apiv1/privatecapb#ListCertificatesRequest.
	req := &privatecapb.ListCertificatesRequest{Parent: fullCaName}

	it := caClient.ListCertificates(ctx, req)
	for {
		resp, err := it.Next()
		if err == iterator.Done {
			break
		}
		if err != nil {
			return fmt.Errorf("unable to get the list of cerficates: %w", err)
		}

		fmt.Fprintf(w, " - %s (common name: %s)", resp.Name,
			resp.CertificateDescription.SubjectDescription.Subject.CommonName)
	}

	return nil
}

Java

如需向 CA Service 进行身份验证，请设置应用默认凭据。 如需了解详情，请参阅为本地开发环境设置身份验证。

import com.google.cloud.security.privateca.v1.CaPoolName;
import com.google.cloud.security.privateca.v1.Certificate;
import com.google.cloud.security.privateca.v1.CertificateAuthorityServiceClient;
import java.io.IOException;

public class ListCertificates {

  public static void main(String[] args) throws IOException {
    // TODO(developer): Replace these variables before running the sample.
    // location: For a list of locations, see:
    // https://cloud.google.com/certificate-authority-service/docs/locations
    // poolId: Id of the CA pool which contains the certificates to be listed.
    String project = "your-project-id";
    String location = "ca-location";
    String poolId = "ca-pool-id";
    listCertificates(project, location, poolId);
  }

  // List Certificates present in the given CA pool.
  public static void listCertificates(String project, String location, String poolId)
      throws IOException {
    // Initialize client that will be used to send requests. This client only needs to be created
    // once, and can be reused for multiple requests. After completing all of your requests, call
    // the `certificateAuthorityServiceClient.close()` method on the client to safely
    // clean up any remaining background resources.
    try (CertificateAuthorityServiceClient certificateAuthorityServiceClient =
        CertificateAuthorityServiceClient.create()) {

      CaPoolName caPool =
          CaPoolName.newBuilder()
              .setProject(project)
              .setLocation(location)
              .setCaPool(poolId)
              .build();

      // Retrieve and print the certificate names.
      System.out.println("Available certificates: ");
      for (Certificate certificate :
          certificateAuthorityServiceClient.listCertificates(caPool).iterateAll()) {
        System.out.println(certificate.getName());
      }
    }
  }
}

Python

如需向 CA Service 进行身份验证，请设置应用默认凭据。 如需了解详情，请参阅为本地开发环境设置身份验证。

import google.cloud.security.privateca_v1 as privateca_v1


def list_certificates(
    project_id: str,
    location: str,
    ca_pool_name: str,
) -> None:
    """
    List Certificates present in the given CA pool.

    Args:
        project_id: project ID or project number of the Cloud project you want to use.
        location: location you want to use. For a list of locations, see: https://cloud.google.com/certificate-authority-service/docs/locations.
        ca_pool_name: name of the CA pool which contains the certificates to be listed.
    """

    caServiceClient = privateca_v1.CertificateAuthorityServiceClient()

    ca_pool_path = caServiceClient.ca_pool_path(project_id, location, ca_pool_name)

    # Retrieve and print the certificate names.
    print(f"Available certificates in CA pool {ca_pool_name}:")
    for certificate in caServiceClient.list_certificates(parent=ca_pool_path):
        print(certificate.name)

查看单个证书的详细信息

控制台

1. 在 Google Cloud 控制台中，前往 Certificate Authority Service 页面。

   前往 Certificate Authority Service

2. 在 CA Manager 标签页下，选择您的目标 CA。

3. 点击 CA 名称。

4. 在证书授权机构详情页面底部，点击查看已颁发的证书以查看已颁发的证书列表。

5. 在要下载的证书对应的操作列中，点击 。

6. 在下载下，点击证书。您可以点击证书链下载证书链。

gcloud

如需查看证书的完整说明，请运行以下命令：

gcloud privateca certificates describe CERT_NAME --issuer-pool POOL_ID --issuer-location ISSUER_LOCATION

如需详细了解 gcloud privateca certificates describe 命令，请参阅 gcloud privateca certificates describe。

如需将 PEM 编码的 X.509 证书链导出到文件，请运行以下命令：

gcloud privateca certificates export CERT_NAME \
    --issuer-pool POOL_ID \
    --issuer-location ISSUER_LOCATION \
    --include-chain \
    --output-file certificate-file

如需详细了解 gcloud privateca certificates export 命令，请参阅 gcloud privateca certificates export。

注意 ：您可以省略 ---include-chain，以便仅导出叶证书。

证书的所有权证明

私钥所有权证明可确保证书请求者持有相应证书的私钥。仅当请求者根据 RFC 2986 提供 PKCS #10 CSR 时，CA 服务才会检查所有权证明。系统不会强制执行其他形式的证书请求（例如 CertificateConfig 的请求）的所有权证明。

接受证书的客户端应用有责任验证证书持有人是否拥有该证书的私钥。在颁发证书期间强制执行所有权证明检查是一种纵深防御措施，可防止客户端行为异常。无论 CA 是否检查所有权证明，此类客户端的存在都可能构成安全漏洞。

后续步骤

• 了解如何撤消证书。
• 了解如何对证书进行排序和过滤。