查看已颁发的证书

本页面介绍了如何使用 Google Cloud 控制台、Google Cloud CLI 和 Cloud 客户端库查看已颁发的证书。

查看已颁发的证书

控制台

  1. 在 Google Cloud 控制台中，前往 Certificate Authority Service 页面。

    转到 Certificate Authority Service

  2. 点击 CA 管理员标签页。

  3. 在证书授权机构页面上，点击 CA 的名称。

  4. 在证书授权机构详细信息页面底部，点击查看已颁发的证书以查看 CA 颁发的证书列表。

    所有证书页面上会显示证书列表。显示的详细信息包括证书的状态、颁发的 CA、包含该 CA 的 CA 池、证书的失效日期等。

gcloud

如需列出 CA 池中的特定 CA 颁发的所有证书，请使用以下 gcloud 命令：

gcloud privateca certificates list --issuer-pool ISSUER_POOL --ca CA_NAME

如需详细了解 gcloud privateca certificates list 命令，请参阅 gcloud privatecacertificate list。

如需列出给定位置中所有 CA 的所有证书，请使用以下 gcloud 命令：

gcloud privateca certificates list --location LOCATION

Go

如需向 CA 服务进行身份验证，请设置应用默认凭据。如需了解详情，请参阅为本地开发环境设置身份验证。 

import (
	"context"
	"fmt"
	"io"

	privateca "cloud.google.com/go/security/privateca/apiv1"
	"cloud.google.com/go/security/privateca/apiv1/privatecapb"
	"google.golang.org/api/iterator"
)

// List Certificates present in the given CA pool.
func listCertificates(
	w io.Writer,
	projectId string,
	location string,
	caPoolId string) error {
	// projectId := "your_project_id"
	// location := "us-central1"		// For a list of locations, see: https://cloud.google.com/certificate-authority-service/docs/locations.
	// caPoolId := "ca-pool-id"			// The CA Pool id in which the certificate exists.

	ctx := context.Background()
	caClient, err := privateca.NewCertificateAuthorityClient(ctx)
	if err != nil {
		return fmt.Errorf("NewCertificateAuthorityClient creation failed: %w", err)
	}
	defer caClient.Close()

	fullCaName := fmt.Sprintf("projects/%s/locations/%s/caPools/%s", projectId, location, caPoolId)

	// Create the ListCertificatesRequest.
	// See https://pkg.go.dev/cloud.google.com/go/security/privateca/apiv1/privatecapb#ListCertificatesRequest.
	req := &privatecapb.ListCertificatesRequest{Parent: fullCaName}

	it := caClient.ListCertificates(ctx, req)
	for {
		resp, err := it.Next()
		if err == iterator.Done {
			break
		}
		if err != nil {
			return fmt.Errorf("unable to get the list of cerficates: %w", err)
		}

		fmt.Fprintf(w, " - %s (common name: %s)", resp.Name,
			resp.CertificateDescription.SubjectDescription.Subject.CommonName)
	}

	return nil
}

Java

如需向 CA 服务进行身份验证，请设置应用默认凭据。如需了解详情，请参阅为本地开发环境设置身份验证。 


import com.google.cloud.security.privateca.v1.CaPoolName;
import com.google.cloud.security.privateca.v1.Certificate;
import com.google.cloud.security.privateca.v1.CertificateAuthorityServiceClient;
import java.io.IOException;

public class ListCertificates {

  public static void main(String[] args) throws IOException {
    // TODO(developer): Replace these variables before running the sample.
    // location: For a list of locations, see:
    // https://cloud.google.com/certificate-authority-service/docs/locations
    // poolId: Id of the CA pool which contains the certificates to be listed.
    String project = "your-project-id";
    String location = "ca-location";
    String poolId = "ca-pool-id";
    listCertificates(project, location, poolId);
  }

  // List Certificates present in the given CA pool.
  public static void listCertificates(String project, String location, String poolId)
      throws IOException {
    // Initialize client that will be used to send requests. This client only needs to be created
    // once, and can be reused for multiple requests. After completing all of your requests, call
    // the `certificateAuthorityServiceClient.close()` method on the client to safely
    // clean up any remaining background resources.
    try (CertificateAuthorityServiceClient certificateAuthorityServiceClient =
        CertificateAuthorityServiceClient.create()) {

      CaPoolName caPool =
          CaPoolName.newBuilder()
              .setProject(project)
              .setLocation(location)
              .setCaPool(poolId)
              .build();

      // Retrieve and print the certificate names.
      System.out.println("Available certificates: ");
      for (Certificate certificate :
          certificateAuthorityServiceClient.listCertificates(caPool).iterateAll()) {
        System.out.println(certificate.getName());
      }
    }
  }
}

Python

如需向 CA 服务进行身份验证，请设置应用默认凭据。如需了解详情，请参阅为本地开发环境设置身份验证。 


import google.cloud.security.privateca_v1 as privateca_v1


def list_certificates(
    project_id: str,
    location: str,
    ca_pool_name: str,
) -> None:
    """
    List Certificates present in the given CA pool.

    Args:
        project_id: project ID or project number of the Cloud project you want to use.
        location: location you want to use. For a list of locations, see: https://cloud.google.com/certificate-authority-service/docs/locations.
        ca_pool_name: name of the CA pool which contains the certificates to be listed.
    """

    caServiceClient = privateca_v1.CertificateAuthorityServiceClient()

    ca_pool_path = caServiceClient.ca_pool_path(project_id, location, ca_pool_name)

    # Retrieve and print the certificate names.
    print(f"Available certificates in CA pool {ca_pool_name}:")
    for certificate in caServiceClient.list_certificates(parent=ca_pool_path):
        print(certificate.name)

查看单个证书的详细信息

控制台

  1. 在 Google Cloud 控制台中，前往 Certificate Authority Service 页面。

    转到 Certificate Authority Service

  2. 在 CA 管理器标签页下选择目标 CA。

  3. 点击 CA 名称。

  4. 在证书授权机构详细信息页面底部，点击查看已颁发的证书以查看已颁发证书的列表。

  5. 在操作列中，点击要下载的证书对应的 。

  6. 在下载下，点击证书。您可以点击证书链来下载证书链。

gcloud

如需查看证书的完整说明，请运行以下命令：

gcloud privateca certificates describe CERT_NAME \
    --issuer-pool POOL_ID

如需详细了解 gcloud privateca certificates describe 命令，请参阅 gcloud privatecacertificate describe。

如需将 PEM 编码的 X.509 证书链导出到文件，请运行以下命令：

gcloud privateca certificates export CERT_NAME \
    --issuer-pool POOL_ID \
    --include-chain \
    --output-file certificate-file

如需详细了解 gcloud privateca certificates export 命令，请参阅 gcloud privateca certificate export。

证书的所有权证明

私钥的所有权证明可确保证书请求者保留该证书的私钥。仅当请求者根据 RFC 2986 提供 PKCS #10 CSR 时，CA Service 才会检查所有权证明。其他形式的证书请求（如 CertificateConfig 的请求）不会强制执行所有权证明。

接受证书的客户端应用负责验证证书持有者是否拥有该证书的私钥。在证书颁发期间强制执行所有权证明检查是一种深度防御形式，可防止出现异常的客户端。无论 CA 是否检查所有权证明，此类客户端的存在都会构成安全漏洞。

后续步骤