来自 x509 证书的 golang 主题 dn

Question

是否有任何简单的方法可以从 x509 证书中获取完整的主题 DN（或颁发者 DN）作为字符串？

我在 pkix.Name 中找不到像“.String()”这样的方法

Answer 1

解决方案（感谢同事）：var oid = map[string]string{&nbsp; &nbsp; "2.5.4.3":&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "CN",&nbsp; &nbsp; "2.5.4.4":&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "SN",&nbsp; &nbsp; "2.5.4.5":&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "serialNumber",&nbsp; &nbsp; "2.5.4.6":&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "C",&nbsp; &nbsp; "2.5.4.7":&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "L",&nbsp; &nbsp; "2.5.4.8":&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "ST",&nbsp; &nbsp; "2.5.4.9":&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "streetAddress",&nbsp; &nbsp; "2.5.4.10":&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"O",&nbsp; &nbsp; "2.5.4.11":&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"OU",&nbsp; &nbsp; "2.5.4.12":&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"title",&nbsp; &nbsp; "2.5.4.17":&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"postalCode",&nbsp; &nbsp; "2.5.4.42":&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"GN",&nbsp; &nbsp; "2.5.4.43":&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"initials",&nbsp; &nbsp; "2.5.4.44":&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"generationQualifier",&nbsp; &nbsp; "2.5.4.46":&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"dnQualifier",&nbsp; &nbsp; "2.5.4.65":&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"pseudonym",&nbsp; &nbsp; "0.9.2342.19200300.100.1.25": "DC",&nbsp; &nbsp; "1.2.840.113549.1.9.1":&nbsp; &nbsp; &nbsp; &nbsp;"emailAddress",&nbsp; &nbsp; "0.9.2342.19200300.100.1.1":&nbsp; "userid",}func getDNFromCert(namespace pkix.Name, sep string) (string, error) {&nbsp; &nbsp; subject := []string{}&nbsp; &nbsp; for _, s := range namespace.ToRDNSequence() {&nbsp; &nbsp; &nbsp; &nbsp; for _, i := range s {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if v, ok := i.Value.(string); ok {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if name, ok := oid[i.Type.String()]; ok {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // <oid name>=<value>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; subject = append(subject, fmt.Sprintf("%s=%s", name, v))&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; } else {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // <oid>=<value> if no <oid name> is found&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; subject = append(subject, fmt.Sprintf("%s=%s", i.Type.String(), v))&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; } else {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // <oid>=<value in default format> if value is not string&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; subject = append(subject, fmt.Sprintf("%s=%v", i.Type.String, v))&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; &nbsp; return sep + strings.Join(subject, sep), nil}调用函数：subj, err := getDNFromCert(x509Cert.Subject, "/")if err != nil {&nbsp; &nbsp;// do error handling}fmt.Println(subj)输出（示例）：/C=US/O=some organization/OU=unit/CN=common name这似乎是唯一的“简单”解决方案

Answer 2

为了从 x509 证书中获取完整的主题 DN（或颁发者 DN），您可以使用下一个代码：cert, err := x509.ParseCertificate(certData)if err != nil {&nbsp; &nbsp; return err}var subject pkix.RDNSequenceif _, err := asn1.Unmarshal(cert.RawSubject, &subject); err != nil {&nbsp; &nbsp; return err}fmt.Plrintln(subject.String()同样，如果您只需要从主题（或发行者）获取某些特定的对象值，您可以使用下一种方法。下面的示例从主题中检索 UID（未在标准库https://github.com/golang/go/issues/25667中定义）// http://www.alvestrand.no/objectid/0.9.2342.19200300.100.1.1.htmlconst oidUserID = "0.9.2342.19200300.100.1.1"var UID stringcert, err := x509.ParseCertificate(certData)if err != nil {&nbsp; &nbsp; return err}// manually parsing the Certificate subject to get the// UID field, which is being ignored by the stdlib// https://github.com/golang/go/issues/25667var subject pkix.RDNSequenceif _, err := asn1.Unmarshal(cert.RawSubject, &subject); err != nil {&nbsp; &nbsp; return err}for _, s := range subject {&nbsp; &nbsp; for _, i := range s {&nbsp; &nbsp; &nbsp; &nbsp; if i.Type.String() == oidUserID {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if v, ok := i.Value.(string); ok {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; UID = v&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }}fmt.Println(UID)更新：感谢@FiloSottile ，简化了获取 UID 的方法：// http://www.alvestrand.no/objectid/0.9.2342.19200300.100.1.1.htmlvar oidUserID = []int{0, 9, 2342, 19200300, 100, 1, 1}var UID stringcert, err := x509.ParseCertificate(certData)if err != nil {&nbsp; &nbsp; return err}// reading the UID from list of unprased&nbsp;// objects from Subjectfor _, n := range cert.Subject.Names {&nbsp; &nbsp; if n.Type.Equal(oidUserID) {&nbsp; &nbsp; &nbsp; &nbsp; if v, ok := n.Value.(string); ok {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; UID = v&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }}fmt.Println(UID)

Answer 3

我今天面临同样的任务。您可以通过这种方式从证书中获取主题：// d is []byte with your certificatecert, err := x509.ParseCertificate(d)fmt.Printf("%+v\n", cert.Subject.ToRDNSequence())// Output: CN=client1,OU=MyClients,O=MongoDB-Cluster,L=Austin,ST=TX,C=US