PyOpenSSL verify_certificate（）是否执行签名验证

Question

我使用PyOpenSSLverify_certificate()来验证证书链。我的代码似乎有效。但是我想知道这个函数是否也检查证书链上的签名。假设我们有ca证书链->；i\u cert->；s证书。因此ca证书签名了i\U ca证书，i\U ca证书签名了s证书。对于链上的每个证书，verify_certificate()是否使用签名者的（RSA）密钥对证书进行签名，签名是否正确？在

Answer 1

But I was wondering if the function also checks the signatures along the certificate chain

当然有。否则链验证的目的是什么？从OpenSSL文档（man 1ssl verify在linux上）：

The final operation is to check the validity of the certificate chain. The validity period is checked against the current system time and the notBefore and notAfter dates in the certificate. The certificate signatures are also checked at this point.