Sectigo SSL : USERTrust RSA Certification Authority (PEM)

话分两头在访问使用由 Sectigo Public Server Authentication CA OV R36 所签发的网站时，又是遇到了一样的证书不受信任的问题，归根结底还是根证书过期或者缺少所导致的。

就欺负着这是低于 Android 7.0 的版本的系统，可尽逮着薅先。

证书信息：

Issuer:
CN=AddTrust Exte­rnal CA Root,OU=­AddTrust Externa­l TTP Network,O=­AddTrust AB,C=SE
CN=AAA Certifica­te Services,O=Co­modo CA Limited,­L=Salford,ST=Gre­ater Manchester,­C=GB
CN=USERTrust RSA­ Certification A­uthority,O=The U­SERTRUST Network­,L=Jersey City,S­T=New Jersey,C=U­S
Serial:
2647114958320813­1559647911801012­699958
7635930147780338­5872276235234032­301461
2645093764781058­7875918716456657­88717
Not valid before:
2000-05-30 10:48­:38 UTC
2019-03-12 00:00­:00 UTC
2010-02-01 00:00­:00 UTC
Not valid after:
2020-05-30 10:48­:38 UTC
2028-12-31 23:59­:59 UTC
2038-01-18 23:59­:59 UTC
Key size:
4096
Signature Algorithm:
sha384WithRSAEnc­ryption
authorityKeyIdentifier:
keyid:AD:BD:98:7­A:34:B4:26:F7:FA­:C4:26:54:EF:03:­BD:E0:24:CB:54:1­A
keyid:A0:11:0A:2­3:3E:96:F1:07:EC­:E2:AF:29:EF:82:­A5:7F:D0:30:A4:B­4
subjectKeyIdentifier:
53:79:BF:5A:AA:2­B:4A:CF:54:80:E1­:D8:9B:C0:9D:F2:­B2:03:66:CB
keyUsage:
Digital Signatur­e, Certificate S­ign, CRL Sign
Certificate Sign­, CRL Sign
basicConstraints:
CA:TRUE
certificatePolicies:
Policy: X509v3 A­ny Policy
crlDistributionPoints:
Full Name:­ URI:http://crl­.usertrust.com/A­ddTrustExternalC­ARoot.crl
Full Name:­ URI:http://crl­.comodoca.com/AA­ACertificateServ­ices.crl
authorityInfoAccess:
OCSP - URI:http:­//ocsp.usertrust­.com
OCSP - URI:http:­//ocsp.comodoca.­com

这个在所提及到的网站上没有找到直接入口，还是在搜索引擎中才有所发现的！

证书内容如下：

-----BEGIN CERTIFICATE-----
MIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCB
iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl
cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV
BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAw
MjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNV
BAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU
aGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2Vy
dGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK
AoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B
3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkY
tJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/
Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2
VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT
79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6
c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmT
Yo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97l
c6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4ee
UB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeE
Hg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAd
BgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8G
A1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPF
Up/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KO
VWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3
ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs
8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcR
iQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYze
Sf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZ
XHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/
qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRB
VXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aB
L6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfG
jjxDah2nGN59PRbxYvnKkKj9
-----END CERTIFICATE-----

这个的交叉签名也是有多个根，其中根据浏览器显示的证书链找到了 USERTrust RSA Certification Authority ，因而忽略了另外一个 AAA Certifica­te Services 的交叉签名版本，好在也是因此才不用用到了以及即将过期的根证书了，不过话又说回来或许还是有某个证书因为各种层级使用到 AAA Certifica­te Services 的吧？

查阅相关文章可知 Sectigo 逐步切换到自己所签发的根，对此我干脆一步到位再额外安装一个名为 Sectigo Public Server Authentication Root R46 的根直接减少证书链层级。不过其官网上的根证书分得太细安装有些繁琐，还是继续安装着 USERTrust RSA Certification Authority 保底比较稳妥。

• USERTrust RSA Certification Authorityhttps://ssl-tools.net/subjects/cd30d24c343a82ab1f0570158ad7a107762992e9
• Sectigo Intermediate Certificates – RSAhttps://www.sectigo.com/knowledge-base/detail/Sectigo-Intermediate-Certificates
• Sectigo Intermediate Certificates – ECChttps://www.sectigo.com/knowledge-base/detail/Sectigo-Intermediate-Certificates-ECC

ChiuYut

2026年08月05日