如果危及根证书CA怎么办？
可以用以下命令检查根证书，确保一切正常。
You can have a look at your root certificate just to make sure everything's right by using.
用于签名证书而不是可信根证书的证书链。
A certificate chain for the signature certificate, but not the trusted root certificate.
用于签名证书而不是可信根证书的证书链。
A certificate chain for the signature certificate, including the trusted root certificate.
用于签名证书(包含可信根证书)的证书链。
A certificate chain for the signature certificate, including the trusted root certificate.
删除根证书将使受信任根证书颁发机构失效。
Deleting root certificates invalidates the trusted root certification authorities.
存储根证书和单个服务证书以及相关私有密钥。
Stores root certificates along with single service certificate and associated private key.
安装根证书5。
返回到ikeyman以导入试用CA根证书。
在名单中出现，寻找和扩大受信任的根证书权威文件夹。
In the list that appears, find and expand the Trusted Root Certification Authority folder.
如果客户端或服务器的信任存储区中尚没有ca根证书，则导入该证书。
Import the ca root certificate, if it does not already exist in the trust store of the client or the server.
提交的证书是自签证书，它不是由受信根证书颁发机构颁发的。
Certificates that are issued by the certification authorities or any lower level certification authorities will no longer be trusted.
您管理证书的结构、命名、验证和到期时间，但是如前所述您不能控制根证书。
You manage the certificate structure, naming, validation, and expiration, but as we mentioned, you cannot control the root certificate.
选择可信的根证书或任何其他证书类别，把刚才创建的服务器证书导入到其中。
Select the trusted root certificate or any other certificate category accordingly and import the server certificate that you had created into it.
为防止此类攻击，基于md5哈希的根证书和签名者证书不应受信任。
To guard against such an attack, root and signer certificates based on the MD5 hash should not be trusted.
处理：确保您在使用由可信任的根证书颁发机构颁发的有效的、非过期的安全证书。
Workaround: Ensure that you are using valid, non-expired security certificates issued by a trusted root certification authority.
因为我们现在只使用自签名证书，所有这些根证书代表对我们的队列管理器的不恰当的访问授权。
Since we are using only self-signed certificates, all of these root certificates represent inappropriate access grants to our queue managers.
选择此处更长的有效期内表示授予您自己更长一段时间之前需要更新您的ca根证书。
Selecting a longer Validity period here means granting yourself a longer period of time before needing to update your ca's root certificate.
假设您安装此服务器作为域管理员，它将自动开始填充它拖到您的域中的每台计算机上的根证书。
Assuming you installed this server as a domain Administrator, it will automatically begin populating its root certificate onto every computer in your domain.
在公共网络中，在你还未上任何网站之前，Firefox就已经隐含地信任了VeriSign的根证书。
On the public Internet, VeriSign's root certificate is implicitly trusted by Firefox long before you go to any website.
如果您已经一切正常，您应很快发现一台计算机上的受信任的根证书颁发机构存储中的ADCS服务器的根证书。
If you've done everything correctly, you should soon find the AD CS server's root certificate in the Trusted root Certification Authorities store on a computer.
因为此根ca证书的位置在受信任的根证书颁发机构存储中，此计算机现在将信任由ADCS服务器颁发的所有证书。
Because this root ca certificate is located in your Trusted root Certification Authorities store, this computer will now trust any certificates issued by your AD CS server.
消费应用程序（Consuming Application）的keystore将包含服务提供者（Service Provider）的证书的根证书。
The Consuming Application's keystore will have the root certificate of the Service Provider's certificate.
使用开放式公共系统的一个不利之处是您不能拥有证书的根。
One disadvantage of using an open public system is that you cannot own the root of the certificate.
如果由于某种原因它们没有放在那里，即使Windows把证书显示为可信根ca，也无法建立信任。
If for some reason they are not placed in there trust cannot be established although Windows may show the certificate as a trusted root ca.
为根生成自签名的证书(有效期大约10年)。
Generate the certificate for root (valid for approximately 10 years) by self-signing it.
这个屏幕图显示在默认的Windows 2003Server中所有可信的根CA证书，还有目前已经添加的两个证书（CS Germany CA 和Applix）。
The screenshot shows all trusted root CA certificates in a default Windows 2003 Server plus two additional certificate which have been added so far (CS Germany CA and Applix).
这要求Windows信任此证书，意味着必须导入正确的可信根ca。
Again this requires Windows to trust the certificate which implies to have the correct trusted root ca imported.
这个设置让TM 1根本不检查服务器证书，而是直接接受它。
With this setting TM1 will not verify the server certificate at all but simply accept it.
当CA使用自签名证书时(称为根ca)，该ca通常公开发布其自签名证书详细信息，因此用户可以确定该CA的真实性。
When the ca USES a self-signed certificate, called a Root ca, the ca usually publishes its self-signed certificate details publicly so that users can establish the authenticity of the ca.
应用推荐