关于网页上微信免扫码登陆，微信这样做不会被吊销证书吗？

[zhmouV2]

在一些第三方网站上，使用微信登录可以走免扫码快捷登录，本质是向 localhost.weixin.qq.com 发起请求：

而 localhost.weixin.qq.com 指向本地：

localhost.weixin.qq.com. 164	IN	A	127.0.0.1

显然本地微信程序应该监听了 14013 端口，而且起了 https 服务，但是要完成 TLS 握手需要证书对应的私钥。难道说微信是把私钥随应用程序分发到每台电脑上？

Let's Encrypt 上有文章提及过这一点并指出不该这么做：

You might be tempted to work around these limitations by setting up a domain name in the global DNS that happens to resolve to 127.0.0.1 (for instance, localhost.example.com), getting a certificate for that domain name, shipping that certificate and corresponding private key with your native app, and telling your web app to communicate with https://localhost.example.com:8000/ instead of http://127.0.0.1:8000/. Don’t do this. It will put your users at risk, and your certificate may get revoked.
（...中略...）
This is considered a compromise of your private key, and your Certificate Authority (CA) is required to revoke your certificate if they become aware of it. Many native apps have had their certificates revoked for shipping their private key.

这里面已经说过历史上很多应用都这么做过，然后被吊销了证书，至少我借助 AI 问了下是这样的。 而且目前来看，微信也没有用 mkcert 这类用自签名的开发证书，所以好奇是怎么实现的？

求答疑解惑。

[dzdh]

可以远程签名进行 tls 握手。私钥不放在本地也行。

Keyless SSL

https://www.cloudflare-cn.com/learning/ssl/keyless-ssl/

[InDom]

你说的这种可能确实存在, 但如果是我, 在知道这个前提条件的情况下, 我会考虑不将私钥下发到客户端.

而是客户端监听请求直接转发给服务器, 由服务器处理后返回给客户端, 或者客户端转发请求时就带上了自己的信息.

这样就可以避免问题了.