TLS1.3: Certificate, Certificate Verify, Finished

複合したら見れた。

https://qiita.com/uturned0/items/bbff862b64d689a542ad

```yml
Transport Layer Security
    TLSv1.3 Record Layer: Handshake Protocol: Certificate
        Opaque Type: Application Data (23)
        Version: TLS 1.2 (0x0303)
        Length: 3599
        [Content Type: Handshake (22)]
        Handshake Protocol: Certificate
            Handshake Type: Certificate (11)
            Length: 3578
            Certificate Request Context Length: 0
            Certificates Length: 3574
            Certificates (3574 bytes)
                Certificate Length: 1867
                Certificate: 308207473082062fa00302010202100faa63109307bc3d414892640ccd4d9a300d06092a… (id-at-commonName=www.example.org,id-at-organizationName=Internet Corporation for Assigned Na,id-at-localityName=Los Angeles,id-at-stateOrProvince
                    signedCertificate
                        version: v3 (2)
                        serialNumber: 0x0faa63109307bc3d414892640ccd4d9a
                        signature (sha256WithRSAEncryption)
                            Algorithm Id: 1.2.840.113549.1.1.11 (sha256WithRSAEncryption)
                        issuer: rdnSequence (0)
                            rdnSequence: 3 items (id-at-commonName=DigiCert TLS RSA SHA256 2020 CA1,id-at-organizationName=DigiCert Inc,id-at-countryName=US)
                                RDNSequence item: 1 item (id-at-countryName=US)
                                    RelativeDistinguishedName item (id-at-countryName=US)
                                        Id: 2.5.4.6 (id-at-countryName)
                                        CountryName: US
                                RDNSequence item: 1 item (id-at-organizationName=DigiCert Inc)
                                    RelativeDistinguishedName item (id-at-organizationName=DigiCert Inc)
                                        Id: 2.5.4.10 (id-at-organizationName)
                                        DirectoryString: printableString (1)
                                            printableString: DigiCert Inc
                                RDNSequence item: 1 item (id-at-commonName=DigiCert TLS RSA SHA256 2020 CA1)
                                    RelativeDistinguishedName item (id-at-commonName=DigiCert TLS RSA SHA256 2020 CA1)
                                        Id: 2.5.4.3 (id-at-commonName)
                                        DirectoryString: printableString (1)
                                            printableString: DigiCert TLS RSA SHA256 2020 CA1
                        validity
                            notBefore: utcTime (0)
                                utcTime: 2022-03-14 00:00:00 (UTC)
                            notAfter: utcTime (0)
                                utcTime: 2023-03-14 23:59:59 (UTC)
                        subject: rdnSequence (0)
                            rdnSequence: 5 items (id-at-commonName=www.example.org,id-at-organizationName=Internet Corporation for Assigned Na,id-at-localityName=Los Angeles,id-at-stateOrProvinceName=California,id-at-countryName=US)
                                RDNSequence item: 1 item (id-at-countryName=US)
                                    RelativeDistinguishedName item (id-at-countryName=US)
                                        Id: 2.5.4.6 (id-at-countryName)
                                        CountryName: US
                                RDNSequence item: 1 item (id-at-stateOrProvinceName=California)
                                    RelativeDistinguishedName item (id-at-stateOrProvinceName=California)
                                        Id: 2.5.4.8 (id-at-stateOrProvinceName)
                                        DirectoryString: printableString (1)
                                            printableString: California
                                RDNSequence item: 1 item (id-at-localityName=Los Angeles)
                                    RelativeDistinguishedName item (id-at-localityName=Los Angeles)
                                        Id: 2.5.4.7 (id-at-localityName)
                                        DirectoryString: printableString (1)
                                            printableString: Los Angeles
                                RDNSequence item: 1 item (id-at-organizationName=Internet Corporation for Assigned Na)
                                    RelativeDistinguishedName item (id-at-organizationName=Internet Corporation for Assigned Names and Numbers)
                                        Id: 2.5.4.10 (id-at-organizationName)
                                        DirectoryString: uTF8String (4)
                                            uTF8String: Internet Corporation for Assigned Names and Numbers
                                RDNSequence item: 1 item (id-at-commonName=www.example.org)
                                    RelativeDistinguishedName item (id-at-commonName=www.example.org)
                                        Id: 2.5.4.3 (id-at-commonName)
                                        DirectoryString: printableString (1)
                                            printableString: www.example.org
                        subjectPublicKeyInfo
                            algorithm (rsaEncryption)
                                Algorithm Id: 1.2.840.113549.1.1.1 (rsaEncryption)
                            subjectPublicKey: 3082010a0282010100955d96639ae51a7d5fa70bee0618f49d505c3710b1907506fe9246…
                                modulus: 0x00955d96639ae51a7d5fa70bee0618f49d505c3710b1907506fe9246e07bda25e9fb6086…
                                publicExponent: 65537
                        extensions: 10 items
                            Extension (id-ce-authorityKeyIdentifier)
                                Extension Id: 2.5.29.35 (id-ce-authorityKeyIdentifier)
                                AuthorityKeyIdentifier
                                    keyIdentifier: b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4
                            Extension (id-ce-subjectKeyIdentifier)
                                Extension Id: 2.5.29.14 (id-ce-subjectKeyIdentifier)
                                SubjectKeyIdentifier: f72a09d0245b1171eebabef43e1c3d56128816bb
                            Extension (id-ce-subjectAltName)
                                Extension Id: 2.5.29.17 (id-ce-subjectAltName)
                                GeneralNames: 8 items
                                    GeneralName: dNSName (2)
                                        dNSName: www.example.org
                                    GeneralName: dNSName (2)
                                        dNSName: example.net
                                    GeneralName: dNSName (2)
                                        dNSName: example.edu
                                    GeneralName: dNSName (2)
                                        dNSName: example.com
                                    GeneralName: dNSName (2)
                                        dNSName: example.org
                                    GeneralName: dNSName (2)
                                        dNSName: www.example.com
                                    GeneralName: dNSName (2)
                                        dNSName: www.example.edu
                                    GeneralName: dNSName (2)
                                        dNSName: www.example.net
                            Extension (id-ce-keyUsage)
                                Extension Id: 2.5.29.15 (id-ce-keyUsage)
                                critical: True
                                Padding: 5
                                KeyUsage: a0
                                    1... .... = digitalSignature: True
                                    .0.. .... = contentCommitment: False
                                    ..1. .... = keyEncipherment: True
                                    ...0 .... = dataEncipherment: False
                                    .... 0... = keyAgreement: False
                                    .... .0.. = keyCertSign: False
                                    .... ..0. = cRLSign: False
                                    .... ...0 = encipherOnly: False
                                    0... .... = decipherOnly: False
                            Extension (id-ce-extKeyUsage)
                                Extension Id: 2.5.29.37 (id-ce-extKeyUsage)
                                KeyPurposeIDs: 2 items
                                    KeyPurposeId: 1.3.6.1.5.5.7.3.1 (id-kp-serverAuth)
                                    KeyPurposeId: 1.3.6.1.5.5.7.3.2 (id-kp-clientAuth)
                            Extension (id-ce-cRLDistributionPoints)
                                Extension Id: 2.5.29.31 (id-ce-cRLDistributionPoints)
                                CRLDistPointsSyntax: 2 items
                                    DistributionPoint
                                        distributionPoint: fullName (0)
                                            fullName: 1 item
                                                GeneralName: uniformResourceIdentifier (6)
                                                    uniformResourceIdentifier: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl
                                    DistributionPoint
                                        distributionPoint: fullName (0)
                                            fullName: 1 item
                                                GeneralName: uniformResourceIdentifier (6)
                                                    uniformResourceIdentifier: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl
                            Extension (id-ce-certificatePolicies)
                                Extension Id: 2.5.29.32 (id-ce-certificatePolicies)
                                CertificatePoliciesSyntax: 1 item
                                    PolicyInformation
                                        policyIdentifier: 2.23.140.1.2.2 (joint-iso-itu-t.23.140.1.2.2)
                                        policyQualifiers: 1 item
                                            PolicyQualifierInfo
                                                Id: 1.3.6.1.5.5.7.2.1 (id-qt-cps)
                                                DirectoryString: http://www.digicert.com/CPS
                            Extension (id-pe-authorityInfoAccess)
                                Extension Id: 1.3.6.1.5.5.7.1.1 (id-pe-authorityInfoAccess)
                                AuthorityInfoAccessSyntax: 2 items
                                    AccessDescription
                                        accessMethod: 1.3.6.1.5.5.7.48.1 (id-ad-ocsp)
                                        accessLocation: 6
                                            uniformResourceIdentifier: http://ocsp.digicert.com
                                    AccessDescription
                                        accessMethod: 1.3.6.1.5.5.7.48.2 (id-ad-caIssuers)
                                        accessLocation: 6
                                            uniformResourceIdentifier: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt
                            Extension (id-ce-basicConstraints)
                                Extension Id: 2.5.29.19 (id-ce-basicConstraints)
                                BasicConstraintsSyntax [0 length]
                            Extension (SignedCertificateTimestampList)
                                Extension Id: 1.3.6.1.4.1.11129.2.4.2 (SignedCertificateTimestampList)
                                Serialized SCT List Length: 358
                                Signed Certificate Timestamp (Google 'Argon2023' log)
                                    Serialized SCT Length: 117
                                    SCT Version: 0
                                    Log ID: e83ed0da3ef5063532e75728bc896bc903d3cbd1116beceb69e1777d6d06bd6e
                                    Timestamp: Mar 14, 2022 22:48:46.197000000 UTC
                                    Extensions length: 0
                                    Signature Algorithm: ecdsa_secp256r1_sha256 (0x0403)
                                        Signature Hash Algorithm Hash: SHA256 (4)
                                        Signature Hash Algorithm Signature: ECDSA (3)
                                    Signature Length: 70
                                    Signature: 304402203178f353eb467fbd32533d5af2886cd7acbc4234942ab5e50b920b8110c6c6fe…
                                Signed Certificate Timestamp (DigiCert Yeti2023 Log)
                                    Serialized SCT Length: 117
                                    SCT Version: 0
                                    Log ID: 35cf191bbfb16c57bf0fad4c6d42cbbbb627202651ea3fe12aefa803c33bd64c
                                    Timestamp: Mar 14, 2022 22:48:46.204000000 UTC
                                    Extensions length: 0
                                    Signature Algorithm: ecdsa_secp256r1_sha256 (0x0403)
                                        Signature Hash Algorithm Hash: SHA256 (4)
                                        Signature Hash Algorithm Signature: ECDSA (3)
                                    Signature Length: 70
                                    Signature: 304402203b294f1c24501a44a1e03e22894d63038a97d6319b093cd7ac9dd0ed8824f65c…
                                Signed Certificate Timestamp (DigiCert Nessie2023 Log)
                                    Serialized SCT Length: 118
                                    SCT Version: 0
                                    Log ID: b3737707e18450f86386d605a9dc11094a792db1670c0b87dcf0030e7936a59a
                                    Timestamp: Mar 14, 2022 22:48:46.215000000 UTC
                                    Extensions length: 0
                                    Signature Algorithm: ecdsa_secp256r1_sha256 (0x0403)
                                        Signature Hash Algorithm Hash: SHA256 (4)
                                        Signature Hash Algorithm Signature: ECDSA (3)
                                    Signature Length: 71
                                    Signature: 30450220291eeac0f2d06fa513dbe4bbc3bb90b1bb0365f6555ff83c16406d025b5a4e90…
                    algorithmIdentifier (sha256WithRSAEncryption)
                        Algorithm Id: 1.2.840.113549.1.1.11 (sha256WithRSAEncryption)
                    Padding: 0
                    encrypted: aa9fbe5d911bade44e4ecc8f07644435b4ad3b133fc129d8b4abf3425149463bd6cf1e41…
                Extensions Length: 479
                Extension: status_request (len=475)
                    Type: status_request (5)
                    Length: 475
                    Certificate Status Type: OCSP (1)
                    OCSP Response Length: 471
                    OCSP Response
                        responseStatus: successful (0)
                        responseBytes
                            ResponseType Id: 1.3.6.1.5.5.7.48.1.1 (id-pkix-ocsp-basic)
                            BasicOCSPResponse
                                tbsResponseData
                                    responderID: byKey (2)
                                        byKey: b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4
                                    producedAt: 2022-08-24 05:30:21 (UTC)
                                    responses: 1 item
                                        SingleResponse
                                            certID
                                                hashAlgorithm (SHA-1)
                                                    Algorithm Id: 1.3.14.3.2.26 (SHA-1)
                                                issuerNameHash: e4e395a229d3d4c1c31ff0980c0b4ec0098aabd8
                                                issuerKeyHash: b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4
                                                serialNumber: 0x0faa63109307bc3d414892640ccd4d9a
                                            certStatus: good (0)
                                                good
                                            thisUpdate: 2022-08-24 05:09:01 (UTC)
                                            nextUpdate: 2022-08-31 04:24:01 (UTC)
                                signatureAlgorithm (sha256WithRSAEncryption)
                                    Algorithm Id: 1.2.840.113549.1.1.11 (sha256WithRSAEncryption)
                                Padding: 0
                                signature: af403d59728b2972a64d968ac30bffeeccd5bd2641b7d357643da0122fe1c2c72c4722ef…
                Certificate Length: 1218
                Certificate: 308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a… (id-at-commonName=DigiCert TLS RSA SHA256 2020 CA1,id-at-organizationName=DigiCert Inc,id-at-countryName=US)
                    signedCertificate
                        version: v3 (2)
                        serialNumber: 0x06d8d904d5584346f68a2fa754227ec4
                        signature (sha256WithRSAEncryption)
                            Algorithm Id: 1.2.840.113549.1.1.11 (sha256WithRSAEncryption)
                        issuer: rdnSequence (0)
                            rdnSequence: 4 items (id-at-commonName=DigiCert Global Root CA,id-at-organizationalUnitName=www.digicert.com,id-at-organizationName=DigiCert Inc,id-at-countryName=US)
                                RDNSequence item: 1 item (id-at-countryName=US)
                                    RelativeDistinguishedName item (id-at-countryName=US)
                                        Id: 2.5.4.6 (id-at-countryName)
                                        CountryName: US
                                RDNSequence item: 1 item (id-at-organizationName=DigiCert Inc)
                                    RelativeDistinguishedName item (id-at-organizationName=DigiCert Inc)
                                        Id: 2.5.4.10 (id-at-organizationName)
                                        DirectoryString: printableString (1)
                                            printableString: DigiCert Inc
                                RDNSequence item: 1 item (id-at-organizationalUnitName=www.digicert.com)
                                    RelativeDistinguishedName item (id-at-organizationalUnitName=www.digicert.com)
                                        Id: 2.5.4.11 (id-at-organizationalUnitName)
                                        DirectoryString: printableString (1)
                                            printableString: www.digicert.com
                                RDNSequence item: 1 item (id-at-commonName=DigiCert Global Root CA)
                                    RelativeDistinguishedName item (id-at-commonName=DigiCert Global Root CA)
                                        Id: 2.5.4.3 (id-at-commonName)
                                        DirectoryString: printableString (1)
                                            printableString: DigiCert Global Root CA
                        validity
                            notBefore: utcTime (0)
                                utcTime: 2021-04-14 00:00:00 (UTC)
                            notAfter: utcTime (0)
                                utcTime: 2031-04-13 23:59:59 (UTC)
                        subject: rdnSequence (0)
                            rdnSequence: 3 items (id-at-commonName=DigiCert TLS RSA SHA256 2020 CA1,id-at-organizationName=DigiCert Inc,id-at-countryName=US)
                                RDNSequence item: 1 item (id-at-countryName=US)
                                    RelativeDistinguishedName item (id-at-countryName=US)
                                        Id: 2.5.4.6 (id-at-countryName)
                                        CountryName: US
                                RDNSequence item: 1 item (id-at-organizationName=DigiCert Inc)
                                    RelativeDistinguishedName item (id-at-organizationName=DigiCert Inc)
                                        Id: 2.5.4.10 (id-at-organizationName)
                                        DirectoryString: printableString (1)
                                            printableString: DigiCert Inc
                                RDNSequence item: 1 item (id-at-commonName=DigiCert TLS RSA SHA256 2020 CA1)
                                    RelativeDistinguishedName item (id-at-commonName=DigiCert TLS RSA SHA256 2020 CA1)
                                        Id: 2.5.4.3 (id-at-commonName)
                                        DirectoryString: printableString (1)
                                            printableString: DigiCert TLS RSA SHA256 2020 CA1
                        subjectPublicKeyInfo
                            algorithm (rsaEncryption)
                                Algorithm Id: 1.2.840.113549.1.1.1 (rsaEncryption)
                            subjectPublicKey: 3082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c…
                                modulus: 0x00c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdc…
                                publicExponent: 65537
                        extensions: 8 items
                            Extension (id-ce-basicConstraints)
                                Extension Id: 2.5.29.19 (id-ce-basicConstraints)
                                critical: True
                                BasicConstraintsSyntax
                                    cA: True
                                    pathLenConstraint: 0
                            Extension (id-ce-subjectKeyIdentifier)
                                Extension Id: 2.5.29.14 (id-ce-subjectKeyIdentifier)
                                SubjectKeyIdentifier: b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4
                            Extension (id-ce-authorityKeyIdentifier)
                                Extension Id: 2.5.29.35 (id-ce-authorityKeyIdentifier)
                                AuthorityKeyIdentifier
                                    keyIdentifier: 03de503556d14cbb66f0a3e21b1bc397b23dd155
                            Extension (id-ce-keyUsage)
                                Extension Id: 2.5.29.15 (id-ce-keyUsage)
                                critical: True
                                Padding: 1
                                KeyUsage: 86
                                    1... .... = digitalSignature: True
                                    .0.. .... = contentCommitment: False
                                    ..0. .... = keyEncipherment: False
                                    ...0 .... = dataEncipherment: False
                                    .... 0... = keyAgreement: False
                                    .... .1.. = keyCertSign: True
                                    .... ..1. = cRLSign: True
                                    .... ...0 = encipherOnly: False
                                    0... .... = decipherOnly: False
                            Extension (id-ce-extKeyUsage)
                                Extension Id: 2.5.29.37 (id-ce-extKeyUsage)
                                KeyPurposeIDs: 2 items
                                    KeyPurposeId: 1.3.6.1.5.5.7.3.1 (id-kp-serverAuth)
                                    KeyPurposeId: 1.3.6.1.5.5.7.3.2 (id-kp-clientAuth)
                            Extension (id-pe-authorityInfoAccess)
                                Extension Id: 1.3.6.1.5.5.7.1.1 (id-pe-authorityInfoAccess)
                                AuthorityInfoAccessSyntax: 2 items
                                    AccessDescription
                                        accessMethod: 1.3.6.1.5.5.7.48.1 (id-ad-ocsp)
                                        accessLocation: 6
                                            uniformResourceIdentifier: http://ocsp.digicert.com
                                    AccessDescription
                                        accessMethod: 1.3.6.1.5.5.7.48.2 (id-ad-caIssuers)
                                        accessLocation: 6
                                            uniformResourceIdentifier: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt
                            Extension (id-ce-cRLDistributionPoints)
                                Extension Id: 2.5.29.31 (id-ce-cRLDistributionPoints)
                                CRLDistPointsSyntax: 1 item
                                    DistributionPoint
                                        distributionPoint: fullName (0)
                                            fullName: 1 item
                                                GeneralName: uniformResourceIdentifier (6)
                                                    uniformResourceIdentifier: http://crl3.digicert.com/DigiCertGlobalRootCA.crl
                            Extension (id-ce-certificatePolicies)
                                Extension Id: 2.5.29.32 (id-ce-certificatePolicies)
                                CertificatePoliciesSyntax: 5 items
                                    PolicyInformation
                                        policyIdentifier: 2.16.840.1.114412.2.1 (US company arc.114412.2.1)
                                    PolicyInformation
                                        policyIdentifier: 2.23.140.1.1 (joint-iso-itu-t.23.140.1.1)
                                    PolicyInformation
                                        policyIdentifier: 2.23.140.1.2.1 (joint-iso-itu-t.23.140.1.2.1)
                                    PolicyInformation
                                        policyIdentifier: 2.23.140.1.2.2 (joint-iso-itu-t.23.140.1.2.2)
                                    PolicyInformation
                                        policyIdentifier: 2.23.140.1.2.3 (joint-iso-itu-t.23.140.1.2.3)
                    algorithmIdentifier (sha256WithRSAEncryption)
                        Algorithm Id: 1.2.840.113549.1.1.11 (sha256WithRSAEncryption)
                    Padding: 0
                    encrypted: 8032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178…
                Extensions Length: 0

```