如何使用自签名证书创建带有私钥的已签名X509证书

Question

如何使用自签名证书创建带有私钥的已签名X509证书

7

我想要做的是创建一个有效的证书来签署电子文档。这需要一个带有私钥的x509Certificate2对象。我无法弄清如何使用我创建的CA证书创建带有私钥的已签名证书。如果可能的话，我想仅使用.Net代码完成此操作（我正在使用4.7.2）。我现在拥有的代码可以创建带有私钥的有效CA证书，但是子证书没有私钥，因此无法用于签署电子文档。这是我现在拥有的代码...

        private void CreateCerts()
        {
            const string issuerName = "Issuer";
            const string signerName = "Signer";

            var root = GetCertificate(issuerName, StoreName.AuthRoot);

            if (root == null)
            {
                root = CreateRoot(issuerName);
            }

            var signer = GetCertificate(signerName, StoreName.My);

            if (signer == null)
            {
                signer = CreateSigner(root, signerName);
            }
        }

        private X509Certificate2 CreateSigner(X509Certificate2 root, string name)
        {
            X509Certificate2 signer = null;
            using (RSA rsa = RSA.Create(2048))
            {

                CertificateRequest req = new CertificateRequest(
                    $"CN={name}",
                    rsa,
                    HashAlgorithmName.SHA256,
                    RSASignaturePadding.Pkcs1);

                req.CertificateExtensions.Add(
                    new X509BasicConstraintsExtension(false, false, 0, false));

                req.CertificateExtensions.Add(
                    new X509KeyUsageExtension(
                        X509KeyUsageFlags.DigitalSignature | X509KeyUsageFlags.NonRepudiation,
                        false));

                req.CertificateExtensions.Add(
                    new X509EnhancedKeyUsageExtension(
                        new OidCollection
                        {
                            new Oid("1.3.6.1.5.5.7.3.8")
                        },
                        true));

                req.CertificateExtensions.Add(
                    new X509SubjectKeyIdentifierExtension(req.PublicKey, false));

                using (X509Certificate2 cert = req.Create(
                    root,
                    DateTimeOffset.UtcNow.AddDays(-1),
                    DateTimeOffset.UtcNow.AddDays(90),
                    new byte[] { 1, 2, 3, 4, 5, 6 }))
                {

                    using (var password = new SecureString())
                    {
                        password.AppendChar('P');
                        password.AppendChar('W');

                        var childExport = cert.Export(X509ContentType.Pfx, password);

                        signer = new X509Certificate2(childExport, password);

                        AddCertToStore(signer, StoreName.My, StoreLocation.LocalMachine);
                    }
                }
            }

            return signer;
        }

        private X509Certificate2 GetCertificate(string commonName, StoreName storeName)
        {
            X509Certificate2 certificate = null;

            // Look for a certificate in the local machine store.
            // We will search for a certificate that has a CN (common name) that matches
            // the currently logged-in user.
            using (var store = new X509Store(storeName, StoreLocation.LocalMachine))
            {
                store.Open(OpenFlags.ReadOnly);
                foreach (var cert in store.Certificates)
                {
                    var subjectNames = cert.SubjectName.Name.Split(',');
                    foreach (var subjectName in subjectNames)
                    {
                        if (subjectName.Equals($"CN={commonName}"))
                        {
                            certificate = cert;
                            break;
                        }
                    }

                    if (certificate != null)
                    {
                        break;
                    }
                }
            }

            return certificate;
        }

        private X509Certificate2 CreateRoot(string name)
        {
            X509Certificate2 root = null;

            using (RSA parent = RSA.Create(4096))
            {
                CertificateRequest parentReq = new CertificateRequest(
                    $"CN={name}",
                    parent,
                    HashAlgorithmName.SHA256,
                    RSASignaturePadding.Pkcs1);

                parentReq.CertificateExtensions.Add(
                    new X509BasicConstraintsExtension(true, false, 0, true));

                parentReq.CertificateExtensions.Add(
                    new X509SubjectKeyIdentifierExtension(parentReq.PublicKey, false));

                using (X509Certificate2 parentCert = parentReq.CreateSelfSigned(
                    DateTimeOffset.UtcNow.AddDays(-45),
                    DateTimeOffset.UtcNow.AddDays(365)))
                {
                    using (var password = new SecureString())
                    {
                        password.AppendChar('P');
                        password.AppendChar('W');

                        var export = parentCert.Export(X509ContentType.Pfx, password);
                        root = new X509Certificate2(export, password);

                        AddCertToStore(root, StoreName.AuthRoot, StoreLocation.LocalMachine);
                    }
                }
            }

            return root;
        }

        private void AddCertToStore(X509Certificate2 cert, StoreName name, StoreLocation location)
        {
            using (var store = new X509Store(name, location))
            {
                store.Open(OpenFlags.ReadWrite);
                store.Add(cert);

                store.Close();
            }
        }

- user3357795

你解决了吗？在这里分享修复方法。 - saravana

1个回答

网页内容由stack overflow 提供, 点击上面的

可以查看英文原文，
原文链接

- bartonjs · Accepted Answer

从另一个证书创建证书时，将输入密钥视为仅限公钥（实际上，在构造函数中它将接受PublicKey类型）。

如果您想与私钥配对，请使用CopyWithPrivateKey（扩展）方法：

using (X509Certificate2 cert = req.Create(
    root,
    DateTimeOffset.UtcNow.AddDays(-1),
    DateTimeOffset.UtcNow.AddDays(90),
    new byte[] { 1, 2, 3, 4, 5, 6 }))
{
    using (X509Certificate2 certWithKey = cert.CopyWithPrivateKey(rsa))
    {
        ...
    }
}