在颁发者名称与特定值匹配的集合中查找X509证书

Question

In my application i need to be able to find certs in a local store that match a certain issuer name. So, what I was doing before was:

LocalStore.Certificates.Find(X509FindType.FindByIssuerName, "My Common Name", True)

But since the new certificate server was installed and is using active directory my certificates "Issuer" field has additional attributes (DC values). Full string looks like this:

"CN=My Common Name, DC=MyCompanyDomain, DC=local"

This will not let me use Find method as before, and any combination of CN,DC values didnt work for me.

This is what I've tried in ImmediateWindow:

?LocalStore.Certificates.Item(0).IssuerName
{System.Security.Cryptography.X509Certificates.X500DistinguishedName}
    Name: "CN=My Common Name, DC=MyCompanyDomain, DC=local"
    Oid: {System.Security.Cryptography.Oid}
    RawData: {Length=85}
    m_distinguishedName: "CN=My Common Name, DC=MyCompanyDomain, DC=local"
    m_oid: {System.Security.Cryptography.Oid}
    m_rawData: {Length=85}
?LocalStore.Certificates.Find(X509FindType.FindBySubjectName, "My Common Name", True).Count 
0
?LocalStore.Certificates.Find(X509FindType.FindByIssuerName, "My Common", True).Count 
0
?LocalStore.Certificates.Find(X509FindType.FindByIssuerDistinguishedName, "My Common Name", True).Count 
0
?LocalStore.Certificates.Find(X509FindType.FindByIssuerDistinguishedName, "My", True).Count 
0

Answer 1

What you probably want is FindByIssuerDistingushedName .

FindByIssuerName is a case insensitive substring match against the issuer name in forward order with comma separators and no field tagging. That doesn't make a whole lot of sense as a sentence, so let's take an example.

The normal Windows (and .NET) way of printing things is actually Reversed, so your Issuer Distinguished Name is most likely DC=local, DC=MyCompanyDomain, CN=My Common Name . FindByIssuerName will turn that value into the string local, MyCompanyDomain, My Common Name , and then will match if your input is (case insensitively) found anywhere in that string.

• "local, MyCompanyDomain, My Common Name": Yep
• "local, mycompanyDOMAIN, My common name": Yep
• "local": Yep
• "m": Yep
• " ": Yep
• "banana": Nope

FindByIssuerDistinguishedName , on the other hand, is a case-insensitive equals against the same string as cert.Issuer returns. So the string you already have would be a match.

https://github.com/dotnet/corefx/blob/f252ef6d695176143aa46b855db5553fb6e44921/src/System.Security.Cryptography.X509Certificates/tests/FindTests.cs#L381-L406 shows the behavior-preserving unit tests for FindByIssuerName and FindByIssuerDistinguishedName.