简体繁体 English

如何以编程方式获取用于在.NET中进行数字签名的公司信息？

[英]How can I programmatically obtain the company info used to digitally sign an assembly in .NET?

原文 2010-04-15 02:10:31 6 2 c#/ .net/ assemblies/ code-signing/ digital-signature

As a means of simple security, I was previously checking the digital signature of a downloaded update package for my program against its public key to ensure that it originated from me. 作为一种简单的安全措施，我以前根据程序的公钥检查了已下载的程序更新包的数字签名，以确保该程序源自我。 However, as I'm using cheap code signing certs (Tucows), I am unable to renew an existing cert and therefore the keys change every time I need to renew. 但是，由于我使用的是便宜的代码签名证书（Tucows），因此我无法续订现有证书，因此，每次需要续订时，密钥都会更改。

Therefore, a more reliable means would be to verify the organization information embedded in the signed assembly (which is displayed in the UAC dialog) against my well-known organization string, as this will continue to be the same. 因此，一种更可靠的方法是对照我熟知的组织字符串来验证嵌入在已签名程序集中（在UAC对话框中显示）的组织信息，因为这将继续保持不变。

Does anyone know how to obtain this information from a digitally-signed assembly? 有谁知道如何从数字签名的程序集中获取此信息？

2 个解决方案

Isn't it enough to just check that the assembly is strong named using your key? 仅使用您的密钥检查程序集是否为强命名就够了吗？ Authenticode mostly benefits the end user who can identify that you are who you say you are (due to the efforts of the cert. authority). Authenticode最能使最终用户受益，因为它可以证明您是您的真实身份（由于证书颁发机构的努力）。 To my mind, in your situation, there's no extra security in an authenticode certificate over a simple strong name. 我认为，在您的情况下，authenticode证书中的简单强名称没有任何额外的安全性。

I assume a strong name is much simpler to verify, and you won't have to worry about your key changing. 我认为一个强名更容易验证，并且您不必担心密钥更改。

Assuming that the assembly is signed using Authenticode technology and X.509 certificates (and not just strong-named), you need an Authenticode reader code (or component) to extract the certificate and validate it. 假定程序集使用Authenticode技术和X.509证书（而不仅仅是强名称）签名，则需要Authenticode读取器代码（或组件）以提取证书并对其进行验证。 After that you will find organization name in one of the fields of certificate's SubjectName or SubjectRDN record. 之后，您将在证书的SubjectName或SubjectRDN记录的字段之一中找到组织名称。

We offer Authenticode reader class and certificate manipulation class in PKIBlackbox package. 我们在PKIBlackbox包中提供Authenticode读取器类和证书操作类。