從.net Framework 4.7.2中的base64字符串創建certificateRequest

Question

過去，我將certTool用於CERTENROLLLib來創建csr 。 從版本4.7.2您可以使用.net Framework。

可以通過在CreateSigningRequest方法中傳遞所有必需的屬性來創建csr ，並將其轉換為pem base64字符串。

不幸的是，我找不到其他方法，在字段中以pem格式復制了一個csr，並從中讀取了所有csr屬性（cn，san，organization等）。

我不想使用com lib CERTENROLLLib ，openssl或其他第三方。

這是我所做的（為了獲取csr pem字符串）在這里以及在MS Framework類描述中找到了很好的示例，感謝您的幫助

protected void createButton_Click(object sender, EventArgs e)
    {
        string csr_cn = txtb_csr_cn.Text;
        string csr_c = txtb_csr_c.Text;
        string csr_l = txtb_csr_l.Text;
        string csr_o = txtb_csr_o.Text;
        string csr_ou = txtb_csr_ou.Text;
        string csr_s = txtb_csr_s.Text;
        csr_san = sanMemo.Text.Replace(" ", "");
        if (csr_san.IndexOf(csr_cn) == -1)
        {
            if (csr_san == "")
            {
                csr_san = csr_cn;
            }
            else
            {
                csr_san = csr_cn + "," + csr_san;
            }
        }
        csr_key_size = Convert.ToInt32(combobox_csr_key.Text);
        csr_info = "CN=" + csr_cn + "," + "OU=" + csr_ou + "," + "O=" + csr_o + "," + "L=" + csr_l + "," + "S=" + csr_s + "," + "C=" + csr_c;
        notesMemo.Text = CreateCSR(); //CreateRequest();

    }

public static string CreateCSR()
    {
        string[] arrSeperator = new string[] { "," };

        RSA keySize = RSA.Create(csr_key_size);

        CertificateRequest parentReq = new CertificateRequest(csr_info,
            //"CN=Experimental Issuing Authority",
            keySize,
            HashAlgorithmName.SHA256,
            RSASignaturePadding.Pkcs1);

        parentReq.CertificateExtensions.Add(
            new X509BasicConstraintsExtension(true, false, 0, true));

        parentReq.CertificateExtensions.Add(
            new X509SubjectKeyIdentifierExtension(parentReq.PublicKey, false));


        var sanBuilder = new SubjectAlternativeNameBuilder();
        Array arrsan = csr_san.Split(arrSeperator, StringSplitOptions.RemoveEmptyEntries);
        foreach (string sanvalue in arrsan)
        {
            sanBuilder.AddDnsName(sanvalue);
        }

        parentReq.CertificateExtensions.Add(sanBuilder.Build());

        string csrdecrypt = PemEncodeSigningRequest(parentReq);
        return csrdecrypt;

}

public static string PemEncodeSigningRequest(CertificateRequest request)
    {
        byte[] pkcs10 = request.CreateSigningRequest();
        StringBuilder builder = new StringBuilder();

        builder.AppendLine("-----BEGIN CERTIFICATE REQUEST-----");

        string base64 = Convert.ToBase64String(pkcs10);

        int offset = 0;
        const int LineLength = 64;

        while (offset < base64.Length)
        {
            int lineEnd = Math.Min(offset + LineLength, base64.Length);
            builder.AppendLine(base64.Substring(offset, lineEnd - offset));
            offset = lineEnd;
        }

        builder.AppendLine("-----END CERTIFICATE REQUEST-----");
        string tester2 = builder.ToString();
        return builder.ToString();
    }

Answer 1

沒有第三方庫，沒有純粹的托管方式可以讀取證書簽名請求。

您可以嘗試使用P / Invoke來CryptDecodeObjectEx ，可能使用X509_CERT的結構標識符（每個https://docs.microsoft.com/zh-cn/windows/desktop/SecCrypto/constants-for-cryptencodeobject-and-cryptdecodeobject ） 。

但是CertificateRequest類是沒有讀者的PKCS＃10作家。