仅使用.NET生成证书请求并提交给CA

Question

我正尝试仅使用.NET代码创建证书请求，并将该请求提交给我们的前提Active Directory PKI证书颁发机构，然后取回证书。我有一个已经工作了几年的解决方案，但它使用了CERTCLILib和CERTENROLLLib，我希望摆脱这些依赖关系，并将此代码移植到.NET5。

然后将这些证书导入到Yubikey设备上。我们在Yubikey上生成密钥对，然后将公钥与CSR一起使用。

这里的问题使用纯.NET Framework生成和签署证书请求对获得DER编码的CSR非常有帮助，但是我仍然有一些问题没有弄清楚。

1. 如何指定要在CertificateRequest对象中使用的CA和模板？
2. 我有一个公钥，它是rsaparameters对象。如何将其导入RSA对象，以便与CertificateRequst构造函数一起使用？
3. 一旦我有了DER编码的CSR，我如何将其提交给CA？在System.Security.Cryptography.X509Certificates命名空间中找不到任何实现此功能的类或方法。

下面是我想移植到.NET5的当前代码。请注意，devicedetails包含关于Yubikey设备以及CA和模板的属性。这段代码是提供Yubikey设备的更大应用程序的一部分。

    {
        //private const int CC_UIPICKCONFIG = 0x1;
        private const int CR_IN_BASE64 = 0x1;
        private const int CR_IN_FORMATANY = 0;
        private const int CR_DISP_ISSUED = 0x3;
        private const int CR_DISP_UNDER_SUBMISSION = 0x5;
        private const int CR_OUT_BASE64 = 0x1;

        public static string GenerateRequest(DeviceDetails deviceDetails)
        {
            //  Create all the objects that will be required
            var objPkcs10 = new CX509CertificateRequestPkcs10();
            var objDN = new CX500DistinguishedName();
            var objObjectIds = new CObjectIds();
            var objObjectId = new CObjectId();
            var objExtensionKeyUsage = new CX509ExtensionKeyUsage();
            var objX509ExtensionEnhancedKeyUsage = new CX509ExtensionEnhancedKeyUsage();
            var objPublicKey = new CX509PublicKey();

            try
            {
                var publicKey = Utilities.ExportPublicKeyToPEMFormat(deviceDetails.PublicKey);

                publicKey = string.Join("", publicKey.Split(new[] { "\r\n" }, StringSplitOptions.RemoveEmptyEntries).Where(s => !s.StartsWith("--")));

                objPublicKey.InitializeFromEncodedPublicKeyInfo(publicKey, EncodingType.XCN_CRYPT_STRING_BASE64);

                var sha512 = new CObjectId();
                sha512.InitializeFromValue("2.16.840.1.101.3.4.2.3");

                // Initialize the PKCS#10 certificate request object based on the public key.
                objPkcs10.InitializeFromPublicKey(X509CertificateEnrollmentContext.ContextUser, objPublicKey, "");
                objPkcs10.HashAlgorithm = sha512;

                //Key Usage Extension
                objExtensionKeyUsage.InitializeEncode(
                    X509KeyUsageFlags.XCN_CERT_DIGITAL_SIGNATURE_KEY_USAGE |
                    X509KeyUsageFlags.XCN_CERT_NON_REPUDIATION_KEY_USAGE |
                    X509KeyUsageFlags.XCN_CERT_KEY_ENCIPHERMENT_KEY_USAGE |
                    X509KeyUsageFlags.XCN_CERT_DATA_ENCIPHERMENT_KEY_USAGE
                );

                objPkcs10.X509Extensions.Add((CX509Extension)objExtensionKeyUsage);

                // Enhanced Key Usage Extension
                objObjectId.InitializeFromValue("1.3.6.1.5.5.7.3.2"); // OID for Client Authentication usage
                objObjectIds.Add(objObjectId);
                objX509ExtensionEnhancedKeyUsage.InitializeEncode(objObjectIds);
                objPkcs10.X509Extensions.Add((CX509Extension)objX509ExtensionEnhancedKeyUsage);

                //  Encode the name in using the Distinguished Name object
                objDN.Encode(
                    deviceDetails.CertificateDetails.Subject,
                    X500NameFlags.XCN_CERT_NAME_STR_NONE
                );

                //  Adding the subject name by using the Distinguished Name object initialized above
                objPkcs10.Subject = objDN;

                //  Adding the Subject Alternate Names
                var strRfc822Name = deviceDetails.UserDetails.OUN + "@corp.com";
                var strUpn = deviceDetails.UserDetails.OUN + "@corp.com";

                var objRfc822Name = new CAlternativeName();
                var objUserPrincipalName = new CAlternativeName();
                var objAlternativeNames = new CAlternativeNames();
                var objExtensionAlternativeNames = new CX509ExtensionAlternativeNames();

                // Set Alternative RFC822 Name
                objRfc822Name.InitializeFromString(AlternativeNameType.XCN_CERT_ALT_NAME_RFC822_NAME, strRfc822Name);
                

                // Set Alternative UPN
                objUserPrincipalName.InitializeFromString(AlternativeNameType.XCN_CERT_ALT_NAME_USER_PRINCIPLE_NAME, strUpn);

                // Set Alternative Names 
                objAlternativeNames.Add(objRfc822Name);
                
                objAlternativeNames.Add(objUserPrincipalName);
                objExtensionAlternativeNames.InitializeEncode(objAlternativeNames);
                objPkcs10.X509Extensions.Add((CX509Extension)objExtensionAlternativeNames);

                // Create a CMC outer request and initialize
                var cmcReq = new CX509CertificateRequestCmc();
                cmcReq.InitializeFromInnerRequestTemplateName(objPkcs10, deviceDetails.CertificateDetails.TemplateName);              

                // encode the request
                cmcReq.Encode();
                var strRequest = cmcReq.RawData[EncodingType.XCN_CRYPT_STRING_BASE64];
                return strRequest;
            }
            catch (Exception ex)
            {
                throw new Exception(ex.Message);
            }
        }

        // Submit request to CA and get response
        public static X509Certificate2 SendRequest(DeviceDetails deviceDetails, string request, out string error)
        {
            error = "";

            //  Create all the objects that will be required
            //var objCertConfig = new CCertConfig();
            var objCertRequest = new CCertRequest();

            try
            {
                // Submit the request
                var iDisposition = objCertRequest.Submit(
                    CR_IN_BASE64 | CR_IN_FORMATANY,
                    request,
                    null,
                    deviceDetails.CertificateDetails.IssuingCa
                );

                // Check the submission status
                if (CR_DISP_ISSUED != iDisposition) // Not enrolled
                {
                    var strDisposition = objCertRequest.GetDispositionMessage();

                    if (CR_DISP_UNDER_SUBMISSION == iDisposition) // Pending
                    {
                        error = "The submission is pending: " + strDisposition;
                        return null;
                    }

                    else // Failed
                    {
                        error = $"The submission failed: {strDisposition}. Last status: {objCertRequest.GetLastStatus()}";
                        return null;
                    }
                }

                // Get the certificate
                var strCert = objCertRequest.GetCertificate(CR_OUT_BASE64);
                var rawCert = Convert.FromBase64String(strCert);

                return new X509Certificate2(rawCert);
            }

            catch (Exception ex)
            {
                throw new Exception($"Error sending the request. {ex.Message}");
            }
        }

Answer 1

多部分的问题很难，因为它们需要多部分的答案。下面是我可以回答的部分：

如何指定要在CertificateRequest对象中使用的CA和模板？

不能，但没关系，因为在CertEnroll代码中也没有。CertificateRequest对象相当于您的ObjpKCS10，CA和模板用于处理CreateSigningRequest输出。

using (RSA key = RSA.Create())
{
    key.ImportParameters(rsaParameters);
    ...
}

一旦我有了DER编码的CSR，我如何将它提交给CA？我在System.Security.Cryptography.X509Certificates命名空间中找不到任何实现此功能的类或方法。

盒子里没有直接装这个的东西。基于CX509CertificateRequest类名，它似乎在使用CMS证书管理(CMC)，但仍然需要解决身份验证和请求提交部分。