如何在.NET标准2.0/Core 2.1中使用PrivateKey创建X509Certificate2？

Question

private static X509Certificate2 CreateCertificate(string subject, DateTimeOffset notBefore, DataTimeOffset notAfter, string issuer, AsymmetricKeyParamter issuerPrivateKey)
{
        // Setup
        X509V3CertificateGenerator certGenerator = new X509V3CertificateGenerator();
        SecureRandom random = new SecureRandom(new CryptoApiRandomGenerator());

        RsaKeyPairGenerator keyPairGenerator = new RsaKeyPairGenerator();
        keyPairGenerator.Init(new KeyGenerationParameters(random, KeyStrength));

        // Randomly generate a serial number
        BigInteger serialNumber = BigIntegers.CreateRandomInRange(BigInteger.One, BigInteger.ValueOf(long.MaxValue), random);
        certGenerator.SetSerialNumber(serialNumber);

        // Set the issuer and subject names
        X509Name issuerName = new X509Name(issuer);
        X509Name subjectName = new X509Name(subject);
        certGenerator.SetIssuerDN(issuerName);
        certGenerator.SetSubjectDN(subjectName);

        // Set the validity period
        certGenerator.SetNotBefore(notBefore.UtcDateTime);
        certGenerator.SetNotAfter(notAfter.UtcDateTime);

        // Randomly generate the public key
        AsymmetricCipherKeyPair subjectKeyPair = keyPairGenerator.GenerateKeyPair();
        certGenerator.SetPublicKey(subjectKeyPair.Public);

        // Generate the signed certificate
        ISignatureFactory signatureFactory = new Asn1SignatureFactory(SHA256RSASignatureAlgorithm, issuerPrivateKey ?? subjectKeyPair.Private, random);
        X509Certificate2 certificate = new X509Certificate2(certGenerator.Generate(signatureFactory).GetEncoded());

        // Include the private key with the response
        // ERROR HERE!
        certificate.PrivateKey = DotNetUtilities.ToRSA(subjectKeyPair.Private as RsaPrivateCrtKeyParameters);

        return certificate;
}

如何在.NET Standard 2.0中以与.NET Core兼容的方式创建具有私钥的X509Certificate2？

Answer 1

经过大量挖掘，我找到的唯一解决方案是将证书转换为PKCS12格式的字节数组，附加私钥，然后将其读回X509Certificate2对象。它糟透了，但根据我在.NET Core中所知，您可以通过私钥获得一个密钥的唯一方法是调用CopyWithPrivateKey（如问题中所述，在.NET Standard 2.0中不可用），或者加载包含私钥的PKCS12数据。下面的代码可以做到这一点：

    private static X509Certificate2 AddPrivateKeyPlatformIndependent(Org.BouncyCastle.X509.X509Certificate bouncyCastleCert, AsymmetricKeyParameter privateKey)
    {
        string alias = bouncyCastleCert.SubjectDN.ToString();
        Pkcs12Store store = new Pkcs12StoreBuilder().Build();

        X509CertificateEntry certEntry = new X509CertificateEntry(bouncyCastleCert);
        store.SetCertificateEntry(alias, certEntry);

        // TODO: This needs extra logic to support a certificate chain
        AsymmetricKeyEntry keyEntry = new AsymmetricKeyEntry(privateKey);
        store.SetKeyEntry(alias, keyEntry, new X509CertificateEntry[] { certEntry });

        byte[] certificateData;
        string password = GenerateRandomString();
        using (MemoryStream memoryStream = new MemoryStream())
        {
            store.Save(memoryStream, password.ToCharArray(), new SecureRandom());
            memoryStream.Flush();
            certificateData = memoryStream.ToArray();
        }

        return new X509Certificate2(certificateData, password, X509KeyStorageFlags.Exportable);
    }

使用它来代替问题代码中的最后两行，并且不是使用CertGenerator创建X509Certificate2，而是使用它创建等效的Bouncy Castle类型来传递给它:org.bouncyCastle.x509.x509Certificate bouncyCastleCert=CertGenerator.Generate(signatureFactory)；

由于关于Bouncy Castle和.NET证书的文档充其量是稀疏的，下面是我在此过程中发现的一些怪癖：

>

PKCS12容器中证书项和密钥项的别名必须相同。否则，您将在尝试使用私钥时得到一个“keyset不存在”异常。

加载字节数组时必须使用X509KeyStorageFlags.Exportable，否则可能会出现“密钥在指定状态下使用无效”异常，具体取决于证书的使用方式。这也意味着您必须提供密码，因为没有密码就不会重载，但是您可以使用任何旧字符串，因为它是临时密码。