背景
生成数字证书用于PDF文档数字签名
数字证书需要考虑环境兼容性，如linux、windows
网上资料不全或版本多样
本文章主要介绍了在C#中使用BouncyCastle生成PKCS#12个人信息交换语法标准的pfx证书、cer证书，旨在引导大家了解非对称加密算法，快速、轻松的使用证书对文本进行加密、解密，额外提供了RSAHelper类，包含加密、解密、签名、验签函数，支持无限长度、分段加解密，如有错误、欢迎留言指正；
pfx证书：含有公钥、私钥
cer证书：只含有公钥
非对称加密算法：常见的有很多，这其中最有名、最常用的还是RSA
RSA文件格式有很多中，PKCS#12只是其中一种，除此之外还有PKCS#1、PKCS#7、PKCS#8等，具体有什么区别，我这里不再进行阐述，自行百度；
不同语言采用的RSA文件格式不同，如java的私钥采用的是PKCS8，c#的私钥采用的是PKCS1，c#和java生成的私钥要让对方使用的就需要进行转换为对方语言适用的文件格式；
依赖
本文示例代码依赖于BouncyCastle.Crypto.dll，可以在项目中使用NuGet程序包引入。
源码
RSAHelper类
1 public class RSAHelper
2 {
3 #region 使用私钥签名Sign(string data, string privateKey, RSAType rsaType, Encoding encoding)
4 /// <summary>
5 /// 使用私钥签名
6 /// </summary>
7 /// <param name="data">待签名串</param>
8 /// <param name="privateKey">私钥</param>
9 /// <param name="encoding">编码类型，推荐使用UTF8</param>
10 /// <param name="rsaType">签名类型，默认RSA2</param>
11 /// <returns></returns>
12 public static string Sign(string data, string privateKey, Encoding encoding, RSAType rsaType = RSAType.RSA2)
13 {
14 encoding = encoding ?? Encoding.UTF8;
15 byte[] dataBytes = encoding.GetBytes(data);
16 RSA _privateKeyRsaProvider = CreateRsaProviderFromPrivateKey(privateKey);
17 HashAlgorithmName _hashAlgorithmName = rsaType == RSAType.RSA ? HashAlgorithmName.SHA1 : HashAlgorithmName.SHA256;
18 var signatureBytes = _privateKeyRsaProvider.SignData(dataBytes, _hashAlgorithmName, RSASignaturePadding.Pkcs1);
19 return Convert.ToBase64String(signatureBytes);
20 }
21 /// <summary>
22 /// 使用私钥签名，默认Encoding为Encoding.UTF8
23 /// </summary>
24 /// <param name="data">待签名串</param>
25 /// <param name="privateKey">私钥</param>
26 /// <param name="rsaType">签名类型，默认RSA2</param>
27 /// <returns></returns>
28 public static string Sign(string data, string privateKey, RSAType rsaType = RSAType.RSA2)
29 {
30 return Sign(data, privateKey, Encoding.UTF8, rsaType);
31 }
32 /// <summary>
33 /// 使用私钥签名
34 /// </summary>
35 /// <param name="parameters">待签参数</param>
36 /// <param name="privateKey">私钥</param>
37 /// <param name="encoding">编码类型，推荐使用UTF8</param>
38 /// <param name="rsaType">签名类型，默认RSA2</param>
39 /// <param name="removeSign">是否移除签名串，默认移除名为“sign”的签名串</param>
40 /// <returns></returns>
41 public static string SignParameters(IDictionary<string, string> parameters, string privateKey, Encoding encoding, RSAType rsaType = RSAType.RSA2, bool removeSign = true)
42 {
43
44 string data = GetSignContent(parameters, removeSign);
45 byte[] dataBytes = encoding.GetBytes(data);
46 RSA _privateKeyRsaProvider = CreateRsaProviderFromPrivateKey(privateKey);
47 HashAlgorithmName _hashAlgorithmName = rsaType == RSAType.RSA ? HashAlgorithmName.SHA1 : HashAlgorithmName.SHA256;
48 var signatureBytes = _privateKeyRsaProvider.SignData(dataBytes, _hashAlgorithmName, RSASignaturePadding.Pkcs1);
49 return Convert.ToBase64String(signatureBytes);
50 }
51 /// <summary>
52 /// 使用私钥签名，默认Encoding为Encoding.UTF8
53 /// </summary>
54 /// <param name="parameters">待签参数</param>
55 /// <param name="privateKey">私钥</param>
56 /// <param name="rsaType">签名类型，默认RSA2</param>
57 /// <param name="removeSign">是否移除签名串，默认移除名为“sign”的签名串</param>
58 /// <returns></returns>
59 public static string SignParameters(IDictionary<string, string> parameters, string privateKey, RSAType rsaType = RSAType.RSA2, bool removeSign = true)
60 {
61 return SignParameters(parameters, privateKey, Encoding.UTF8, rsaType, removeSign);
62 }
63 #endregion
64
65 #region 使用公钥验证签名Verify(string data, string sign,string publickey,RSAType rsaType,Encoding encoding)
66 /// <summary>
67 /// 使用公钥验证签名
68 /// </summary>
69 /// <param name="data">原始数据</param>
70 /// <param name="sign">签名串</param>
71 /// <param name="publickey">公钥</param>
72 /// <param name="encoding">编码类型，推荐使用UTF8</param>
73 /// <param name="rsaType">签名类型，推默认RSA2</param>
74 /// <returns></returns>
75 public static bool Verify(string data, string sign, string publickey, Encoding encoding, RSAType rsaType = RSAType.RSA2)
76 {
77 byte[] dataBytes = encoding.GetBytes(data);
78 byte[] signBytes = Convert.FromBase64String(sign);
79 RSA _publicKeyRsaProvider = CreateRsaProviderFromPublicKey(publickey);
80 HashAlgorithmName _hashAlgorithmName = rsaType == RSAType.RSA ? HashAlgorithmName.SHA1 : HashAlgorithmName.SHA256;
81 var verify = _publicKeyRsaProvider.VerifyData(dataBytes, signBytes, _hashAlgorithmName, RSASignaturePadding.Pkcs1);
82 return verify;
83 }
84 /// <summary>
85 /// 使用公钥验证签名 默认Encoding为Encoding.UTF8
86 /// </summary>
87 /// <param name="data">原始数据</param>
88 /// <param name="sign">签名串</param>
89 /// <param name="publickey">公钥</param>
90 /// <param name="rsaType">签名类型，推默认RSA2</param>
91 /// <returns></returns>
92 public static bool Verify(string data, string sign, string publickey, RSAType rsaType = RSAType.RSA2)
93 {
94 return Verify(data, sign, publickey, Encoding.UTF8, rsaType);
95 }
96 /// <summary>
97 /// 使用公钥验证签名
98 /// </summary>
99 /// <param name="parameters">代验签参数</param>
100 /// <param name="publickey">公钥</param>
101 /// <param name="encoding">编码类型，推荐使用UTF8</param>
102 /// <param name="rsaType">签名类型，推荐使用RSA2</param>
103 /// <param name="removeSign">是否移除签名串，默认移除名为“sign”的签名串</param>
104 /// <returns></returns>
105 public static bool VerifyParameters(IDictionary<string, string> parameters, string publickey, Encoding encoding, RSAType rsaType = RSAType.RSA2, bool removeSign = true)
106 {
107 string sign = parameters["sign"];
108 parameters.Remove("sign");
109
110 byte[] dataBytes = encoding.GetBytes(GetSignContent(parameters, removeSign));
111 byte[] signBytes = Convert.FromBase64String(sign);
112 RSA _publicKeyRsaProvider = CreateRsaProviderFromPublicKey(publickey);
113 HashAlgorithmName _hashAlgorithmName = rsaType == RSAType.RSA ? HashAlgorithmName.SHA1 : HashAlgorithmName.SHA256;
114 var verify = _publicKeyRsaProvider.VerifyData(dataBytes, signBytes, _hashAlgorithmName, RSASignaturePadding.Pkcs1);
115 return verify;
116 }
117 /// <summary>
118 /// 使用公钥验证签名 默认Encoding为Encoding.UTF8
119 /// </summary>
120 /// <param name="parameters">代验签参数</param>
121 /// <param name="publickey">公钥</param>
122 /// <param name="rsaType">签名类型，推荐使用RSA2</param>
123 /// <param name="removeSign">是否移除签名串，默认移除名为“sign”的签名串</param>
124 /// <returns></returns>
125 public static bool VerifyParameters(IDictionary<string, string> parameters, string publickey, RSAType rsaType = RSAType.RSA2, bool removeSign = true)
126 {
127 return VerifyParameters(parameters, publickey, Encoding.UTF8, rsaType, removeSign);
128 }
129 #endregion
130
131 #region 获取/组装待签名串GetSignContent(IDictionary<string, string> parameters, bool removeSign = true)
132 /// <summary>
133 /// 获取/组装待签名串
134 /// </summary>
135 /// <param name="parameters">参数内容</param>
136 /// <param name="removeSign">是否移除签名串，默认移除名为“sign”的签名串</param>
137 /// <returns></returns>
138 public static string GetSignContent(IDictionary<string, string> parameters, bool removeSign = true)
139 {
140 if (removeSign && parameters.ContainsKey("sign"))
141 {
142 parameters.Remove("sign");
143 }
144 // 第一步：把字典按Key的字母顺序排序
145 IDictionary<string, string> sortedParams = new SortedDictionary<string, string>(parameters);
146 IEnumerator<KeyValuePair<string, string>> dem = sortedParams.GetEnumerator();
147
148 // 第二步：把所有参数名和参数值串在一起
149 StringBuilder query = new StringBuilder("");
150 while (dem.MoveNext())
151 {
152 string key = dem.Current.Key;
153 string value = dem.Current.Value;
154 if (!string.IsNullOrEmpty(key) && !string.IsNullOrEmpty(value)) // 空字段不加入签名/验签
155 {
156 query.Append(key).Append("=").Append(value).Append("&");
157 }
158 }
159 string content = query.ToString().Substring(0, query.Length - 1);
160
161 return content;
162 }
163 #endregion
164
165 #region 解密Decrypt(string cipherText,string privateKey)
166 /// <summary>
167 /// 解密(无限长度)
168 /// </summary>
169 /// <param name="cipherText">加密串</param>
170 /// <param name="privateKey">私钥</param>
171 /// <returns></returns>
172 public static string Decrypt(string cipherText, string privateKey)
173 {
174 RSA _privateKeyRsaProvider = CreateRsaProviderFromPrivateKey(privateKey);
175 if (_privateKeyRsaProvider == null)
176 {
177 throw new Exception("_privateKeyRsaProvider is null");
178 }
179 var inputBytes = Convert.FromBase64String(cipherText);
180 int bufferSize = _privateKeyRsaProvider.KeySize / 8;
181 var buffer = new byte[bufferSize];
182 using (MemoryStream inputStream = new MemoryStream(inputBytes),
183 outputStream = new MemoryStream())
184 {
185 while (true)
186 {
187 int readSize = inputStream.Read(buffer, 0, bufferSize);
188 if (readSize <= 0)
189 {
190 break;
191 }
192
193 var temp = new byte[readSize];
194 Array.Copy(buffer, 0, temp, 0, readSize);
195 var rawBytes = _privateKeyRsaProvider.Decrypt(temp, RSAEncryptionPadding.Pkcs1);
196 outputStream.Write(rawBytes, 0, rawBytes.Length);
197 }
198 return Encoding.UTF8.GetString(outputStream.ToArray());
199 }
200
201 //return Encoding.UTF8.GetString(_privateKeyRsaProvider.Decrypt(Convert.FromBase64String(cipherText), RSAEncryptionPadding.Pkcs1));
202 }
203 /// <summary>
204 /// 分段解密
205 /// </summary>
206 /// <param name="encryptedInput"></param>
207 /// <param name="privateKey"></param>
208 /// <returns></returns>
209 private string RsaDecrypt(string encryptedInput, string privateKey)
210 {
211 if (string.IsNullOrEmpty(encryptedInput))
212 {
213 return string.Empty;
214 }
215
216 if (string.IsNullOrWhiteSpace(privateKey))
217 {
218 throw new ArgumentException("Invalid Private Key");
219 }
220
221 using (var rsaProvider = new RSACryptoServiceProvider())
222 {
223 var inputBytes = Convert.FromBase64String(encryptedInput);
224 rsaProvider.FromXmlString(privateKey);
225 int bufferSize = rsaProvider.KeySize / 8;
226 var buffer = new byte[bufferSize];
227 using (MemoryStream inputStream = new MemoryStream(inputBytes),
228 outputStream = new MemoryStream())
229 {
230 while (true)
231 {
232 int readSize = inputStream.Read(buffer, 0, bufferSize);
233 if (readSize <= 0)
234 {
235 break;
236 }
237
238 var temp = new byte[readSize];
239 Array.Copy(buffer, 0, temp, 0, readSize);
240 var rawBytes = rsaProvider.Decrypt(temp, false);
241 outputStream.Write(rawBytes, 0, rawBytes.Length);
242 }
243 return Encoding.UTF8.GetString(outputStream.ToArray());
244 }
245 }
246 }
247 #endregion
248
249 #region 加密 Encrypt(string text,string publickey)
250 /// <summary>
251 /// 加密(无限长度)
252 /// </summary>
253 /// <param name="text">待加密串</param>
254 /// <param name="publickey">公钥</param>
255 /// <returns></returns>
256 public static string Encrypt(string text, string publickey)
257 {
258 RSA _publicKeyRsaProvider = CreateRsaProviderFromPublicKey(publickey);
259 if (_publicKeyRsaProvider == null)
260 {
261 throw new Exception("_publicKeyRsaProvider is null");
262 }
263 var inputBytes = Encoding.UTF8.GetBytes(text);
264 int bufferSize = (_publicKeyRsaProvider.KeySize / 8) - 11;//单块最大长度
265 var buffer = new byte[bufferSize];
266 using (MemoryStream inputStream = new MemoryStream(inputBytes),
267 outputStream = new MemoryStream())
268 {
269 while (true)
270 { //分段加密
271 int readSize = inputStream.Read(buffer, 0, bufferSize);
272 if (readSize <= 0)
273 {
274 break;
275 }
276
277 var temp = new byte[readSize];
278 Array.Copy(buffer, 0, temp, 0, readSize);
279 var encryptedBytes = _publicKeyRsaProvider.Encrypt(temp, RSAEncryptionPadding.Pkcs1);
280 outputStream.Write(encryptedBytes, 0, encryptedBytes.Length);
281 }
282 return Convert.ToBase64String(outputStream.ToArray());//转化为字节流方便传输
283 }
284 }
285 /// <summary>
286 /// 分段加密
287 /// </summary>
288 /// <param name="rawInput"></param>
289 /// <param name="publicKey"></param>
290 /// <returns></returns>
291 private string RsaEncrypt(string rawInput, string publicKey)
292 {
293 if (string.IsNullOrEmpty(rawInput))
294 {
295 return string.Empty;
296 }
297
298 if (string.IsNullOrWhiteSpace(publicKey))
299 {
300 throw new ArgumentException("Invalid Public Key");
301 }
302
303 using (var rsaProvider = new RSACryptoServiceProvider())
304 {
305 var inputBytes = Encoding.UTF8.GetBytes(rawInput);//有含义的字符串转化为字节流
306 rsaProvider.FromXmlString(publicKey);//载入公钥
307 int bufferSize = (rsaProvider.KeySize / 8) - 11;//单块最大长度
308 var buffer = new byte[bufferSize];
309 using (MemoryStream inputStream = new MemoryStream(inputBytes),
310 outputStream = new MemoryStream())
311 {
312 while (true)
313 { //分段加密
314 int readSize = inputStream.Read(buffer, 0, bufferSize);
315 if (readSize <= 0)
316 {
317 break;
318 }
319
320 var temp = new byte[readSize];
321 Array.Copy(buffer, 0, temp, 0, readSize);
322 var encryptedBytes = rsaProvider.Encrypt(temp, false);
323 outputStream.Write(encryptedBytes, 0, encryptedBytes.Length);
324 }
325 return Convert.ToBase64String(outputStream.ToArray());//转化为字节流方便传输
326 }
327 }
328 }
329 #endregion
330
331 #region 私有方法
332 /// <summary>
333 /// 使用私钥创建RSA实例
334 /// </summary>
335 /// <param name="privateKey">私钥</param>
336 /// <returns></returns>
337 private static RSA CreateRsaProviderFromPrivateKey(string privateKey)
338 {
339 var privateKeyBits = Convert.FromBase64String(privateKey);
340
341 var rsa = RSA.Create();
342 var rsaParameters = new RSAParameters();
343
344 using (BinaryReader binr = new BinaryReader(new MemoryStream(privateKeyBits)))
345 {
346 byte bt = 0;
347 ushort twobytes = 0;
348 twobytes = binr.ReadUInt16();
349 if (twobytes == 0x8130)
350 binr.ReadByte();
351 else if (twobytes == 0x8230)
352 binr.ReadInt16();
353 else
354 throw new Exception("Unexpected value read binr.ReadUInt16()");
355
356 twobytes = binr.ReadUInt16();
357 if (twobytes != 0x0102)
358 throw new Exception("Unexpected version");
359
360 bt = binr.ReadByte();
361 if (bt != 0x00)
362 throw new Exception("Unexpected value read binr.ReadByte()");
363
364 rsaParameters.Modulus = binr.ReadBytes(GetIntegerSize(binr));
365 rsaParameters.Exponent = binr.ReadBytes(GetIntegerSize(binr));
366 rsaParameters.D = binr.ReadBytes(GetIntegerSize(binr));
367 rsaParameters.P = binr.ReadBytes(GetIntegerSize(binr));
368 rsaParameters.Q = binr.ReadBytes(GetIntegerSize(binr));
369 rsaParameters.DP = binr.ReadBytes(GetIntegerSize(binr));
370 rsaParameters.DQ = binr.ReadBytes(GetIntegerSize(binr));
371 rsaParameters.InverseQ = binr.ReadBytes(GetIntegerSize(binr));
372 }
373
374 rsa.ImportParameters(rsaParameters);
375 return rsa;
376 }
377
378 /// <summary>
379 /// 使用公钥创建RSA实例
380 /// </summary>
381 /// <param name="publicKeyString">公钥</param>
382 /// <returns></returns>
383 private static RSA CreateRsaProviderFromPublicKey(string publicKeyString)
384 {
385 // encoded OID sequence for PKCS #1 rsaEncryption szOID_RSA_RSA = "1.2.840.113549.1.1.1"
386 byte[] seqOid = { 0x30, 0x0D, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x01, 0x05, 0x00 };
387 byte[] seq = new byte[15];
388
389 var x509Key = Convert.FromBase64String(publicKeyString);
390
391 // --------- Set up stream to read the asn.1 encoded SubjectPublicKeyInfo blob ------
392 using (MemoryStream mem = new MemoryStream(x509Key))
393 {
394 using (BinaryReader binr = new BinaryReader(mem)) //wrap Memory Stream with BinaryReader for easy reading
395 {
396 byte bt = 0;
397 ushort twobytes = 0;
398
399 twobytes = binr.ReadUInt16();
400 if (twobytes == 0x8130) //data read as little endian order (actual data order for Sequence is 30 81)
401 binr.ReadByte(); //advance 1 byte
402 else if (twobytes == 0x8230)
403 binr.ReadInt16(); //advance 2 bytes
404 else
405 return null;
406
407 seq = binr.ReadBytes(15); //read the Sequence OID
408 if (!CompareBytearrays(seq, seqOid)) //make sure Sequence for OID is correct
409 return null;
410
411 twobytes = binr.ReadUInt16();
412 if (twobytes == 0x8103) //data read as little endian order (actual data order for Bit String is 03 81)
413 binr.ReadByte(); //advance 1 byte
414 else if (twobytes == 0x8203)
415 binr.ReadInt16(); //advance 2 bytes
416 else
417 return null;
418
419 bt = binr.ReadByte();
420 if (bt != 0x00) //expect null byte next
421 return null;
422
423 twobytes = binr.ReadUInt16();
424 if (twobytes == 0x8130) //data read as little endian order (actual data order for Sequence is 30 81)
425 binr.ReadByte(); //advance 1 byte
426 else if (twobytes == 0x8230)
427 binr.ReadInt16(); //advance 2 bytes
428 else
429 return null;
430
431 twobytes = binr.ReadUInt16();
432 byte lowbyte = 0x00;
433 byte highbyte = 0x00;
434
435 if (twobytes == 0x8102) //data read as little endian order (actual data order for Integer is 02 81)
436 lowbyte = binr.ReadByte(); // read next bytes which is bytes in modulus
437 else if (twobytes == 0x8202)
438 {
439 highbyte = binr.ReadByte(); //advance 2 bytes
440 lowbyte = binr.ReadByte();
441 }
442 else
443 return null;
444 byte[] modint = { lowbyte, highbyte, 0x00, 0x00 }; //reverse byte order since asn.1 key uses big endian order
445 int modsize = BitConverter.ToInt32(modint, 0);
446
447 int firstbyte = binr.PeekChar();
448 if (firstbyte == 0x00)
449 { //if first byte (highest order) of modulus is zero, don't include it
450 binr.ReadByte(); //skip this null byte
451 modsize -= 1; //reduce modulus buffer size by 1
452 }
453
454 byte[] modulus = binr.ReadBytes(modsize); //read the modulus bytes
455
456 if (binr.ReadByte() != 0x02) //expect an Integer for the exponent data
457 return null;
458 int expbytes = (int)binr.ReadByte(); // should only need one byte for actual exponent data (for all useful values)
459 byte[] exponent = binr.ReadBytes(expbytes);
460
461 // ------- create RSACryptoServiceProvider instance and initialize with public key -----
462 var rsa = RSA.Create();
463 RSAParameters rsaKeyInfo = new RSAParameters
464 {
465 Modulus = modulus,
466 Exponent = exponent
467 };
468 rsa.ImportParameters(rsaKeyInfo);
469
470 return rsa;
471 }
472
473 }
474 }
475
476 /// <summary>
477 /// 导入密钥算法
478 /// </summary>
479 /// <param name="binr">BinaryReader</param>
480 /// <returns></returns>
481 private static int GetIntegerSize(BinaryReader binr)
482 {
483 byte bt = 0;
484 int count = 0;
485 bt = binr.ReadByte();
486 if (bt != 0x02)
487 return 0;
488 bt = binr.ReadByte();
489
490 if (bt == 0x81)
491 count = binr.ReadByte();
492 else
493 if (bt == 0x82)
494 {
495 var highbyte = binr.ReadByte();
496 var lowbyte = binr.ReadByte();
497 byte[] modint = { lowbyte, highbyte, 0x00, 0x00 };
498 count = BitConverter.ToInt32(modint, 0);
499 }
500 else
501 {
502 count = bt;
503 }
504
505 while (binr.ReadByte() == 0x00)
506 {
507 count -= 1;
508 }
509 binr.BaseStream.Seek(-1, SeekOrigin.Current);
510 return count;
511 }
512
513 private static bool CompareBytearrays(byte[] a, byte[] b)
514 {
515 if (a.Length != b.Length)
516 return false;
517 int i = 0;
518 foreach (byte c in a)
519 {
520 if (c != b[i])
521 return false;
522 i++;
523 }
524 return true;
525 }
526
527 #endregion
528 }
529
530 public enum RSAType
531 {
532 /// <summary>
533 /// SHA1
534 /// </summary>
535 RSA = 0,
536 /// <summary>
537 /// RSA2 密钥长度至少为2048
538 /// SHA256
539 /// </summary>
540 RSA2
541 }
生成证书源码：
1 static void Main(string[] args)
2 {
3 /*
4 前言：最近有个需求是需要对文档进行签名，考虑到数字签名证书问题，所以生成一个自签名的数字证书；
5 描述：本示例基于BouncyCastle.Crypto组件提供的算法生成证书，
6 演示了生成了cer证书、pfx证书及加载pfx证书对字符串加密解密
7
8 */
9
10 var takeEffect = DateTime.Now; // 生效时间
11 var loseEffect = DateTime.Now.AddYears(2); // 失效时间
12 var password = "ABCD123456"; //证书密码
13 var signatureAlgorithm = "SHA256WITHRSA"; //签名算法
14 var friendlyName = $"{Guid.NewGuid().ToString("N")}dpps.fun"; // 别名
15
16 // 获取颁发者DN
17 X509Name issuer = GetIssuer();
18
19 // 获取使用者DN
20 X509Name subject = GetSubject();
21
22 // 证书存放目录
23 string file = System.Environment.CurrentDirectory + "\\Cert\\";
24 if (!Directory.Exists(file))
25 {
26 Directory.CreateDirectory(file);
27 }
28 string pfxPath = $"{file}{friendlyName}.pfx";
29 string certPath = $"{file}{friendlyName}.cer";
30
31 // 生成证书
32 GenerateCertificate(certPath, pfxPath, password, signatureAlgorithm, issuer, subject, takeEffect, loseEffect, friendlyName);
33
34 // 加载PFX证书
35 LoadingPfxCertificate(pfxPath, password);
36
37 Console.WriteLine("OK");
38 Console.ReadLine();
39 }
40
41 /// <summary>
42 /// 获取使用者DN.
43 /// </summary>
44 /// <returns>使用者DN.</returns>
45 private static X509Name GetSubject()
46 {
47 // 使用者DN
48 return new X509Name(
49 new ArrayList
50 {
51 X509Name.C,
52 X509Name.O,
53 X509Name.CN
54 },
55 new Hashtable
56 {
57 [X509Name.C] = "CN",
58 [X509Name.O] = "ICH",
59 [X509Name.CN] = "*.dpps.fun"
60 }
61 );
62 }
63
64 /// <summary>
65 /// 获取颁发者DN.
66 /// </summary>
67 /// <returns>颁发者DN.</returns>
68 private static X509Name GetIssuer()
69 {
70 // 颁发者DN
71 return new X509Name(
72 new ArrayList
73 {
74 X509Name.C,
75 X509Name.O,
76 X509Name.OU,
77 X509Name.L,
78 X509Name.ST,
79 X509Name.E,
80 },
81 new Hashtable
82 {
83 [X509Name.C] = "CN",// 证书的语言
84 [X509Name.O] = "dpps.fun",//设置证书的办法者
85 [X509Name.OU] = "dpps.fun Fulu RSA CA 2020",
86 [X509Name.L] = "dpps",
87 [X509Name.ST] = "dpps",
88 [X509Name.E] = "472067093@qq.com",
89 }
90 );
91 }
92
93
94 /// <summary>
95 /// 生成证书
96 /// </summary>
97 /// <param name="certPath">certPath（只含公钥）</param>
98 /// <param name="pfxPath">pfxPath（含公私钥）</param>
99 /// <param name="password">证书密码</param>
100 /// <param name="signatureAlgorithm">设置将用于签署此证书的签名算法</param>
101 /// <param name="issuer">设置此证书颁发者的DN</param>
102 /// <param name="subject">设置此证书使用者的DN</param>
103 /// <param name="takeEffect">证书生效时间</param>
104 /// <param name="loseEffect">证书失效时间</param>
105 /// <param name="friendlyName">设置证书友好名称（可选）</param>
106 /// <param name="keyStrength">密钥长度</param>
107 public static void GenerateCertificate(
108 string certPath,
109 string pfxPath,
110 string password,
111 string signatureAlgorithm,
112 X509Name issuer,
113 X509Name subject,
114 DateTime takeEffect,
115 DateTime loseEffect,
116 string friendlyName,
117 int keyStrength = 2048)
118 {
119 SecureRandom random = new SecureRandom(new CryptoApiRandomGenerator());
120 var keyGenerationParameters = new KeyGenerationParameters(random, keyStrength);
121 var keyPairGenerator = new RsaKeyPairGenerator(); //RSA密钥对生成器
122 keyPairGenerator.Init(keyGenerationParameters);
123 var subjectKeyPair = keyPairGenerator.GenerateKeyPair();
124 ISignatureFactory signatureFactory = new Asn1SignatureFactory(signatureAlgorithm, subjectKeyPair.Private, random);
125 //the certificate generator
126
127 X509V3CertificateGenerator certificateGenerator = new X509V3CertificateGenerator();
128
129 var spki = SubjectPublicKeyInfoFactory.CreateSubjectPublicKeyInfo(subjectKeyPair.Public);
130
131 //允许作为一个CA证书（可以颁发下级证书或进行签名）
132 certificateGenerator.AddExtension(X509Extensions.BasicConstraints, true, new BasicConstraints(true));
133
134 //使用者密钥标识符
135 certificateGenerator.AddExtension(X509Extensions.SubjectKeyIdentifier, false, new SubjectKeyIdentifier(spki));
136
137 //授权密钥标识符
138 certificateGenerator.AddExtension(X509Extensions.AuthorityKeyIdentifier, false, new AuthorityKeyIdentifier(spki));
139
140 certificateGenerator.AddExtension(X509Extensions.ExtendedKeyUsage.Id, true, new ExtendedKeyUsage(KeyPurposeID.IdKPServerAuth));
141
142 //证书序列号
143 BigInteger serialNumber = BigIntegers.CreateRandomInRange(BigInteger.One, BigInteger.ValueOf(long.MaxValue), random);
144
145 certificateGenerator.SetSerialNumber(serialNumber);
146
147 certificateGenerator.SetIssuerDN(issuer); //颁发者信息
148
149 certificateGenerator.SetSubjectDN(subject); //使用者信息
150
151 certificateGenerator.SetNotBefore(takeEffect); //证书生效时间
152
153 certificateGenerator.SetNotAfter(loseEffect); //证书失效时间
154
155 certificateGenerator.SetPublicKey(subjectKeyPair.Public);
156
157 Org.BouncyCastle.X509.X509Certificate certificate = certificateGenerator.Generate(signatureFactory);
158
159 //生成cer证书，公钥证
160 var certificate2 = new X509Certificate2(DotNetUtilities.ToX509Certificate(certificate))
161 {
162 FriendlyName = friendlyName, //设置友好名称
163 };
164 // cer公钥文件
165 var bytes = certificate2.Export(X509ContentType.Cert);
166 using (var fs = new FileStream(certPath, FileMode.Create))
167 {
168 fs.Write(bytes, 0, bytes.Length);
169 }
170
171 //另一种代码生成p12证书的方式（要求使用.net standard 2.1）
172 //certificate2 = certificate2.CopyWithPrivateKey(DotNetUtilities.ToRSA((RsaPrivateCrtKeyParameters)keyPair.Private));
173 //var bytes2 = certificate2.Export(X509ContentType.Pfx, password);
174 //using (var fs = new FileStream(pfxPath, FileMode.Create))
175 //{
176 // fs.Write(bytes2, 0, bytes2.Length);
177 //}
178
179 // 生成pfx证书，公私钥证
180 var certEntry = new X509CertificateEntry(certificate);
181 var store = new Pkcs12StoreBuilder().Build();
182 store.SetCertificateEntry(friendlyName, certEntry); //设置证书
183 var chain = new X509CertificateEntry[1];
184 chain[0] = certEntry;
185 store.SetKeyEntry(friendlyName, new AsymmetricKeyEntry(subjectKeyPair.Private), chain); //设置私钥
186 using (var fs = File.Create(pfxPath))
187 {
188 store.Save(fs, password.ToCharArray(), random); //保存
189 };
190 }
191
192 /// <summary>
193 /// 加载证书
194 /// </summary>
195 /// <param name="pfxPath"></param>
196 /// <param name="password"></param>
197 private static void LoadingPfxCertificate(string pfxPath, string password)
198 {
199 //加载证书
200 X509Certificate2 pfx = new X509Certificate2(pfxPath, password, X509KeyStorageFlags.Exportable);
201 var keyPair = DotNetUtilities.GetKeyPair(pfx.PrivateKey);
202 var subjectPublicKeyInfo = SubjectPublicKeyInfoFactory.CreateSubjectPublicKeyInfo(keyPair.Public);
203 var privateKeyInfo = PrivateKeyInfoFactory.CreatePrivateKeyInfo(keyPair.Private);
204 var privateKey = Base64.ToBase64String(privateKeyInfo.ParsePrivateKey().GetEncoded());
205 var publicKey = Base64.ToBase64String(subjectPublicKeyInfo.GetEncoded());
206 Console.ForegroundColor = ConsoleColor.DarkYellow;
207
208 Console.WriteLine("Pfx证书私钥：");
209 Console.WriteLine(privateKey);
210 Console.WriteLine("Pfx证书公钥：");
211 Console.WriteLine(publicKey);
212
213 var beEncryptedData = "hello rsa";
214 Console.WriteLine($"加密原文：{beEncryptedData}");
215 var cipherText = RSAHelper.Encrypt(beEncryptedData, publicKey);
216 Console.WriteLine("加密结果：");
217 Console.WriteLine(cipherText);
218
219 var datares = RSAHelper.Decrypt(cipherText, privateKey);
220 Console.WriteLine($"解密结果：{datares}");
221 }
完全源码地址：https://github.com/daileass/CreateSelfSignedCertificateByBouncyCastle.git
