blocks|key|1106801|text|我认为你不能使用那个API来做这件事。但是您可以使用Bouncy+Castle+(http://www.bouncycastle.org)创建一个，然后将该对象转换为一个X509Certificate2对象(BC有一些实用程序类可以做到这一点)。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1106802|-编辑-看看这些BC类:+X509V3CertificateGenerator和X509Certificate|1106803|稍后将BC+X509Certificate对象转换为常规X509Certificate2对象的BC实用程序类为:+DotNetUtilities|1106804|entityMap|0|LINK|mutability|MUTABLE|url|http://www.bouncycastle.org/^0|15|R|0|0|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@$A|Q|B|R|1|S]]|C|$]]|$1|D|3|E|5|6|7|T|8|@]|9|@]|C|$]]|$1|F|3|G|5|6|7|U|8|@]|9|@]|C|$]]|$1|H|3|-4|5|6|7|V|8|@]|9|@]|C|$]]]|I|$J|$5|K|L|M|C|$N|O]]]]

I think you can't do it using that API. But you can create one using Bouncy Castle (http://www.bouncycastle.org) and later convert that object to a X509Certificate2 object (BC has some utility class for doing that).

-edit-
Take a look at these BC classes: X509V3CertificateGenerator and X509Certificate

The BC utility class that later will convert a BC X509Certificate object to a regular X509Certificate2 object is: DotNetUtilities

blocks|key|1106841|text|您可以使用PINVOKE调入create+a+self+signed+certificate的Crypt32。有一些可用的sample+code，它将生成一个并将其放入证书存储中。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1106842|还有Keith+Brown的certificate+generator，它是用托管代码编写的，具有a+library+you+can+use。|1106843|或者，您可以只通过Org.BouncyCastle.X509.X509V3CertificateGenerator使用BouncyCastle，并使用Org.BouncyCastle.Security.DotNetUtilities中的实用程序方法并调用ToX509Certificate()。|style|CODE|1106844|如果您想创建一个请求并由CA对其进行签名，那么在.NET中实际上更容易，因为这些类中的大多数都可以作为COM互操作DLL导入。但这完全是另一个问题。|1106845|entityMap|0|LINK|mutability|MUTABLE|url|http://msdn.microsoft.com/en-us/library/aa376039.aspx|1|http://blogs.msdn.com/b/dcook/archive/2008/11/25/creating-a-self-signed-certificate-in-c.aspx|2|http://www.pluralsight-training.net/community/blogs/keith/archive/2009/01/22/create-self-signed-x-509-certificates-in-a-flash-with-self-cert.aspx|3|http://mikehadlow.blogspot.com/2010/02/creating-x509-certificates-with.html^0|E|W|0|1P|B|1|0|E|L|2|1D|L|3|0|9|1C|23|15|3J|J|0|0^^$0|@$1|2|3|4|5|6|7|Z|8|@]|9|@$A|10|B|11|1|12]|$A|13|B|14|1|15]]|C|$]]|$1|D|3|E|5|6|7|16|8|@]|9|@$A|17|B|18|1|19]|$A|1A|B|1B|1|1C]]|C|$]]|$1|F|3|G|5|6|7|1D|8|@$A|1E|B|1F|H|I]|$A|1G|B|1H|H|I]|$A|1I|B|1J|H|I]]|9|@]|C|$]]|$1|J|3|K|5|6|7|1K|8|@]|9|@]|C|$]]|$1|L|3|-4|5|6|7|1L|8|@]|9|@]|C|$]]]|M|$N|$5|O|P|Q|C|$R|S]]|T|$5|O|P|Q|C|$R|U]]|V|$5|O|P|Q|C|$R|W]]|X|$5|O|P|Q|C|$R|Y]]]]

You can use PINVOKE to call into Crypt32 to <a href="http://msdn.microsoft.com/en-us/library/aa376039.aspx" rel="nofollow">create a self signed certificate</a>. There is some <a href="http://blogs.msdn.com/b/dcook/archive/2008/11/25/creating-a-self-signed-certificate-in-c.aspx" rel="nofollow">sample code</a> available which will generate one and put it in the certificate store for you.

There's also Keith Brown's <a href="http://www.pluralsight-training.net/community/blogs/keith/archive/2009/01/22/create-self-signed-x-509-certificates-in-a-flash-with-self-cert.aspx" rel="nofollow">certificate generator</a>, which is written in managed code and has <a href="http://mikehadlow.blogspot.com/2010/02/creating-x509-certificates-with.html" rel="nofollow">a library you can use</a>.

Alternatively you can just use BouncyCastle using the <code>Org.BouncyCastle.X509.X509V3CertificateGenerator</code> and the use the utility methods in <code>Org.BouncyCastle.Security.DotNetUtilities</code> and call <code>ToX509Certificate()</code>.

If you want to create a request and have it signed by a CA that's actually easier in .NET, as most of those classes can be imported as COM interop DLLs. But that's a whole other question.

blocks|key|1106857|text|下面是你可以使用的代码：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1106858|++++static+X509Certificate2+GenerateCertificate(string+certName)
++++{
++++++++var+keypairgen+=+new+RsaKeyPairGenerator();
++++++++keypairgen.Init(new+KeyGenerationParameters(new+SecureRandom(new+CryptoApiRandomGenerator()),+1024));

++++++++var+keypair+=+keypairgen.GenerateKeyPair();

++++++++var+gen+=+new+X509V3CertificateGenerator();

++++++++var+CN+=+new+X509Name("CN="+%2B+certName);
++++++++var+SN+=+BigInteger.ProbablePrime(120,+new+Random());

++++++++gen.SetSerialNumber(SN);
++++++++gen.SetSubjectDN(CN);
++++++++gen.SetIssuerDN(CN);
++++++++gen.SetNotAfter(DateTime.MaxValue);
++++++++gen.SetNotBefore(DateTime.Now.Subtract(new+TimeSpan(7,+0,+0,+0)));
++++++++gen.SetSignatureAlgorithm("MD5WithRSA");
++++++++gen.SetPublicKey(keypair.Public);+++++++++++

++++++++var+newCert+=+gen.Generate(keypair.Private);

++++++++return+new+X509Certificate2(DotNetUtilities.ToX509Certificate((Org.BouncyCastle.X509.X509Certificate)newCert));
++++}|code-block|syntax|javascript|1106859|要实现此功能，请不要忘记添加对BouncyCastle+library的引用|offset|length|1106860|entityMap|0|LINK|mutability|MUTABLE|url|http://www.bouncycastle.org/csharp/^0|0|0|F|K|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|T|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|U|8|@]|9|@$I|V|J|W|1|X]]|A|$]]|$1|K|3|-4|5|6|7|Y|8|@]|9|@]|A|$]]]|L|$M|$5|N|O|P|A|$Q|R]]]]

Here's a code you can use:

<pre><code> static X509Certificate2 GenerateCertificate(string certName)
 {
 var keypairgen = new RsaKeyPairGenerator();
 keypairgen.Init(new KeyGenerationParameters(new SecureRandom(new CryptoApiRandomGenerator()), 1024));

 var keypair = keypairgen.GenerateKeyPair();

 var gen = new X509V3CertificateGenerator();

 var CN = new X509Name("CN=" + certName);
 var SN = BigInteger.ProbablePrime(120, new Random());

 gen.SetSerialNumber(SN);
 gen.SetSubjectDN(CN);
 gen.SetIssuerDN(CN);
 gen.SetNotAfter(DateTime.MaxValue);
 gen.SetNotBefore(DateTime.Now.Subtract(new TimeSpan(7, 0, 0, 0)));
 gen.SetSignatureAlgorithm("MD5WithRSA");
 gen.SetPublicKey(keypair.Public); 

 var newCert = gen.Generate(keypair.Private);

 return new X509Certificate2(DotNetUtilities.ToX509Certificate((Org.BouncyCastle.X509.X509Certificate)newCert));
 }
</code></pre>

for this to work, don't forget to add reference to <a href="http://www.bouncycastle.org/csharp/">BouncyCastle library</a>

blocks|key|1106901|text|打开ssl以创建x509证书|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1106902|1.从以下链接下载Win64+Openssl。(Win64+OpenSSL+v1.1.0j+-+37mb安装程序)+URL+-+https://slproweb.com/products/Win32OpenSSL.html|offset|length|1106903|2.安装后设置系统path环境变量(path=+C:\OpenSSL-Win64\bin)|1106904|3.打开命令提示符，将目录更改为桌面。|1106905|4.创建密钥的命令:+Private：openssl+req+-x509+-days+365+-newkey+rsa:2048+-keyout+cert-key.pem++-out+cert.pem输入命令并按照说明进行操作。|style|CODE|1106906|5.现在我们在桌面上有两个文件，分别名为cert-key.pem和cert.pem。要创建.pfx文件，请运行以下命令openssl+pkcs12+-export+-in+cert.pem+-inkey+cert-key.pem+-out+x509-cert.pfx并按照说明操作(输入相同的密码)。|1106907|6.创建公钥的命令：openssl+pkcs12+-in+x509-cert.pfx+-clcerts+-nokeys+-out+x509-cert-public.pem，并按照说明操作。|1106908|7.将证书注册到mmc。|1106909|entityMap|0|LINK|mutability|MUTABLE|url|https://slproweb.com/products/Win32OpenSSL.html^0|0|1S|1B|0|0|0|0|J|28|0|1N|22|0|A|23|0|0^^$0|@$1|2|3|4|5|6|7|11|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|12|8|@]|9|@$D|13|E|14|1|15]]|A|$]]|$1|F|3|G|5|6|7|16|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|17|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|18|8|@$D|19|E|1A|L|M]]|9|@]|A|$]]|$1|N|3|O|5|6|7|1B|8|@$D|1C|E|1D|L|M]]|9|@]|A|$]]|$1|P|3|Q|5|6|7|1E|8|@$D|1F|E|1G|L|M]]|9|@]|A|$]]|$1|R|3|S|5|6|7|1H|8|@]|9|@]|A|$]]|$1|T|3|-4|5|6|7|1I|8|@]|9|@]|A|$]]]|U|$V|$5|W|X|Y|A|$Z|10]]]]

<h2>Open ssl for creating x509 certificate</h2>
1.Download the Win64 Openssl from the below link.(Win64 OpenSSL v1.1.0j - 37mb installer)
URL - <a href="https://slproweb.com/products/Win32OpenSSL.html" rel="nofollow noreferrer">https://slproweb.com/products/Win32OpenSSL.html</a>
2.After installation set the system path environment variable.(path = C:\OpenSSL-Win64\bin)
3.Open command prompt and change the directory to desktop.
4.Command for key creation :
Private Key : <code>openssl req -x509 -days 365 -newkey rsa:2048 -keyout cert-key.pem -out cert.pem</code>
Enter the command and follow the instruction.
5.Now we have 2 files named cert-key.pem and cert.pem in desktop. To create the .pfx file run the below command
<code>openssl pkcs12 -export -in cert.pem -inkey cert-key.pem -out x509-cert.pfx</code>
and follow the instruction(enter the same password).
6.Command for public key creation :
<code>openssl pkcs12 -in x509-cert.pfx -clcerts -nokeys -out x509-cert-public.pem</code>
and follow the instruction.
7.Register the certificate to mmc.

blocks|key|1106915|text|public+X509Certificate2+GetCertificate()
{
++++var+config+=+InitConfiguration();
++++var+certificateSubject+=+"X509Subject";
++++var+certificateStoreName+=+"X509StoreName";
++++var+certificateStoreLocation+=+"X509StoreLocation";
++++var+thumbPrint+=+"ThumbPrint";

++++var+storeName+=+(StoreName)Enum.Parse(typeof(StoreName),+certificateStoreName,+true);
++++var+storeLocation+=+(StoreLocation)Enum.Parse(typeof(StoreLocation),+certificateStoreLocation,+true);

++++var+certificateStore+=+new+X509Store(storeName,+storeLocation);
++++certificateStore.Open(OpenFlags.ReadOnly);

++++foreach+(var+storeCertificate+in+certificateStore.Certificates)
++++{
++++++++if+(storeCertificate.Thumbprint.ToLower(System.Globalization.CultureInfo.CurrentCulture)+==+thumbPrint.ToLower(System.Globalization.CultureInfo.CurrentCulture))
++++++++{return+storeCertificate;
++++++++}
++++}
certificateStore.Close();
++++return+null;
}|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|1106916|unstyled|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$B|C]]|$1|D|3|-4|5|E|7|H|8|@]|9|@]|A|$]]]|F|$]]

<pre><code>public X509Certificate2 GetCertificate()
{
 var config = InitConfiguration();
 var certificateSubject = "X509Subject";
 var certificateStoreName = "X509StoreName";
 var certificateStoreLocation = "X509StoreLocation";
 var thumbPrint = "ThumbPrint";

 var storeName = (StoreName)Enum.Parse(typeof(StoreName), certificateStoreName, true);
 var storeLocation = (StoreLocation)Enum.Parse(typeof(StoreLocation), certificateStoreLocation, true);

 var certificateStore = new X509Store(storeName, storeLocation);
 certificateStore.Open(OpenFlags.ReadOnly);

 foreach (var storeCertificate in certificateStore.Certificates)
 {
 if (storeCertificate.Thumbprint.ToLower(System.Globalization.CultureInfo.CurrentCulture) == thumbPrint.ToLower(System.Globalization.CultureInfo.CurrentCulture))
 {return storeCertificate;
 }
 }
certificateStore.Close();
 return null;
}
</code></pre>

blocks|key|1322048|text|签出CertificateRequest+(名称空间:+System.Security.Cryptography.X509Certificates)...|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1322049|+public+static+X509Certificate2+GenerateSelfSignedCertificate()
++++{
++++++++string+secp256r1Oid+=+"1.2.840.10045.3.1.7";++//oid+for+prime256v1(7)++other+identifier:+secp256r1
++++++++
++++++++string+subjectName+=+"Self-Signed-Cert-Example";

++++++++var+ecdsa+=+ECDsa.Create(ECCurve.CreateFromValue(secp256r1Oid));

++++++++var+certRequest+=+new+CertificateRequest($"CN={subjectName}",+ecdsa,+HashAlgorithmName.SHA256);

++++++++//add+extensions+to+the+request+(just+as+an+example)
++++++++//add+keyUsage
++++++++certRequest.CertificateExtensions.Add(new+X509KeyUsageExtension(X509KeyUsageFlags.DigitalSignature,+true));

++++++++X509Certificate2+generatedCert+=+certRequest.CreateSelfSigned(DateTimeOffset.Now.AddDays(-1),+DateTimeOffset.Now.AddYears(10));+//+generate+the+cert+and+sign!

++++++++X509Certificate2+pfxGeneratedCert+=+new+X509Certificate2(generatedCert.Export(X509ContentType.Pfx));+//has+to+be+turned+into+pfx+or+Windows+at+least+throws+a+security+credentials+not+found+during+sslStream.connectAsClient+or+HttpClient+request...

+++++return+pfxGeneratedCert;
}|code-block|syntax|javascript|1322050|entityMap|0|LINK|mutability|MUTABLE|url|https://docs.microsoft.com/en-us/dotnet/api/system.security.cryptography.x509certificates.certificaterequest?view=net-5.0^0|2|I|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@$A|R|B|S|1|T]]|C|$]]|$1|D|3|E|5|F|7|U|8|@]|9|@]|C|$G|H]]|$1|I|3|-4|5|6|7|V|8|@]|9|@]|C|$]]]|J|$K|$5|L|M|N|C|$O|P]]]]

Checkout <a href="https://docs.microsoft.com/en-us/dotnet/api/system.security.cryptography.x509certificates.certificaterequest?view=net-5.0" rel="nofollow noreferrer">CertificateRequest</a> (Name Space: System.Security.Cryptography.X509Certificates)...
<pre><code> public static X509Certificate2 GenerateSelfSignedCertificate()
 {
 string secp256r1Oid = &quot;1.2.840.10045.3.1.7&quot;; //oid for prime256v1(7) other identifier: secp256r1
 
 string subjectName = &quot;Self-Signed-Cert-Example&quot;;

 var ecdsa = ECDsa.Create(ECCurve.CreateFromValue(secp256r1Oid));

 var certRequest = new CertificateRequest($&quot;CN={subjectName}&quot;, ecdsa, HashAlgorithmName.SHA256);

 //add extensions to the request (just as an example)
 //add keyUsage
 certRequest.CertificateExtensions.Add(new X509KeyUsageExtension(X509KeyUsageFlags.DigitalSignature, true));

 X509Certificate2 generatedCert = certRequest.CreateSelfSigned(DateTimeOffset.Now.AddDays(-1), DateTimeOffset.Now.AddYears(10)); // generate the cert and sign!

 X509Certificate2 pfxGeneratedCert = new X509Certificate2(generatedCert.Export(X509ContentType.Pfx)); //has to be turned into pfx or Windows at least throws a security credentials not found during sslStream.connectAsClient or HttpClient request...

 return pfxGeneratedCert;
}
</code></pre>

I google it from web, find many samples to generate a new x509Certificate2 from a file in .net, but there is no one sample to show how to generate a completely new x509Certificate2 from the beginning in .net.

Is there any one that can tell me how to do it in .net?

Thank you very much.

how to create a completely new x509Certificate2 in .net?

Windows

我在网上搜索了一下，找到了很多从.net文件中生成新x509Certificate2的示例，但没有一个示例可以展示如何在.net中从头生成一个全新的x509Certificate2。有没有人可以告诉我怎么用.net来做？非常感谢。

问如何在.net中创建一个全新的x509Certificate2？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何在.net中创建一个全新的x509Certificate2？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何在.net中创建一个全新的x509Certificate2？
EN