CA服务器开开发(一)---颁发证书，生成pfx证书安装文件

from  http://blog.csdn.net/xugangjava/article/details/10928703

需要BouncyCastle .net版 下面是项目中用到的证书操作类，通过该类可以生成用户证书cer文件 和证书安装文件pfx文件，并生成认证原文。

[csharp]  view plain  copy

1. public static class CaOperator  
2.    {  
3.   
4.        /// <summary>  
5.        /// 根证书  
6.        /// </summary>  
7.        public static readonly X509Certificate RootCert =  
8.             new X509CertificateParser().ReadCertificate(Encoding.Default.GetBytes(  
9.             "-----BEGIN CERTIFICATE-----\n" +  
10.             "MIIBrDCCARWgAwIBAgIBATANBgkqhkiG9w0BAQUFADAcMRowGAYDVQQDDBHlronl\n" +  
11.             "hahDQeagueivgeS5pjAgFw0xMzA4MTQxNzAwMTBaGA8yMDYzMDgxNjE3MDAxMFow\n" +  
12.             "HDEaMBgGA1UEAwwR5a6J5YWoQ0HmoLnor4HkuaYwgZ0wDQYJKoZIhvcNAQEBBQAD\n" +  
13.             "gYsAMIGHAoGBAIVzPUIiMfkLyDCoyAOKOhoSAjkW8X6GJK7DiLL5cC9R2iWhGB+p\n" +  
14.             "lYWlaFC7MWK0HW7Dk3FygsbZcJXSe41npyY2MUUiXJ8GYj8H9JZ3dlLTKwAUbeen\n" +  
15.             "/WtnpJStj5JqeeXz0po4huq7xExThxSuT7dNiC58Qmi977j7EYe5/K6vAgEDMA0G\n" +  
16.             "CSqGSIb3DQEBBQUAA4GBABEdxlmihCWuB7J0pZ602Q6U/tlaiC5r9m03H21CoJG1\n" +  
17.             "slryxg8Oy365/KKyysYIzx9VplT1D0dC+A3Gsn+DSGIb3j7UDXymkd03KbBHNe2C\n" +  
18.             "ZLrAuesQIzOyv/sea/Mqs0jMwfJQROPSxEgWRHJBjf+kKzjSwqMWhl6Rvq84WkJ0\n" +  
19.             "-----END CERTIFICATE-----"));  
20.   
21.        /// <summary>  
22.        /// 根证书私钥  
23.        /// </summary>  
24.        private static readonly AsymmetricKeyParameter RootKey =  
25.            PrivateKeyFactory.CreateKey(Convert.FromBase64String(  
26.            "MIICdAIBADANBgkqhkiG9w0BAQEFAASCAl4wggJaAgEAAoGBAIVzPUIiMfkLyDCoyAOKOhoSAjkW8X6GJK7DiLL5cC9R2iWhGB+" +  
27.            "plYWlaFC7MWK0HW7Dk3FygsbZcJXSe41npyY2MUUiXJ8GYj8H9JZ3dlLTKwAUbeen/WtnpJStj5JqeeXz0po4huq7xExThxSuT7dNiC58" +  
28.            "Qmi977j7EYe5/K6vAgEDAoGAWPd+LBbL+10wIHCFV7F8EWFW0Ln2VFltydewd1D1dOE8GRYQFRu5A8Oa4HzLlyK+Sde3oPcB2eZLDox" +  
29.            "SXkUaGHnC0IhtBwLB1LWHdt1fSPHE/VpdV5ktdkImrBJbeGtnZ5lD7KHLjb9JlnS7UB7QtGlQgkY9fNZFVoKuWwUNI3sCQQDy6Jsl/" +  
30.            "WC4lwXLxxgnTxBGR9tiuNUrFJ7sN3dqmWjl68WarEZ8yKIGf+IVwRAOezbppmLor9dmd1/hz/QEm0XtAkEAjKRxL7uzyah6K+JMBBhVIj" +  
31.            "uoqikPFySbGDMbJ2z043ME80BwyQz0FlYIjq0McZtxxekIKjZWFhBXVTwLLc2ziwJBAKHwZ26o6yW6A90vZW+KCtmFPOx7OMdjFJ16T" +  
32.            "5xmRe6dLmcdhFMwbARVQWPWCrRSJJvEQfB1OkRPlUE1TVhng/MCQF3C9h/Sd9vFpsfsMq1ljhbScHFwtLoYZ2V3Z2+d+JeiA0zVoIY" +  
33.            "IormOsF8eCEu89oPwsBwkOWQK5ON9XMkzzQcCQGnW8f/Z4Am8llagjpEGH3XXWPDqymj/4EbMDrN2e9KRq1QL1cmR2uH+Ek6qvZdmmtM" +  
34.            "xFo6wZQ5wlX4hNTYqNfQ="));  
35.   
36.   
37.   
38.   
39.        /// <summary>  
40.        /// 验证用户证书是否由CA 机构颁发  
41.        /// </summary>  
42.        /// <param name="privKeyStr">私钥字符串</param>  
43.        /// <param name="x509CertStr">证书字符串</param>  
44.        /// <returns></returns>  
45.        public static bool VeryifyX509(string privKeyStr, string x509CertStr)  
46.        {  
47.            try  
48.            {  
49.                var certObj = new X509CertificateParser().ReadCertificate(new MemoryStream(Encoding.Default.GetBytes(x509CertStr)));  
50.                var privKey = (RsaPrivateCrtKeyParameters)PrivateKeyFactory.CreateKey(Convert.FromBase64String(privKeyStr));  
51.                //公钥 私钥是否相等  
52.                var pubKey = (RsaKeyParameters)certObj.GetPublicKey();  
53.                certObj.Verify(pubKey);  
54.                return pubKey.Exponent.Equals(privKey.PublicExponent);  
55.            }  
56.            catch  
57.            {  
58.                return false;  
59.            }  
60.        }  
61.   
62.        /// <summary>  
63.        /// 生成证书  
64.        /// </summary>  
65.        /// <param name="user">用户对象</param>  
66.        /// <param name="serialNumber">证书序列号</param>  
67.        /// <param name="startDate">生效日期</param>  
68.        /// <param name="endDate">过期日期</param>  
69.        /// <param name="algorithm">算法  "SHA1WITHRSAENCRYPTION" 等等</param>  
70.        /// <param name="keyLength">密钥长度 1024 2048 4096</param>  
71.        /// <param name="useAge">用途 1 签名 2 交换 3  两者</param>  
72.        /// <param name="privKeyStr">私钥字符串</param>  
73.        /// <param name="x509CertStr">证书字符串</param>  
74.        public static void NewX509Cert(Users user,  
75.            BigInteger serialNumber,  
76.            DateTime startDate,  
77.            DateTime endDate,  
78.            string algorithm,  
79.            int keyLength,  
80.            int useAge,  
81.            out string privKeyStr,  
82.            out string x509CertStr)  
83.        {  
84.            var r = new RsaKeyPairGenerator();  
85.   
86.            r.Init(new RsaKeyGenerationParameters(  
87.                        BigInteger.ValueOf(3),  
88.                        new SecureRandom(),  
89.                        keyLength,   //密钥长度    
90.                        25));  
91.   
92.            var keys = r.GenerateKeyPair();  
93.            var certGen = new X509V3CertificateGenerator();  
94.            certGen.Reset();  
95.            certGen.SetSerialNumber(serialNumber);  
96.            certGen.SetIssuerDN(RootCert.SubjectDN);//颁发者  
97.            certGen.SetNotBefore(startDate);  
98.            certGen.SetNotAfter(endDate);  
99.            certGen.SetSubjectDN(RawToX509Name(user));//颁发给  
100.            certGen.SetPublicKey(keys.Public);  
101.   
102.            //ca签名算法  
103.            certGen.SetSignatureAlgorithm(algorithm);  
104.   
105.            //根证书  
106.            certGen.AddExtension(X509Extensions.AuthorityKeyIdentifier,  
107.                false, new AuthorityKeyIdentifierStructure(RootCert));  
108.   
109.            certGen.AddExtension(X509Extensions.BasicConstraints,  
110.                true, new BasicConstraints(true));  
111.   
112.            certGen.AddExtension(X509Extensions.SubjectKeyIdentifier,  
113.                false, new SubjectKeyIdentifierStructure(keys.Public));  
114.              
115.            //密钥用途  
116.            int iuseAge;  
117.            switch (useAge)  
118.            {  
119.                case 1:  
120.                    iuseAge = KeyUsage.DigitalSignature;  
121.                    break;  
122.                case 2:  
123.                    iuseAge = KeyUsage.DataEncipherment;  
124.                    break;  
125.                default:  
126.                    iuseAge = KeyUsage.DigitalSignature | KeyUsage.DataEncipherment;  
127.                    break;  
128.            }  
129.   
130.            certGen.AddExtension(X509Extensions.KeyUsage, true,new KeyUsage(iuseAge));  
131.   
132.            //使用根证书私钥来签名证书 这样客户端安装根证书后 可验证证书的合法性  
133.            var cert = certGen.Generate(RootKey);  
134.   
135.            x509CertStr = RawCert(cert);  
136.            privKeyStr = RawPrivateKey(keys);  
137.        }  
138.   
139.   
140.   
141.   
142.        /// <summary>  
143.        /// 生成Pfx密钥文件  
144.        /// </summary>  
145.        /// <param name="privKeyStr">私钥</param>  
146.        /// <param name="x509CertStr">证书</param>  
147.        /// <param name="pwd">密码</param>  
148.        /// <returns>pfx文件</returns>  
149.        public static string NewX509Pfx(string privKeyStr, string x509CertStr, string pwd)  
150.        {  
151.            var certObj = new X509CertificateParser().ReadCertificate(new MemoryStream(Encoding.Default.GetBytes(x509CertStr)));  
152.            var privKey = (RsaPrivateCrtKeyParameters)PrivateKeyFactory.CreateKey(Convert.FromBase64String(privKeyStr));  
153.            var certEntry = new X509CertificateEntry(certObj);  
154.            var store = new Pkcs12StoreBuilder().SetUseDerEncoding(true).Build();  
155.            store.SetCertificateEntry("安全CA用户身份证书", certEntry);   //设置证书    
156.            store.SetKeyEntry("安全CA用户身份证书", new AsymmetricKeyEntry(privKey),  
157.                new[] { certEntry });   //设置私钥    
158.            using (var tx = new MemoryStream())  
159.            {  
160.                store.Save(tx, pwd.ToCharArray(), new SecureRandom());  
161.                return Convert.ToBase64String(tx.ToArray());  
162.            }  
163.        }  
164.   
165.   
166.        /// <summary>  
167.        ///   
168.        /// </summary>  
169.        /// <param name="user"></param>  
170.        /// <returns></returns>  
171.        private static X509Name RawToX509Name(Users user)  
172.        {  
173.            var attrs = new Hashtable();  
174.            IList order = new ArrayList();  
175.   
176.            attrs[X509Name.OU] = user.Unit == null ? string.Empty : user.Unit.FullUnitName;  
177.            attrs[X509Name.CN] = user.UserNameWithAlias + "用户证书";//证书名字  
178.            attrs[X509Name.O] = SettingCopyright.Organization;  
179.            attrs[X509Name.C] = "Zh";  
180.            attrs[X509Name.UID] = user.UID.ToString(CultureInfo.InvariantCulture);  
181.            attrs[X509Name.T] = user.UserName;  
182.   
183.            order.Add(X509Name.OU);  
184.            order.Add(X509Name.CN);  
185.            order.Add(X509Name.O);  
186.            order.Add(X509Name.C);  
187.            order.Add(X509Name.UID);  
188.            order.Add(X509Name.T);  
189.   
190.            return new X509Name(order, attrs);  
191.   
192.        }  
193.   
194.        /// <summary>  
195.        /// 生成私钥base64字符串  
196.        /// </summary>  
197.        /// <param name="x509CertStr">证书字符串</param>  
198.        /// <returns>私钥字符串</returns>  
199.        private static string RawPrivateKey(AsymmetricCipherKeyPair x509CertStr)  
200.        {  
201.            var privateKeyInfo = PrivateKeyInfoFactory.CreatePrivateKeyInfo(x509CertStr.Private);  
202.            return Convert.ToBase64String(privateKeyInfo.ToAsn1Object().GetDerEncoded());  
203.        }  
204.   
205.        /// <summary>  
206.        /// 生成证书  
207.        /// </summary>  
208.        /// <param name="v3Cert">证书对象</param>  
209.        /// <returns>证书字符串</returns>  
210.        private static string RawCert(X509Certificate v3Cert)  
211.        {  
212.            string cert;  
213.            using (var tx = new StringWriter())  
214.            {  
215.                var pemWriter = new PemWriter(tx);  
216.                pemWriter.WriteObject(v3Cert);  
217.                pemWriter.Writer.Flush();  
218.                cert = tx.ToString();  
219.            }  
220.            return cert;  
221.        }  
222.   
223.   
224.        /// <summary>  
225.        /// 生成认证原文并保存到数据库  
226.        /// </summary>  
227.        /// <param name="session">nhibernate session对象</param>  
228.        /// <param name="user">用户对象</param>  
229.        /// <param name="cert">证书对象</param>  
230.        /// <returns>生成认证原文</returns>  
231.        public static string NewOriginalCode(ISession session,Users user, CaCertificate cert)  
232.        {  
233.            var guid = Guid.NewGuid().ToString().Replace("-", "");  
234.            //前32位为guid 后面的为用户密码  
235.            guid +=user.Pwd;  
236.            guid = guid.ToLower();  
237.            var caRandom = new CaRandom  
238.            {  
239.                UID = cert.UID,  
240.                Random = guid  
241.            };  
242.            session.SaveOrUpdate(caRandom);  
243.            session.Flush();  
244.            return MacAtivex.EnPubKey(guid, cert.Cert);  
245.        }  
246.   
247.   
248.        /// <summary>  
249.        ///  生成认证用户 认证原文  
250.        /// </summary>  
251.        /// <param name="session"></param>  
252.        /// <param name="uid"></param>  
253.        /// <param name="code"></param>  
254.        /// <returns></returns>  
255.        public static bool VerifyOriginalCode(ISession session, int uid, string code)  
256.        {  
257.            var r = session.QueryOver<CaRandom>().Where(o => o.UID == uid)  
258.                  .Take(1).SingleOrDefault();  
259.            return r != null && r.Random.Equals(code);  
260.        }  
261.   
262.    }