c# - 使用 BouncyCaSTLe 在证书请求中指定证书模板

Question

我正在使用 BouncyCaSTLe 生成证书请求:

using Org.BouncyCastle.Asn1.X509;
using Org.BouncyCastle.Crypto;
using Org.BouncyCastle.Crypto.Generators;
using Org.BouncyCastle.Crypto.Prng;
using Org.BouncyCastle.Pkcs;
using Org.BouncyCastle.Security;
using System.IO;

class Program {
    static void Main(string[] args) {
        var keyGenerator = new RsaKeyPairGenerator();
        keyGenerator.Init(
            new KeyGenerationParameters(
                new SecureRandom(new CryptoApiRandomGenerator()),
                2048));
        var keyPair = keyGenerator.GenerateKeyPair();
        X509Name name = new X509Name("CN=test");
        Pkcs10CertificationRequest csr = new Pkcs10CertificationRequest("SHA256WITHRSA", name, keyPair.Public, null, keyPair.Private);
        using (FileStream fs = new FileStream(@"X:\tmp\tmp.csr", FileMode.Create)) {
            var req = csr.GetDerEncoded();
            fs.Write(req, 0, req.Length);
        }
    }
}

如何在请求中指定证书模板？

注意:使用 certutil 解码通过证书控制台创建的请求，看起来证书模板应该是请求的扩展；我尝试相应地创建一个扩展:

var extGen = new Org.BouncyCastle.Asn1.X509.X509ExtensionsGenerator();
extGen.AddExtension(
    new DerObjectIdentifier("1.3.6.1.4.1.311.21.7"), // OID for certificate template extension 
    true,
    new DerObjectIdentifier("1.3.6.1.4.1.311.21.8.the.OID.of.the.template"));

但是，我不明白我应该如何将它附加到请求中。

Answer 1

经过一些挖掘，这个解决方案似乎可行:

const string TemplateOid = "1.3.6.1.4.1.311.21.8.etc.etc";
const int MajorVersion = 100;
const int MinorVersion = 4;

Dictionary<DerObjectIdentifier, X509Extension> extensionsDictionary = new Dictionary<DerObjectIdentifier,X509Extension>();
DerObjectIdentifier certificateTemplateExtensionOid = new DerObjectIdentifier("1.3.6.1.4.1.311.21.7");
DerSequence certificateTemplateExtension = new DerSequence(
    new DerObjectIdentifier(TemplateOid),
    new DerInteger(MajorVersion),
    new DerInteger(MinorVersion));
extensionsDictionary[certificateTemplateExtensionOid] = new X509Extension(
    false,
    new DerOctetString(certificateTemplateExtension));
X509Extensions extensions = new X509Extensions(extensionsDictionary);
Attribute attribute = new Attribute(
    PkcsObjectIdentifiers.Pkcs9AtExtensionRequest,
    new DerSet(extensions));
DerSet attributes = new DerSet(attribute);
Pkcs10CertificationRequest csr = new Pkcs10CertificationRequest("SHA256WITHRSA", name, keyPair.Public, attributes, keyPair.Private);