c# - 使用 Pkcs10CertificationRequest 获取主题备用名称

Question

我目前能够解码 CSR 的值，请求的扩展除外，特别是 X509v3 Subject Alternative Name。这是的相关部分 我的 `DecodeCSR(string csr):

public void DecodeCsr(string csrStr){
//getting just csr
var csrChars = Regex.Replace(csrStr, @"-----[^-]+-----", "").Trim().Replace(" ", "").Replace(Environment.NewLine, "").ToCharArray();
//converting that string into a byte array
byte[] csrEncode = Convert.FromBase64CharArray(csrChars, 0, csrChars.Length);
//giving decodeCsr the byte array
Pkcs10CertificationRequest decodeCsr = new Pkcs10CertificationRequest(csrEncode);
//getting a string of subject information
string subject = decodeCsr.GetCertificationRequestInfo().Subject.ToString();
//here's how I'm getting a DerSet of attribute
DerSet atts = (DerSet)decodeCsr.GetCertificationRequestInfo().Attributes;
}

这是一个使用 SAN 的测试 csr:

string csr = "-----BEGIN CERTIFICATE REQUEST-----MIIC1DCCAbwCAQAwXjELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB0dlb3JnaWExEDAOBgNVBAcMB0F0bGFudGExDTALBgNVBAoMBFRlc3QxHDAaBgNVBAMME3d3dy50aGlzaXNhdGVzdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDFU4pXLB3d8csjvRIkIdZfUF2m9sijtk1bqYohqVwYr3+OyDRkfRuTCni8RJS9VOcl6n5aUiK27P4s5j9LqqfL0vS8B949P/ewb2ip2BGB1sEmxKcsEoZYNNEhMm9p7yNTAEqJ/WN0N1CpKBFV1J/w6xiQy5tUyUe7C9c8DX6K1uhEDF9pfeTaCNxYBShm0JFuAIqn6Z+RzbC7tdwc0KgN/bhx3bEvg8b0p/hgxd2veuUmB/fcIPsFawkGFPcQzLpSbc1Vb+zru40HAbRflyQckA3ZgRsa1OHsdiOyb8vpV7dUm4VHOm38bw2wVImRMfRtNZXrL/WiWcGadtFV8nxXAgMBAAGgMTAvBgkqhkiG9w0BCQ4xIjAgMB4GA1UdEQQXMBWCCHRlc3QuY29tggl0ZXN0Mi5jb20wDQYJKoZIhvcNAQELBQADggEBAKXxHlruiqtTwB1Ov17K+mz03EidfecdW+9u8gcLdOOLKn5kCg6RuC0mCjGHvFGjE6ljFc5cyUFbfdqzd8QXh1f3AgxveR+oq1wExJNr0Yl6kjVEdtndvHhSzUmZZ02EcPbIq/eY5KSTdKidjvIJMwTUtIyUQ71y/vSVn0YavvXYo/re57kC7chW/Ns/hZmHrZ6GvMWE9ea3P3jOKPyXCULJlbQCjXc6CQJAkBlcKpvnW6kU2PjreDWzRMhzqZzUqhc6RsGzz84/xwBsrYXfTj91FQd9+w15CYzBEJOv/Iz3CfVGb4s1+yUPVxgei2ezTjfQVcQgq4CusRnDU5/7lmE=-----END CERTIFICATE REQUEST-----";

我可以从 decodeCsr.GetCertificationRequestInfo().Attributes 获得的信息是一个 Org.BouncyCaSTLe.Asn1.DerSet，如下所示:

DerSet atts = (DerSet)decodeCsr.GetCertificationRequestInfo().Attributes;

这是它在 Debug模式下的样子(下面是整体对象的图片):

atts    {[[1.2.840.113549.1.9.14, [[[2.5.29.17, #3026820a61757374696e2e636f6d820b61757374696e322e636f6d820b61757374696e342e636f6d]]]]]} Org.BouncyCastle.Asn1.DerSet

I can see the DerOctetString in debug mode ，但是我不知道如何去做。我相信如果我能得到那么远，Hugo 的答案可能是适用的，有一个 DerOctetStringParser 但目前我没有什么可以提供的。

我尝试将 atts 视为一个字符串，删除 OID 获取的值与 Debug模式下的 DerOctetString 完全相同，并将其转换为 DerOctetString 没有用，我不相信这个答案可以很好地扩展。

Answer 1

我用下面的代码让它工作:

public static void DecodeCsr(string csr)
{
    csr = Regex.Replace(csr, @"-----[^-]+-----", String.Empty).Trim().Replace(" ", "").Replace(Environment.NewLine, "");

    PemObject pem = new PemObject("CSR", Convert.FromBase64String(csr));
    Pkcs10CertificationRequest request = new Pkcs10CertificationRequest(pem.Content);
    CertificationRequestInfo requestInfo = request.GetCertificationRequestInfo();

    // an Attribute is a collection of Sequence which contains a collection of Asn1Object
    // let's find the sequence that contains a DerObjectIdentifier with Id of "1.2.840.113549.1.9.14"
    DerSequence extensionSequence = requestInfo.Attributes.OfType<DerSequence>()
                                                          .First(o => o.OfType<DerObjectIdentifier>()
                                                                       .Any(oo => oo.Id == "1.2.840.113549.1.9.14"));

    // let's get the set of value for this sequence
    DerSet extensionSet = extensionSequence.OfType<DerSet>().First();

    // estensionSet = [[2.5.29.17, #30158208746573742e636f6d820974657374322e636f6d]]]
    // extensionSet contains nested sequence ... let's use a recursive method 
    DerOctetString str = GetAsn1ObjectRecursive<DerOctetString>(extensionSet.OfType<DerSequence>().First(), "2.5.29.17");

    GeneralNames names = GeneralNames.GetInstance(Asn1Object.FromByteArray(str.GetOctets()));
    Console.WriteLine(names.ToString());
}

static T GetAsn1ObjectRecursive<T>(DerSequence sequence, String id) where T : Asn1Object
{
    if (sequence.OfType<DerObjectIdentifier>().Any(o => o.Id == id))
    {
        return sequence.OfType<T>().First();
    }

    foreach (DerSequence subSequence in sequence.OfType<DerSequence>())
    {
        T value = GetAsn1ObjectRecursive<T>(subSequence, id);
        if (value != default(T))
        {
            return value;
        }
    }

    return default(T);
}

棘手的部分是 BouncyCaSTLe 在任何地方都与集合一起工作，并且请求的值在嵌套的嵌套集合中。我使用递归函数，因为我不确定您的 CSR 是否始终具有此嵌套值。