c# - SSL证书生成

Question

我正在开发 C# 项目，其中服务器和客户端之间的 tcp 传输是使用 SSL 进行的。我使用 makecert 程序创建了证书文件，但它只能在生成它的计算机上运行(尽管我已经安装了 .cer 文件)。我几乎可以肯定，问题出在我输入命令的参数上，但我检查了很多组合，但没有一个(尽管以下)有效

makecert -r -pe -n "CN=This is my certificate" -ss my -sky exchange -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12 ca.cer

.cer文件仅用于加密传输。我不使用 PKI。此外，使用 SSL 是“死要求”——它必须被使用，只是为了被使用。不应考虑任何安全问题。

如果有人回答我，如何创建证书，X509Certificate.CreateFromCertFile 方法可以使用我会很高兴。

Answer 1

谢谢罗杰，我找到了你的博客并设法让它工作并对其进行了包装，因此它易于使用，我还设法在证书上设置了友好名称

using System;
using System.Collections.Generic;
using System.Security.Cryptography.X509Certificates;
using System.Diagnostics;

public class SSLCertificateCreator
{
    public static string RunDosCommand(string Cmd, string Arguments)
    {//Executes a Dos command in the current directory and then returns the result
        string TestMessageText = "";
        string filePath = Environment.CurrentDirectory;
        ProcessStartInfo pi = new ProcessStartInfo()
        {
            FileName = filePath + "\\" + Cmd,
            Arguments = Arguments + " ",
            RedirectStandardOutput = true,
            UseShellExecute = false,
            CreateNoWindow = false
        };
        try
        {
            using (Process p = Process.Start(pi))
            {
                p.WaitForExit();
                TestMessageText = p.StandardOutput.ReadToEnd();
                return TestMessageText;
            }
        }
        catch (Exception Ex)
        {
            return "ERROR :" +Ex.Message;
        }
    }

    public static bool MakeCACertificate(string RootCertificateName, string FriendlyName)
    {//Make a CA certificate but only if we don't already have one and then sets the friendly name
        if (FindCertificate("Root", RootCertificateName, OpenFlags.ReadOnly) != null) return false; //We already have this root certificate
        string Arguments="-pe -n \"CN=" + RootCertificateName + "\" -ss Root -sr CurrentUser -a sha1 -sky signature -r \"" + RootCertificateName + ".cer\" -m 12";
        string Result=RunDosCommand("makecert", Arguments);
        X509Certificate2 Cert = FindCertificate("Root", RootCertificateName, OpenFlags.ReadWrite);
        if (Cert == null || !Result.ToLower().StartsWith("succeeded")) return false;
        Cert.FriendlyName = FriendlyName;
        return true;
    }


    public static bool MakeSignedCertificate(string RootCertificateName, string CertificateName, string FriendlyName)
    {//Makes a signed certificate but only if we have the root certificate and then sets the friendly name
        if (FindCertificate("Root", RootCertificateName, OpenFlags.ReadOnly) == null) return false; //We must have a valid root-certificate first
        if (FindCertificate("my",CertificateName, OpenFlags.ReadOnly)!=null) return false;//Nope we alrady have this signed certificate
        string Arguments = "-pe -n \"CN=" + CertificateName + "\" -ss my -sr CurrentUser -a sha1 -sky exchange -eku 1.3.6.1.5.5.7.3.1 -in \"" + RootCertificateName + "\" -is Root -ir CurrentUser -sp \"Microsoft RSA SChannel Cryptographic Provider\" -sy 12 \"" + CertificateName + ".cer\" -m 12";
        string Result = RunDosCommand("makecert", Arguments);
        X509Certificate2 Cert = FindCertificate("my", CertificateName, OpenFlags.ReadWrite);
        if (Cert==null || !Result.ToLower().StartsWith("succeeded")) return false;
        Cert.FriendlyName = FriendlyName;
        return true;
    }

    private static X509Certificate2 FindCertificate(string Store, string Name, OpenFlags Mode)
    {//Look to see if we can find the certificate store
        X509Store store = new X509Store(Store,StoreLocation.CurrentUser);
        store.Open(Mode);
        foreach (X509Certificate2 Cert in store.Certificates)
        {
            if (Cert.Subject.ToLower() =="cn="+ Name.ToLower()) 
                return Cert;//Yep found it
        }
        return null;
    }
}

示例用法

SSLCertificateCreator.MakeCACertificate("DavesRoot","Nice Name"); SSLCertificateCreator.MakeSignedCertificate("DavesRoot", "Daves Signed Certificate5","Nice Name");

makecert.exe 需要位于 Bin/Release 或 Debug 目录中才能使代码正常工作，并且此代码仅在 Windows-8 上进行过测试