生成的签名X.509客户端证书无效（没有证书链到其CA）

Question

我使用Bouncy Castle生成X.509客户端证书并使用已知CA对其进行唱名。

首先，我从证书存储中读取CA证书，生成客户端证书，并使用CA对其进行签名。证书验证失败，原因如下：

无法为受信任的根权威机构构建证书链。

据我所知，这是由于证书没有与CA相关。

下面是一个代码示例：

public static X509Certificate2 GenerateCertificate(X509Certificate2 caCert, string certSubjectName) 
{ 
    // Generate Certificate 

    var cerKp = kpgen.GenerateKeyPair(); 

    var certName = new X509Name(true,certSubjectName); // subjectName = user 
    var serialNo = BigInteger.ProbablePrime(120, new Random()); 

    X509V3CertificateGenerator gen2 = new X509V3CertificateGenerator(); 
    gen2.SetSerialNumber(serialNo); 
    gen2.SetSubjectDN(certName); 
    gen2.SetIssuerDN(new X509Name(true,caCert.Subject)); 
    gen2.SetNotAfter(DateTime.Now.AddDays(100)); 
    gen2.SetNotBefore(DateTime.Now.Subtract(new TimeSpan(7, 0, 0, 0))); 
    gen2.SetSignatureAlgorithm("SHA1WithRSA"); 
    gen2.SetPublicKey(cerKp.Public); 


    AsymmetricCipherKeyPair akp = DotNetUtilities.GetKeyPair(caCert.PrivateKey); 
    Org.BouncyCastle.X509.X509Certificate newCert = gen2.Generate(caKp.Private); 

    // used for getting a private key 
    X509Certificate2 userCert = ConvertToWindows(newCert,cerKp); 

    if (caCert22.Verify()) // works well for CA 
    { 
     if (userCert.Verify()) // fails for client certificate 
     { 
      return userCert; 
     } 
    } 
    return null; 

} 



private static X509Certificate2 ConvertToWindows(Org.BouncyCastle.X509.X509Certificate newCert, AsymmetricCipherKeyPair kp) 
{ 
    string tempStorePwd = "abcd1234"; 
    var tempStoreFile = new FileInfo(Path.GetTempFileName()); 

    try 
    { 
     // store key 
     { 
      var newStore = new Pkcs12Store(); 

      var certEntry = new X509CertificateEntry(newCert); 

      newStore.SetCertificateEntry(
       newCert.SubjectDN.ToString(), 
       certEntry 
       ); 

      newStore.SetKeyEntry(
       newCert.SubjectDN.ToString(), 
       new AsymmetricKeyEntry(kp.Private), 
       new[] { certEntry } 
       ); 
      using (var s = tempStoreFile.Create()) 
      { 
       newStore.Save(
        s, 
        tempStorePwd.ToCharArray(), 
        new SecureRandom(new CryptoApiRandomGenerator()) 
        ); 
      } 
     } 

     // reload key 
     return new X509Certificate2(tempStoreFile.FullName, tempStorePwd); 
    } 
    finally 
    { 
     tempStoreFile.Delete(); 
    } 
} 

Answer 1

我这出。如果您调用X509Certificate.Verify（publicKey），则必须传递CA的公钥，而不是Pkcs10CertificationRequest中的客户端公钥。