Windows证书的生成导出以及使用证书验证文件是否被修改

本文介绍了如何使用Windows自带的证书生成器生成，导出，使用证书。并以验证文件是否被修改举例

1．证书相关辅助类

  public sealed class DataCertificate

    {

        #region 生成证书

        /// <summary>   

        /// 根据指定的证书名和makecert全路径生成证书（包含公钥和私钥，并保存在MY存储区）   

        /// </summary>   

        /// <paramname="subjectName"></param>  

        /// <paramname="makecertPath"></param>   

        /// <returns></returns>   

        public static boolCreateCertWithPrivateKey(string subjectName, string makecertPath)

        {

            subjectName = "CN=" +subjectName;

            string param = "-r -pe -n" + subjectName + " -b 01/01/2005 -sky exchange -ss my";

            try

            {

                Process p = Process.Start(makecertPath,param);

                p.WaitForExit();

                p.Close();

            }

            catch (Exception e)

            {

                //LogRecord.putErrorLog(e.ToString(),"DataCerficate.CreateCertWithPrivateKey");   

                return false;

            }

            return true;

        }

        #endregion

        #region 文件导入导出

        /// <summary>   

        /// 从WINDOWS证书存储区的个人MY区找到主题为subjectName的证书，   

        /// 并导出为pfx文件，同时为其指定一个密码   

        /// 并将证书从个人区删除(如果isDelFromstor为true)   

        /// </summary>   

        /// <paramname="subjectName">证书主题，不包含CN=</param>   

        /// <paramname="pfxFileName">pfx文件名</param>   

        /// <paramname="password">pfx文件密码</param>   

        /// <paramname="isDelFromStore">是否从存储区删除</param>   

        /// <returns></returns>   

        public static bool ExportToPfxFile(stringsubjectName, string pfxFileName,

            string password, boolisDelFromStore)

        {

            subjectName = "CN=" +subjectName;

            X509Store store = new X509Store(StoreName.My,StoreLocation.CurrentUser);

            store.Open(OpenFlags.ReadWrite);

            X509Certificate2Collectionstorecollection = (X509Certificate2Collection)store.Certificates;

            foreach (X509Certificate2 x509 instorecollection)

            {

                if (x509.Subject ==subjectName)

                {

                    Debug.Print(string.Format("certificatename: {0}", x509.Subject));

                    byte[] pfxByte =x509.Export(X509ContentType.Pfx, password);

                    using (FileStreamfileStream = new FileStream(pfxFileName, FileMode.Create))

                    {

                        // Write the data tothe file, byte by byte.   

                        for (int i = ; i <pfxByte.Length; i++)

                           fileStream.WriteByte(pfxByte[i]);

                        // Set the streamposition to the beginning of the file.   

                        fileStream.Seek(, SeekOrigin.Begin);

                        // Read and verify thedata.   

                        for (int i = ; i <fileStream.Length; i++)

                        {

                            if (pfxByte[i] !=fileStream.ReadByte())

                            {

                                //LogRecord.putErrorLog("Exportpfx error while verify the pfx file!", "ExportToPfxFile");   

                               fileStream.Close();

                                return false;

                            }

                        }

                        fileStream.Close();

                    }

                    if (isDelFromStore == true)

                        store.Remove(x509);

                }

            }

            store.Close();

            store = null;

            storecollection = null;

            return true;

        }

        /// <summary>   

        /// 从WINDOWS证书存储区的个人MY区找到主题为subjectName的证书，   

        /// 并导出为CER文件（即，只含公钥的）   

        /// </summary>   

        /// <paramname="subjectName"></param>  

        /// <paramname="cerFileName"></param>  

        /// <returns></returns>   

        public static bool ExportToCerFile(stringsubjectName, string cerFileName)

        {

            subjectName = "CN=" +subjectName;

            X509Store store = new X509Store(StoreName.My,StoreLocation.CurrentUser);

            store.Open(OpenFlags.ReadWrite);

            X509Certificate2Collectionstorecollection = (X509Certificate2Collection)store.Certificates;

            foreach (X509Certificate2 x509 instorecollection)

            {

                if (x509.Subject ==subjectName)

                {

                    Debug.Print(string.Format("certificatename: {0}", x509.Subject));

                    //byte[] pfxByte =x509.Export(X509ContentType.Pfx, password);  

                    byte[] cerByte =x509.Export(X509ContentType.Cert);

                    using (FileStreamfileStream = new FileStream(cerFileName, FileMode.Create))

                    {

                        // Write the data tothe file, byte by byte.   

                        for (int i = ; i <cerByte.Length; i++)

                           fileStream.WriteByte(cerByte[i]);

                        // Set the streamposition to the beginning of the file.   

                        fileStream.Seek(, SeekOrigin.Begin);

                        // Read and verify thedata.   

                        for (int i = ; i <fileStream.Length; i++)

                        {

                            if (cerByte[i] !=fileStream.ReadByte())

                            {

                                //LogRecord.putErrorLog("ExportCER error while verify the CERT file!", "ExportToCERFile");   

                               fileStream.Close();

                                return false;

                            }

                        }

                        fileStream.Close();

                    }

                }

            }

            store.Close();

            store = null;

            storecollection = null;

            return true;

        }

        #endregion

        #region 从证书中获取信息

        /// <summary>   

        /// 根据私钥证书得到证书实体，得到实体后可以根据其公钥和私钥进行加解密   

        /// 加解密函数使用DEncrypt的RSACryption类   

        /// </summary>   

        /// <paramname="pfxFileName"></param>  

        /// <paramname="password"></param>  

        /// <returns></returns>   

        public static X509Certificate2GetCertificateFromPfxFile(string pfxFileName,

            string password)

        {

            try

            {

                return new X509Certificate2(pfxFileName,password, X509KeyStorageFlags.Exportable);

            }

            catch (Exception e)

            {

                //LogRecord.putErrorLog("getcertificate from pfx" + pfxFileName + " error:" +e.ToString(),   

                //   "GetCertificateFromPfxFile");   

                return null;

            }

        }

        /// <summary>   

        /// 到存储区获取证书   

        /// </summary>   

        /// <paramname="subjectName"></param>  

        /// <returns></returns>   

        public static X509Certificate2GetCertificateFromStore(string subjectName)

        {

            subjectName = "CN=" +subjectName;

            X509Store store = new X509Store(StoreName.My,StoreLocation.CurrentUser);

            store.Open(OpenFlags.ReadWrite);

            X509Certificate2Collectionstorecollection = (X509Certificate2Collection)store.Certificates;

            foreach (X509Certificate2 x509 instorecollection)

            {

                if (x509.Subject ==subjectName)

                {

                    return x509;

                }

            }

            store.Close();

            store = null;

            storecollection = null;

            return null;

        }

        /// <summary>   

        /// 根据公钥证书，返回证书实体   

        /// </summary>   

        /// <paramname="cerPath"></param>  

        public static X509Certificate2GetCertFromCerFile(string cerPath)

        {

            try

            {

                return new X509Certificate2(cerPath);

            }

            catch (Exception e)

            {

                //LogRecord.putErrorLog(e.ToString(),"DataCertificate.LoadStudentPublicKey");   

                return null;

            }

        }

        #endregion

        #region 加解密

        private static byte[] m_Bytes;

        /// <summary>

        /// 根据明文加密证书密码生成密文

        /// </summary>

        /// <paramname="mingwen"></param>

        /// <paramname="pfxFileName"></param>

        /// <paramname="password"></param>

        /// <returns></returns>

        public static string EncryptString(stringmingwen, string pfxFileName, string password)

        {

            UnicodeEncoding ByteConverter = newUnicodeEncoding();

            byte[] mingwenBytes =ByteConverter.GetBytes(mingwen);

            X509Certificate2 X509Certificate2 =GetCertificateFromPfxFile(pfxFileName, password);

            RSACryptoServiceProvidermyRSACryptoServiceProvider = (RSACryptoServiceProvider)X509Certificate2.PrivateKey;

            RSAParameters parameters =myRSACryptoServiceProvider.ExportParameters(true);

            byte[] encryptedData =myRSACryptoServiceProvider.SignData(mingwenBytes, new SHA1CryptoServiceProvider());

            return Convert.ToBase64String(encryptedData);

            //returnRSAext.EncryptProcess(mingwen, parameters.D, parameters.Modulus);

            //byte[] plaintextByte =myRSACryptoServiceProvider.Encrypt(mingwenBytes, false);

            //m_Bytes = plaintextByte;

            //string str = "";

            //for (int i = 0; i <plaintextByte.Length; i++)

            //{

            //    str +=plaintextByte[i].ToString("X2");

            //}

            //return str;

        }

        /// <summary>

        /// 根据明文密文证书，验证文件是否被修改

        /// </summary>

        /// <paramname="yuanwen"></param>

        /// <paramname="miwen"></param>

        /// <paramname="cerPath"></param>

        /// <returns></returns>

        public static bool DecryptString(stringyuanwen, string miwen, string cerPath)

        {

            X509Certificate2 X509Certificate2 =GetCertFromCerFile(cerPath);

            RSACryptoServiceProvidermyRSACryptoServiceProvider = (RSACryptoServiceProvider)X509Certificate2.PublicKey.Key;

            //RSAParameters parameters =myRSACryptoServiceProvider.ExportParameters(true);

            UnicodeEncoding ByteConverter = newUnicodeEncoding();

            byte[] dataToVerifyBytes =ByteConverter.GetBytes(yuanwen);

            byte[] signedDataBytes = Convert.FromBase64String(miwen);

            returnmyRSACryptoServiceProvider.VerifyData(dataToVerifyBytes, new SHA1CryptoServiceProvider(),signedDataBytes);

            //returnRSAext.DecryptProcess(miwen, parameters.Modulus, parameters.Exponent);

            //byte[] plaintextByte =myRSACryptoServiceProvider.Decrypt(mingwenBytes, false);

            //returnEncoding.UTF8.GetString(plaintextByte);

        }

        #endregion

}

2．使用举例

根据指定的证书名和makecert全路径生成证书（包含公钥和私钥，并保存在MY存储区）

stringMakeCert = @"C:\Program Files (x86)\WindowsKits\8.0\bin\x86\makecert.exe";

DataCertificate.CreateCertWithPrivateKey("digihail123",MakeCert);

从WINDOWS证书存储区的个人MY区找到主题为digihail123的证书，并使用密码生成pfx文件和导出cer文件

DataCertificate.ExportToPfxFile("digihail123","d:\\digihail456.pfx","123456",false);

DataCertificate.ExportToCerFile("digihail123","d:\\digihail456.cer");

根据明文 pfx文件 密码生成密文 并把明文 密文一起写入的文件，和cer证书下发给客户端

string miwen=DataCertificate.EncryptString(mingwen,"d:\\digihail456.pfx", "123456");

4.根据从文件读取的 明文 密文 和cer文件验证文件是否被修改

bool isok = DataCertificate.DecryptString(mingwen,miwen,"d:\\digihail456.cer");