通过使用C#传递整个X509证书链对Soap标头进行签名

Question

全部，作为调用javaapi的一部分，我正在尝试对SOAP请求标头进行数字签名。我使用的是带有.Net框架4.5的C#。我手动创建了soap请求，当我在使用X509Certificate的私钥(.pfx-cert文件(签名后发送签名请求时，Java服务使用的Mulesoft编排层抱怨我的值不包含整个证书链。我使用C#的X509Certificate类的GetRawCertData((，并将此byte[]转换为base64编码的字符串。当我使用mmc在我的个人证书存储中查看这个.pfx时，我可以看到中间证书和根证书。这个.pfx证书是我们组织的服务器管理员给我的。是否有人知道使用C#在wsse:BinarySecurityToken元素中传递整个证书链的其他方法？请看下面我的样品肥皂信封。

我正在使用HttpClient和WebApi(.Net框架(将此请求发送到Java服务(

C#逻辑设置wsse:BinarySecurityToken元素的值

X509Certificate2 x509Certificate = GetCertificateBySubjectName();
byte[] rawData = x509Certificate.GetRawCertData();    
var cerrtBase64String = Convert.ToBase64String(rawData);
binarySecurityToken.InnerText = cerrtBase64String ;
public  X509Certificate2 GetCertificateBySubjectName(string subjectName)
{
// Load the certificate from the certificate store.
X509Certificate2 cert = null;
X509Store store = new X509Store(StoreName.My, StoreLocation.CurrentUser);
try
{
// Open the store.
store.Open(OpenFlags.ReadOnly | OpenFlags.OpenExistingOnly);
// Find the certificate with the specified subject.
cert = store.Certificates.Find(X509FindType.FindBySubjectName, subjectName, false)[0];
// Throw an exception of the certificate was not found.
if (cert == null)
{
throw new CryptographicException("The certificate could not be found.");
}
}
catch (Exception ex)
{
var message = ex.Message;
}
finally
{
// Close the store even if an exception was thrown.
store.Close();
}
return cert;
}

<?xml version="1.0" encoding="UTF8"?>
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
<SOAP-ENV:Header>
<wsse:Security xmlns:ds="http://www.w3.org/2000/09/xmldsig#" 
xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" 
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" 
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" SOAP-ENV:mustUnderstand="1">
<wsse:BinarySecurityToken  
EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" 
ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509" 
wsu:Id="x509cert00">MIIChDCCAe2gAwIBAgIBADANBgkqhkiG9w0BAQUFADAwMQswCQYDVQQGEwJHQjEMMAoGA1UEChMD
SUJNMRMwEQYDVQQDEwpXaWxsIFlhdGVzMB4XDTA2MDEzMTAwMDAwMFoXDTA3MDEzMTIzNTk1OVow
MDELMAkGA1UEBhMCR0IxDDAKBgNVBAoTA0lCTTETMBEGA1UEAxMKV2lsbCBZYXRlczCBnzANBgkq
hkiG9w0BAQEFAAOBjQAwgYkCgYEArsRj/n+3RN75+jaxuOMBWSHvZCB0egv8qu2UwLWEeiogePsR
6Ku4SuHbBwJtWNr0xBTAAS9lEa70yhVdppxOnJBOCiERg7S0HUdP7a8JXPFzA+BqV63JqRgJyxN6
msfTAvEMR07LIXmZAte62nwcFrvCKNPCFIJ5mkaJ9v1p7jkCAwEAAaOBrTCBqjA/BglghkgBhvhC
AQ0EMhMwR2VuZXJhdGVkIGJ5IHRoZSBTZWN1cml0eSBTZXJ2ZXIgZm9yIHovT1MgKFJBQ0YpMDgG
ZQVRFU0BVSy5JQk0uQ09ggdJQk0uQ09NhgtXV1cuSUJNLkNPTYcECRRlBjAO
</wsse:BinarySecurityToken>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" 
xmlns:ds="http://www.w3.org/2000/09/xmldsig#" 
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" 
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<c14n:InclusiveNamespaces xmlns:c14n="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="ds wsu xenc SOAP-ENV "/>
</ds:CanonicalizationMethod>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#TheBody">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<c14n:InclusiveNamespaces xmlns:c14n="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="wsu SOAP-ENV "/>
</ds:Transform>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/> 
<ds:DigestValue>QORZEA+gpafluShspHxhrjaFlXE=</ds:DigestValue> 
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>drDH0XESiyN6YJm27mfK1ZMG4Q4IsZqQ9N9V6kEnw2lk7aM3if77XNFnyKS4deglbC3ga11kkaFJ
p4jLOmYRqqycDPpqPm+UEu7mzfHRQGe7H0EnFqZpikNqZK5FF6fvYlv2JgTDPwrOSYXmhzwegUDT
lTVjOvuUgXYrFyaO3pw=</ds:SignatureValue>
<ds:KeyInfo>
<wsse:SecurityTokenReference>
<wsse:Reference URI="#x509cert00" 
ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509"/>
</wsse:SecurityTokenReference>
</ds:KeyInfo>
</ds:Signature>
</wsse:Security>
</SOAP-ENV:Header>
<SOAP-ENV:Body xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="TheBody">
<getVersion xmlns="http://msgsec.wssecfvt.ws.ibm.com"/>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>

Answer 1

GetRawCertData()返回组成证书的字节，忽略任何"；附加数据"；比如私钥或友好名称之类的。它并不是一个绑定到它加载的文件或任何神奇的东西。

整个证书链

您没有显示如何加载PFX，但最常见的方法是X509Certificate2构造函数(new X509Certificate2(pfx, pwd, maybeSomeFlags)(。由于这是单个证书的构造函数，因此只能加载一个证书。另一种方法是将其导入集合

X509Certificate2Collection coll = new X509Certificate2Collection();
coll.Import(pfx, pwd, maybeSomeFlags);

从那里，您可能会循环为该集合中的所有元素添加x509cert00所做的一切。当然，这是假设集合按照您喜欢的方式排序，并且没有多余的数据。如果你想知道它被排序到一个合适的链中，你必须通过X509Chain.Build运行签名证书(在将集合的其余部分复制到chain.ChainPolicy.ExtraStore中之后(。