我有以下代码,它生成了一个很好的自签名证书,效果很好,但我想更新到最新的BouncyCastle(1.8.1.0),我收到了关于过时用法的警告:
var persistedCertificateFilename = "ClientCertificate.pfx";
if (!string.IsNullOrWhiteSpace(ConfigurationManager.AppSettings["PersistedCertificateFilename"])) { persistedCertificateFilename = ConfigurationManager.AppSettings["PersistedCertificateFilename"].Trim(); }
if (persistCertificateToDisk)
{
if (File.Exists(persistedCertificateFilename))
{
var certBytes = File.ReadAllBytes(persistedCertificateFilename);
this.clientCertificate = new X509Certificate2(certBytes, (string) null, X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.Exportable | X509KeyStorageFlags.PersistKeySet);
}
}
if (this.clientCertificate == null)
{
// Initialize the new secure keys
KeyGenerator keyGenerator = KeyGenerator.Create();
KeyPair keyPair = keyGenerator.GenerateKeyPair();
this.privateKey = keyPair.ToEncryptedPrivateKeyString(privateKeySecret);
this.publicKey = keyPair.ToPublicKeyString();
// Client certificate permissions
var certificatePermissions = new ArrayList()
{
KeyPurposeID.IdKPCodeSigning,
KeyPurposeID.IdKPServerAuth,
KeyPurposeID.IdKPTimeStamping,
KeyPurposeID.IdKPOcspSigning,
KeyPurposeID.IdKPClientAuth
};
// Initialize the certificate generation
var certificateGenerator = new X509V3CertificateGenerator();
BigInteger serialNo = BigInteger.ProbablePrime(128, new Random());
certificateGenerator.SetSerialNumber(serialNo);
certificateGenerator.SetSubjectDN(GetLicenseeDN());
certificateGenerator.SetIssuerDN(GetLicencerDN());
certificateGenerator.SetNotAfter(DateTime.Now.AddYears(100));
certificateGenerator.SetNotBefore(DateTime.Now.Subtract(new TimeSpan(7, 0, 0, 0)));
//ISignatureFactory signatureFactory = new Asn1SignatureFactory("SHA512WITHRSA", keyPair.PrivateKey); // ??
certificateGenerator.SetSignatureAlgorithm("SHA512withRSA");
certificateGenerator.AddExtension(X509Extensions.ExtendedKeyUsage, false, new ExtendedKeyUsage(certificatePermissions));
var subjectKeyIdentifier = new SubjectKeyIdentifier(SubjectPublicKeyInfoFactory.CreateSubjectPublicKeyInfo(keyPair.PublicKey));
certificateGenerator.AddExtension(X509Extensions.SubjectKeyIdentifier.Id, false, subjectKeyIdentifier);
certificateGenerator.SetPublicKey(keyPair.PublicKey);
var result = certificateGenerator.Generate(keyPair.PrivateKey);
var secure = new SecureString();
foreach (char c in privateKeySecret)
{
secure.AppendChar(c);
}
X509KeyStorageFlags flags = X509KeyStorageFlags.MachineKeySet;
if (persistCertificateToDisk) { flags |= X509KeyStorageFlags.Exportable; flags |= X509KeyStorageFlags.PersistKeySet; }
this.clientCertificate = new X509Certificate2(Org.BouncyCastle.Security.DotNetUtilities.ToX509Certificate(result).Export(X509ContentType.Cert), secure, flags);
// This section allows us to use this certificate on Azure (no file access required)
CspParameters cspParams;
const int PROVIDER_RSA_FULL = 1;
cspParams = new CspParameters(PROVIDER_RSA_FULL);
cspParams.KeyContainerName = new Guid().ToString();
cspParams.Flags = CspProviderFlags.UseMachineKeyStore;
cspParams.ProviderName = "Microsoft Strong Cryptographic Provider";
var rule = new CryptoKeyAccessRule("everyone", CryptoKeyRights.FullControl, AccessControlType.Allow);
cspParams.CryptoKeySecurity = new CryptoKeySecurity();
cspParams.CryptoKeySecurity.SetAccessRule(rule);
// Set the private key
var tempRcsp = (RSACryptoServiceProvider) Org.BouncyCastle.Security.DotNetUtilities.ToRSA((RsaPrivateCrtKeyParameters) keyPair.PrivateKey);
var rcsp = new RSACryptoServiceProvider(cspParams);
rcsp.ImportCspBlob(tempRcsp.ExportCspBlob(true));
this.clientCertificate.PrivateKey = rcsp;
if (persistCertificateToDisk)
{
if (!File.Exists(persistedCertificateFilename))
{
File.WriteAllBytes(persistedCertificateFilename, this.clientCertificate.Export(X509ContentType.Pkcs12, (string) null));
}
}
}
具体来说,警告是:
"X509V3CertificateGenerator.SSetSignatureAlgorithm(string)"为过时:"如果Generate与ISignatureFactory一起使用,则不需要"
和
"X509V3CertificateGenerator.Genere(AsymmetricKeyParameter)"为过时:"使用ISignatureFactory生成"
所以,我的问题是:
- 我需要担心这些警告吗
- 如果是,哪些线条会发生变化
- 如果我确实更新了这段代码,是否有性能优势
注意:如果有人好奇的话,我将其保存到磁盘的原因是,每次实例化客户端时,这段代码都会创建一个证书,由于最小密钥大小为2048,性能为1.7.0,这一点尤其苛刻。
我也为此挣扎了一段时间。我终于有了解决办法。让我们看看其中一个错误:
'X509V3CertificateGenerator.Generate(AsymmetricKeyParameter)' is obsolete: 'Use Generate with an ISignatureFactory'
你基本上是在使用(我也在做同样的事情)Generate方法,如下所示:
var certificate = certificateGenerator.Generate(issuerCertificate.PrivateKey, random);
其中certificateGenerator是类CertificateContainer
的实例错误表明:'Use Generate with an ISignatureFactory'
因此,让我们首先为ISignatureFactory创建一个实例。
ISignatureFactory signatureFactory = new Asn1SignatureFactory("SHA512WITHRSA", issuerKeyPair.Private, random);
为了在这之前正确工作,你还应该声明以下内容:
var randomGenerator = new CryptoApiRandomGenerator();
var random = new SecureRandom(randomGenerator);
AsymmetricCipherKeyPair subjectKeyPair = default(AsymmetricCipherKeyPair);
var keyGenerationParameters = new KeyGenerationParameters(random, keyStrength);
keyPairGenerator.Init(keyGenerationParameters);
subjectKeyPair = keyPairGenerator.GenerateKeyPair();
AsymmetricCipherKeyPair issuerKeyPair = subjectKeyPair;
现在,在这些更改之后,将方法Generate
从:更改为
var certificate = certificateGenerator.Generate(issuerCertificate.PrivateKey, random);
至:
var certificate = certificateGenerator.Generate(signatureFactory);
我希望它能有所帮助。