我目前正在进行概念验证,以使用证书加密数据。它运行良好,但现在,我想尝试证书过期时的情况。我创建了一个过期的证书,我很惊讶地注意到,即使使用过期的证书,一切都可以正常工作。我期待一个错误。
你知道是不是因为它是一个自签名证书吗?
这是我用来测试我的案例的代码
[TestMethod]
public void Encrypt_decrypt_with_expired_certificate()
{
//Arrange
var baseString = "This is an encryption test";
X509Certificate2 newX509Certificate2 = new X509Certificate2("d:\testx509certExpired.pfx", "apassword");
Console.WriteLine(newX509Certificate2.NotAfter); //Show the expiration date which is in the past
var encryptor = new CertificateEncryptor(newX509Certificate2); //This class is a simple wrapper around RSACryptoServiceProvider
//Act
string encryptedResult = encryptor.Encrypt(baseString); //Exception expected because of the expired certificate but not thrown
//Assert
Console.WriteLine("Base string : {0}", baseString);
Console.WriteLine("Encrypted string : {0}", encryptedResult);
Assert.IsNotNull(encryptedResult);
//revert back
string decryptedString = encryptor.Decrypt(encryptedResult);
Console.WriteLine("Decrypted string : {0}", decryptedString);
Assert.AreEqual(baseString, decryptedString);
}
谢谢
正如 GregS 所说,RSACryptoServiceProvider
类(不是 X509Certificate2)提供了执行加密操作的能力。 RSACryptoServiceProvider
对证书一无所知,它只知道密钥及其参数。这就是您看不到任何错误的原因。
这意味着证书验证 -- 是你的应用的责任。加密数据时应检查证书,并跳过所有证书检查以解密数据。
尝试访问证书的 X509Certificate2.PublicKey.Key 属性时,如果证书不在其有效期内,则应引发 CryptographicException。
以下是我如何从证书加载公钥和私钥以执行加密操作:
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;
class Example
{
private RSACryptoServiceProvider publicKey,
privateKey;
private bool getRSAKeys(X509Certificate2 cert, StoreLocation location)
{
try
{
//This will throw a CryptographicException if the certificate is expired
publicKey = (RSACryptoServiceProvider)cert.PublicKey.Key;
privateKey = (RSACryptoServiceProvider)cert.PrivateKey;
return true;
}
catch (CryptographicException e)
{
Console.WriteLine("The certificate is expired or otherwise unusablern" + e.ToString());
return false;
}
}