Создание цепочки сертификатов в Bouncy Castle (C#) ⇐ C#

[Anonymous]

Я создаю оболочку для надувного замка, которая генерирует сертификат и может быть подписана другим сертификатом.
Я настроил AuthorityKeyIndentifier и имена его каталогов, чтобы они соответствовали подписи. сертификат. Я также добавил сертификаты от корня вниз по листу, но продолжаю получать ошибку 20 в openssl.
openssl verify -CAfile ROOT.cer -untrusted INTERMEDIATE.cer LEAF.cer
error 20 at 0 depth lookup: unable to get local issuer certificate
error LEAF.cer: verification failed

Вот код, который я использовал для своей оболочки генератора:
using System;
using System.IO;
using System.Collections.Generic;
using System.Security.Cryptography.X509Certificates;

using Org.BouncyCastle.Math;
using Org.BouncyCastle.Security;
using Org.BouncyCastle.Crypto;
using Org.BouncyCastle.Crypto.Generators;
using Org.BouncyCastle.Crypto.Operators;
using Org.BouncyCastle.Crypto.Parameters;
using Org.BouncyCastle.Crypto.Prng;
using Org.BouncyCastle.Pkcs;
using Org.BouncyCastle.X509;
using Org.BouncyCastle.Asn1;
using Org.BouncyCastle.Asn1.Pkcs;
using Org.BouncyCastle.Asn1.X509;
using Org.BouncyCastle.Utilities;

using Ensign.Cryptography;
using Ensign.Structures.Cryptography;
using Ensign.Structures.X509Certificates;
using System.Buffers.Text;
using System.Runtime.Serialization;

using Ensign.Structures.X509Certificates;

namespace Ensign.X509.Generators;

partial class X509CertificateGenerator : X509CertificateBuilder {
protected List _X509CertificatesChain = new List();
protected Org.BouncyCastle.X509.X509Certificate _X509Certificate;
protected Pkcs12Store _Pkcs12Store;
protected readonly X509V3CertificateGenerator _CertificateGenerator = new X509V3CertificateGenerator();
protected int _KeyUsages = 0;
protected List _ExtendedKeyUsages = new List();

protected SubjectKeyIdentifier _SubjectKeyIdentifier;
protected AuthorityKeyIdentifier _AuthorityKeyIdentifier;

protected Asn1SignatureFactory _SignatureFactory;

public X509CertificateGenerator() { }
public X509CertificateGenerator(Certificate certificate) : base(certificate) { }
}

partial class X509CertificateGenerator : X509CertificateBuilder {
public X509CertificateGenerator AddToCertificateChain(Org.BouncyCastle.X509.X509Certificate x509Certificate) {
_X509CertificatesChain.Add(x509Certificate);
return this;
}
public new X509CertificateGenerator WithKeyPair(KeyPair keyPair) {
base.WithKeyPair(keyPair);
_SignatureFactory = new Asn1SignatureFactory(keyPair.Algorithm, keyPair.Private);
_CertificateGenerator.SetPublicKey(keyPair.Public);
return this;
}

public X509CertificateGenerator WithPublicKey(AsymmetricKeyParameter publicKey) {
_CertificateGenerator.SetPublicKey(publicKey);
return this;
}

public X509CertificateGenerator WithCertificateAuthoritySignature(Org.BouncyCastle.X509.X509Certificate x509Certificate) {
DisallowIssuerReassignment();
Issuer = RelativeDistinguishedName.Parse(x509Certificate.SubjectDN.ToString());

if (_AuthorityKeyIdentifier is not null)
throw new InvalidOperationException($"{nameof(_AuthorityKeyIdentifier)} already set. " +
"There is already a certificate authority signature signed for this certificate.");

// _CertificateGenerator.SetPublicKey(x509Certificate.GetPublicKey());

_AuthorityKeyIdentifier = new AuthorityKeyIdentifier(
SubjectPublicKeyInfoFactory.CreateSubjectPublicKeyInfo(x509Certificate.GetPublicKey()),
new GeneralNames(new GeneralName(x509Certificate.SubjectDN)),
x509Certificate.SerialNumber
);

_X509CertificatesChain.Add(x509Certificate);

// TODO: accept a X509Name object in RelativeDistinguishedName
return this;
}
}

partial class X509CertificateGenerator : X509CertificateBuilder {

public Org.BouncyCastle.X509.X509Certificate Build() {
if (_X509Certificate is not null)
throw new InvalidOperationException($"{nameof(_X509Certificate)} already built.");
if (Subject is null)
throw new MissingFieldException($"{nameof(Subject)} is missing. " +
$"Call {nameof(SetSubject)} first.");
if (Issuer is null)
throw new MissingFieldException($"{nameof(Issuer)} is missing. " +
$"Call {nameof(SetIssuer)} first.");
if (SerialNumber is null)
throw new MissingFieldException($"{nameof(SerialNumber)} is missing. " +
$"Call {nameof(SetSerialNumber)} first.");
if (_CipherKeyPair is null)
throw new MissingFieldException($"{nameof(_CipherKeyPair)} is missing. " +
$"Call {nameof(WithKeyPair)} first.");
if (_SignatureFactory is null)
throw new MissingFieldException($"{nameof(_SignatureFactory)} is missing. " +
$"Call {nameof(WithKeyPair)} first.");
if (_Password is null)
throw new MissingFieldException($"{nameof(_Password)} is missing. " +
$"Call {nameof(UsePassword)} first.");
if (_SecureRandom is null)
throw new MissingFieldException($"{nameof(_SecureRandom)} is missing. " +
$"Call {nameof(WithSecureRandom)} first.");
if (_SignatureFactory is null) // NOTE: this code is unreachable
throw new MissingFieldException($"{nameof(_SignatureFactory)} is missing. " +
$"Call {nameof(WithKeyPair)} first.");
if (_KeyUsages == 0)
throw new MissingFieldException($"{nameof(_KeyUsages)} is missing. " +
$"Assign some key usage.");

_SubjectKeyIdentifier = new SubjectKeyIdentifier(
SubjectPublicKeyInfoFactory.CreateSubjectPublicKeyInfo(PublicKey)
);

_CertificateGenerator.SetSubjectDN(new X509Name(Subject.ToString()));
_CertificateGenerator.SetIssuerDN(new X509Name(Issuer.ToString()));
_CertificateGenerator.SetNotBefore(InvalidBefore);
_CertificateGenerator.SetNotAfter(InvalidAfter);
_CertificateGenerator.SetSerialNumber(SerialNumber);

if (_KeyUsages > 0) { _CertificateGenerator.AddExtension(X509Extensions.KeyUsage, true, new KeyUsage(_KeyUsages)); }
if (_ExtendedKeyUsages.Count > 0) {
_CertificateGenerator.AddExtension(X509Extensions.ExtendedKeyUsage, true, new ExtendedKeyUsage(_ExtendedKeyUsages));
}
_CertificateGenerator.AddExtension(X509Extensions.SubjectKeyIdentifier, false, _SubjectKeyIdentifier);
_CertificateGenerator.AddExtension(X509Extensions.AuthorityKeyIdentifier.Id, false, _AuthorityKeyIdentifier);

_X509Certificate = _CertificateGenerator.Generate(_SignatureFactory);
_X509CertificatesChain.Add(_X509Certificate);

return _X509Certificate;
}

public X509Certificate2 Generate() {
if (_X509Certificate2 is not null)
throw new InvalidOperationException($"{nameof(_X509Certificate2)} already built.");
if (_X509Certificate is null) // TODO: convert to warning
throw new MissingFieldException($"{nameof(_X509Certificate)} not built. " +
$"Call {nameof(Build)} first.");

// _X509Certificate.CheckValidity(DateTime.Now);
// _X509Certificate.Verify(PublicKey);

_Pkcs12Store = new Pkcs12StoreBuilder().Build();
X509CertificateEntry[] x509CertificateEntries = new X509CertificateEntry[_X509CertificatesChain.Count];
AsymmetricKeyEntry asymmetricKeyEntry = new AsymmetricKeyEntry(_CipherKeyPair.Private);

for (int i = _X509CertificatesChain.Count - 1; i >= 0; i--) {
x509CertificateEntries = new X509CertificateEntry(_X509CertificatesChain);
}

// for (int i = 0; i < _X509CertificatesChain.Count; i++) {
// x509CertificateEntries = new X509CertificateEntry(_X509CertificatesChain);
// }

_Pkcs12Store.SetKeyEntry(Subject.Name, asymmetricKeyEntry, x509CertificateEntries);

using (MemoryStream memoryStream = new MemoryStream()) {
_Pkcs12Store.Save(memoryStream, _Password.ToCharArray(), _SecureRandom);
_X509Certificate2 = new X509Certificate2(memoryStream.ToArray(), _Password, X509KeyStorageFlags.Exportable);
}
return _X509Certificate2;
}

public Org.BouncyCastle.X509.X509Certificate GetCertificateBuild() {
if (_X509Certificate is null)
throw new MissingFieldException($"{nameof(_X509Certificate)} not built. " +
$"Call {nameof(Build)} first.");
return _X509Certificate;
}

public X509Certificate2 GetCertificate() {
if (_X509Certificate2 is null)
throw new MissingFieldException($"{nameof(_X509Certificate2)} not built. " +
$"Call {nameof(Generate)} first.");
return _X509Certificate2;
}

public Certificate GetCertificateInstance() {
if (_X509Certificate2 is null)
throw new MissingFieldException($"{nameof(_X509Certificate2)} not built. " +
$"Call {nameof(Generate)} first.");
return this;
}

}


Подробнее здесь: https://stackoverflow.com/questions/792 ... y-castle-c