使用Pkcs10CertificationRequest获取主题备用名称 [英] Getting Subject Alternate Names with Pkcs10CertificationRequest
问题描述
除请求的扩展程序(特别是 X509v3使用者备用名称)外,我目前能够解码CSR的值。这是我的DecodeCSR(string csr)中
的相关部分:
public void DecodeCsr(string csrStr){
//只得到csr
var csrChars = Regex.Replace(csrStr,@ ----- [^-] + -----,).Trim()。Replace( ,).Replace(Environment.NewLine,).ToCharArray();
//将该字符串转换为字节数组
byte [] csrEncode = Convert.FromBase64CharArray(csrChars,0,csrChars.Length);
//将字节数组
赋予decodeCsr Pkcs10CertificationRequest encodeCsr = new Pkcs10CertificationRequest(csrEncode);
//获取一串主题信息
字符串subject = encodeCsr.GetCertificationRequestInfo()。Subject.ToString();
//这就是我如何获取属性
的DerSet DerSet atts =(DerSet)decodeCsr.GetCertificationRequestInfo()。Attributes;
}
以下是使用SAN的测试csr:
'pre>
串CSR =----- BEGIN CERTIFICATE REQUEST ----- MIIC1DCCAbwCAQAwXjELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB0dlb3JnaWExEDAOBgNVBAcMB0F0bGFudGExDTALBgNVBAoMBFRlc3QxHDAaBgNVBAMME3d3dy50aGlzaXNhdGVzdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDFU4pXLB3d8csjvRIkIdZfUF2m9sijtk1bqYohqVwYr3 + OyDRkfRuTCni8RJS9VOcl6n5aUiK27P4s5j9LqqfL0vS8B949P / ewb2ip2BGB1sEmxKcsEoZYNNEhMm9p7yNTAEqJ / WN0N1CpKBFV1J / w6xiQy5tUyUe7C9c8DX6K1uhEDF9pfeTaCNxYBShm0JFuAIqn6Z + RzbC7tdwc0KgN / bhx3bEvg8b0p / hgxd2veuUmB / fcIPsFawkGFPcQzLpSbc1Vb + zru40HAbRflyQckA3ZgRsa1OHsdiOyb8vpV7dUm4VHOm38bw2wVImRMfRtNZXrL / WiWcGadtFV8nxXAgMBAAGgMTAvBgkqhkiG9w0BCQ4xIjAgMB4GA1UdEQQXMBWCCHRlc3QuY29tggl0ZXN0Mi5jb20wDQYJKoZIhvcNAQELBQADggEBAKXxHlruiqtTwB1Ov17K + mz03EidfecdW + 9u8gcLdOOLKn5kCg6RuC0mCjGHvFGjE6ljFc5cyUFbfdqzd8QXh1f3AgxveR + oq1wExJNr0Yl6kjVEdtndvHhSzUmZZ02EcPbIq / eY5KSTdKidjvIJMwTUtIyUQ71y / vSVn0YavvXYo / re57kC7chW / NS / hZmHrZ6GvMWE9ea3P3jOKPyXCULJlbQCjXc6 CQJAkBlcKpvnW6kU2PjreDWzRMhzqZzUqhc6RsGzz84 / xwBsrYXfTj91FQd9 + w15CYzBEJOv / Iz3CfVGb4s1 + yUPVxgei2ezTjfQVcQgq4CusRNTE4;
我可以从 decodeCsr.GetCertificationRequestInfo()。Attributes获得的信息
是一个 Org.BouncyCastle.Asn1.DerSet
,看起来像这样:
DerSet atts =(DerSet)decodeCsr.GetCertificationRequestInfo()。Attributes;
这是在调试模式下的样子(下面是总体对象的图片):
atts {[[1.2.840.113549.1.9.14,[[[2.5.29.17,#3026820a61757374696e2e636f6d820b61757374696e322e636f6d820b61757374696e342e636f6d]]]]]}}] Org.BouncyCastle.Asn1.DerSet
我可以在调试模式下看到 DerOctetString
,但是我不知道该如何使用它。我相信,如果我能做到的话,Hugo的答案可能适用,那就是 DerOctetStringParser
,但目前我无能为力。
我尝试将 atts
当作字符串来删除,OID获得的值与<$ c完全相同$ c> DerOctetString 在调试模式下并将其强制转换为 DerOctetString
无效,而且我认为答案的伸缩性不好。
我使用以下代码进行了操作:
public static void DecodeCsr(string csr)
{
csr = Regex.Replace(csr,@ ----- [^-] + ----- ,String.Empty).Trim()。Replace(,).Replace(Environment.NewLine,);
PemObject pem = new PemObject( CSR,Convert.FromBase64String(csr));
Pkcs10CertificationRequest请求=新的Pkcs10CertificationRequest(pem.Content);
CertificationRequestInfo requestInfo = request.GetCertificationRequestInfo();
//属性是Sequence的集合,其中包含Asn1Object的集合
//让我们找到包含ID为 1.2.840.113549.1.9.14的DerObjectIdentifier的序列b $ b DerSequence extensionSequence = requestInfo.Attributes.OfType< DerSequence>()
.First(o => o.OfType< DerObjectIdentifier>()
.Any(oo => oo.Id = = 1.2.840.113549.1.9.14));
//让我们获取此序列的值集
DerSet extensionSet = extensionSequence.OfType< DerSet>()。First();
// estensionSet = [[2.5.29.17,#30158208746573742e636f6d820974657374322e636f6d]]]
// extensionSet包含嵌套序列...让我们使用递归方法
DerOctetString str = GetAsn1ObjectRecursive< DerOctetString>(extensionSet.OfType< DerSequence>()。First(), 2.5.29.17);
GeneralNames名称= GeneralNames.GetInstance(Asn1Object.FromByteArray(str.GetOctets()));
Console.WriteLine(names.ToString());
}
静态T GetAsn1ObjectRecursive< T>(DerSequence序列,字符串ID)其中T:Asn1Object
{
if(sequence.OfType< DerObjectIdentifier>()。 Any(o => o.Id == id))
{
返回序列.OfType< T>()。First();
}
foreach(顺序为DerSequence子序列。OfType< DerSequence>())
{
T值= GetAsn1ObjectRecursive< T>(subSequence,id);
if(value!= default(T))
{
返回值;
}
}
return default(T);
}
棘手的部分是 BouncyCastle 与集合兼容随处可见,请求的值位于嵌套的嵌套集合内。我使用递归函数,是因为我不确定您的CSR是否总是将此值嵌套。
I'm currently able to decode a CSR's values except for Requested Extensions, specifically X509v3 Subject Alternative Name
. Here's the relevant part of
my `DecodeCSR(string csr):
public void DecodeCsr(string csrStr){
//getting just csr
var csrChars = Regex.Replace(csrStr, @"-----[^-]+-----", "").Trim().Replace(" ", "").Replace(Environment.NewLine, "").ToCharArray();
//converting that string into a byte array
byte[] csrEncode = Convert.FromBase64CharArray(csrChars, 0, csrChars.Length);
//giving decodeCsr the byte array
Pkcs10CertificationRequest decodeCsr = new Pkcs10CertificationRequest(csrEncode);
//getting a string of subject information
string subject = decodeCsr.GetCertificationRequestInfo().Subject.ToString();
//here's how I'm getting a DerSet of attribute
DerSet atts = (DerSet)decodeCsr.GetCertificationRequestInfo().Attributes;
}
Here's a test csr with SANs:
string csr = "-----BEGIN CERTIFICATE REQUEST-----MIIC1DCCAbwCAQAwXjELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB0dlb3JnaWExEDAOBgNVBAcMB0F0bGFudGExDTALBgNVBAoMBFRlc3QxHDAaBgNVBAMME3d3dy50aGlzaXNhdGVzdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDFU4pXLB3d8csjvRIkIdZfUF2m9sijtk1bqYohqVwYr3+OyDRkfRuTCni8RJS9VOcl6n5aUiK27P4s5j9LqqfL0vS8B949P/ewb2ip2BGB1sEmxKcsEoZYNNEhMm9p7yNTAEqJ/WN0N1CpKBFV1J/w6xiQy5tUyUe7C9c8DX6K1uhEDF9pfeTaCNxYBShm0JFuAIqn6Z+RzbC7tdwc0KgN/bhx3bEvg8b0p/hgxd2veuUmB/fcIPsFawkGFPcQzLpSbc1Vb+zru40HAbRflyQckA3ZgRsa1OHsdiOyb8vpV7dUm4VHOm38bw2wVImRMfRtNZXrL/WiWcGadtFV8nxXAgMBAAGgMTAvBgkqhkiG9w0BCQ4xIjAgMB4GA1UdEQQXMBWCCHRlc3QuY29tggl0ZXN0Mi5jb20wDQYJKoZIhvcNAQELBQADggEBAKXxHlruiqtTwB1Ov17K+mz03EidfecdW+9u8gcLdOOLKn5kCg6RuC0mCjGHvFGjE6ljFc5cyUFbfdqzd8QXh1f3AgxveR+oq1wExJNr0Yl6kjVEdtndvHhSzUmZZ02EcPbIq/eY5KSTdKidjvIJMwTUtIyUQ71y/vSVn0YavvXYo/re57kC7chW/Ns/hZmHrZ6GvMWE9ea3P3jOKPyXCULJlbQCjXc6CQJAkBlcKpvnW6kU2PjreDWzRMhzqZzUqhc6RsGzz84/xwBsrYXfTj91FQd9+w15CYzBEJOv/Iz3CfVGb4s1+yUPVxgei2ezTjfQVcQgq4CusRnDU5/7lmE=-----END CERTIFICATE REQUEST-----";
The information I can get from decodeCsr.GetCertificationRequestInfo().Attributes
is an Org.BouncyCastle.Asn1.DerSet
that looks like this:
DerSet atts = (DerSet)decodeCsr.GetCertificationRequestInfo().Attributes;
This is what it looks like in debug mode(a picture of the overal object is below):
atts {[[1.2.840.113549.1.9.14, [[[2.5.29.17, #3026820a61757374696e2e636f6d820b61757374696e322e636f6d820b61757374696e342e636f6d]]]]]} Org.BouncyCastle.Asn1.DerSet
I can see the DerOctetString
in debug mode, however I have no idea how to get to it. I believe if i can get that far Hugo's answer may be applicable, there is a DerOctetStringParser
but at the moment I have nothing to give it.
I've tried to treat atts
as a string removed the OIDs get the value exactly like the DerOctetString
in debug mode and cast it as a DerOctetString
that didn't work, and I don't believe that answer scales well.
I made it work with the following code :
public static void DecodeCsr(string csr)
{
csr = Regex.Replace(csr, @"-----[^-]+-----", String.Empty).Trim().Replace(" ", "").Replace(Environment.NewLine, "");
PemObject pem = new PemObject("CSR", Convert.FromBase64String(csr));
Pkcs10CertificationRequest request = new Pkcs10CertificationRequest(pem.Content);
CertificationRequestInfo requestInfo = request.GetCertificationRequestInfo();
// an Attribute is a collection of Sequence which contains a collection of Asn1Object
// let's find the sequence that contains a DerObjectIdentifier with Id of "1.2.840.113549.1.9.14"
DerSequence extensionSequence = requestInfo.Attributes.OfType<DerSequence>()
.First(o => o.OfType<DerObjectIdentifier>()
.Any(oo => oo.Id == "1.2.840.113549.1.9.14"));
// let's get the set of value for this sequence
DerSet extensionSet = extensionSequence.OfType<DerSet>().First();
// estensionSet = [[2.5.29.17, #30158208746573742e636f6d820974657374322e636f6d]]]
// extensionSet contains nested sequence ... let's use a recursive method
DerOctetString str = GetAsn1ObjectRecursive<DerOctetString>(extensionSet.OfType<DerSequence>().First(), "2.5.29.17");
GeneralNames names = GeneralNames.GetInstance(Asn1Object.FromByteArray(str.GetOctets()));
Console.WriteLine(names.ToString());
}
static T GetAsn1ObjectRecursive<T>(DerSequence sequence, String id) where T : Asn1Object
{
if (sequence.OfType<DerObjectIdentifier>().Any(o => o.Id == id))
{
return sequence.OfType<T>().First();
}
foreach (DerSequence subSequence in sequence.OfType<DerSequence>())
{
T value = GetAsn1ObjectRecursive<T>(subSequence, id);
if (value != default(T))
{
return value;
}
}
return default(T);
}
The tricky part is that BouncyCastle works with collection everywhere and the requested value is inside a nested nested collection. I use a recursive function because I'm not sure if your CSR will always have this value as nested.
这篇关于使用Pkcs10CertificationRequest获取主题备用名称的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!