C# X509CertificateCollection.Remove方法代码示例

        public static void X509CertificateCollectionRemove()
        {
            using (X509Certificate2 c1 = new X509Certificate2())
            using (X509Certificate2 c2 = new X509Certificate2(TestData.PfxData, TestData.PfxDataPassword))
            {
                X509CertificateCollection cc = new X509CertificateCollection(new X509Certificate[] { c1, c2 });

                cc.Remove(c1);
                Assert.Equal(1, cc.Count);
                Assert.Same(c2, cc[0]);

                cc.Remove(c2);
                Assert.Equal(0, cc.Count);

                Assert.Throws<ArgumentException>(() => cc.Remove(c2));

                IList il = new X509CertificateCollection(new X509Certificate[] { c1, c2 });

                il.Remove(c1);
                Assert.Equal(1, il.Count);
                Assert.Same(c2, il[0]);

                il.Remove(c2);
                Assert.Equal(0, il.Count);

                Assert.Throws<ArgumentException>(() => il.Remove(c2));
            }
        }

        public static void X509CertificateCollectionThrowsArgumentNullException()
        {
            using (X509Certificate certificate = new X509Certificate())
            {
                Assert.Throws<ArgumentNullException>(() => new X509CertificateCollection((X509Certificate[])null));
                Assert.Throws<ArgumentNullException>(() => new X509CertificateCollection((X509CertificateCollection)null));

                X509CertificateCollection collection = new X509CertificateCollection { certificate };

                Assert.Throws<ArgumentNullException>(() => collection[0] = null);
                Assert.Throws<ArgumentNullException>(() => collection.Add(null));
                Assert.Throws<ArgumentNullException>(() => collection.AddRange((X509Certificate[])null));
                Assert.Throws<ArgumentNullException>(() => collection.AddRange((X509CertificateCollection)null));
                Assert.Throws<ArgumentNullException>(() => collection.CopyTo(null, 0));
                Assert.Throws<ArgumentNullException>(() => collection.Insert(0, null));
                Assert.Throws<ArgumentNullException>(() => collection.Remove(null));

                IList ilist = (IList)collection;
                Assert.Throws<ArgumentNullException>(() => ilist[0] = null);
                Assert.Throws<ArgumentNullException>(() => ilist.Add(null));
                Assert.Throws<ArgumentNullException>(() => ilist.CopyTo(null, 0));
                Assert.Throws<ArgumentNullException>(() => ilist.Insert(0, null));
                Assert.Throws<ArgumentNullException>(() => ilist.Remove(null));
            }

            Assert.Throws<ArgumentNullException>(() => new X509CertificateCollection.X509CertificateEnumerator(null));
        }

		void LocalValidation (ClientContext context, AlertDescription description)
		{
			// the leaf is the web server certificate
			X509Certificate leaf = certificates [0];
			X509Cert.X509Certificate cert = new X509Cert.X509Certificate (leaf.RawData);

			ArrayList errors = new ArrayList();

			// SSL specific check - not all certificates can be 
			// used to server-side SSL some rules applies after 
			// all ;-)
			if (!checkCertificateUsage (leaf)) 
			{
				// WinError.h CERT_E_PURPOSE 0x800B0106
				errors.Add ((int)-2146762490);
			}

			// SSL specific check - does the certificate match 
			// the host ?
			if (!checkServerIdentity (leaf))
			{
				// WinError.h CERT_E_CN_NO_MATCH 0x800B010F
				errors.Add ((int)-2146762481);
			}

			// Note: building and verifying a chain can take much time
			// so we do it last (letting simple things fails first)

			// Note: In TLS the certificates MUST be in order (and
			// optionally include the root certificate) so we're not
			// building the chain using LoadCertificate (it's faster)

			// Note: IIS doesn't seem to send the whole certificate chain
			// but only the server certificate :-( it's assuming that you
			// already have this chain installed on your computer. duh!
			// http://groups.google.ca/groups?q=IIS+server+certificate+chain&hl=en&lr=&ie=UTF-8&oe=UTF-8&selm=85058s%24avd%241%40nnrp1.deja.com&rnum=3

			// we must remove the leaf certificate from the chain
			X509CertificateCollection chain = new X509CertificateCollection (certificates);
			chain.Remove (leaf);
			X509Chain verify = new X509Chain (chain);

			bool result = false;

			try
			{
				result = verify.Build (leaf);
			}
			catch (Exception)
			{
				result = false;
			}

			if (!result) 
			{
				switch (verify.Status) 
				{
					case X509ChainStatusFlags.InvalidBasicConstraints:
						// WinError.h TRUST_E_BASIC_CONSTRAINTS 0x80096019
						errors.Add ((int)-2146869223);
						break;
					
					case X509ChainStatusFlags.NotSignatureValid:
						// WinError.h TRUST_E_BAD_DIGEST 0x80096010
						errors.Add ((int)-2146869232);
						break;
					
					case X509ChainStatusFlags.NotTimeNested:
						// WinError.h CERT_E_VALIDITYPERIODNESTING 0x800B0102
						errors.Add ((int)-2146762494);
						break;
					
					case X509ChainStatusFlags.NotTimeValid:
						// WinError.h CERT_E_EXPIRED 0x800B0101
						description = AlertDescription.CertificateExpired;
						errors.Add ((int)-2146762495);
						break;
					
					case X509ChainStatusFlags.PartialChain:
						// WinError.h CERT_E_CHAINING 0x800B010A
						description = AlertDescription.UnknownCA;
						errors.Add ((int)-2146762486);
						break;
					
					case X509ChainStatusFlags.UntrustedRoot:
						// WinError.h CERT_E_UNTRUSTEDROOT 0x800B0109
						description = AlertDescription.UnknownCA;
						errors.Add ((int)-2146762487);
						break;
					
					default:
						// unknown error
						description = AlertDescription.CertificateUnknown;
						errors.Add ((int)verify.Status);
						break;
				}
			}

			int[] certificateErrors = (int[])errors.ToArray(typeof(int));

//.........这里部分代码省略.........

		private void validateCertificates (X509CertificateCollection certificates)
		{
			ServerContext context = (ServerContext)this.Context;
			AlertDescription description = AlertDescription.BadCertificate;
			SSCX.X509Certificate client = null;
			int[] certificateErrors = null;

			// note: certificate may be null is no certificate is sent
			// (e.g. optional mutual authentication)
			if (certificates.Count > 0) {
				X509Certificate leaf = certificates[0];
			
				ArrayList errors = new ArrayList ();

				// SSL specific check - not all certificates can be 
				// used to server-side SSL some rules applies after 
				// all ;-)
				if (!checkCertificateUsage (leaf))
				{
					// WinError.h CERT_E_PURPOSE 0x800B0106
					errors.Add ((int)-2146762490);
				}

				X509Chain verify;
				// was a chain supplied ? if so use it, if not
				if (certificates.Count > 1) {
					// if so use it (and don't build our own)
					X509CertificateCollection chain = new X509CertificateCollection (certificates);
					chain.Remove (leaf);
					verify = new X509Chain (chain);
				} else {
					// if not, then let's build our own (based on what's available in the stores)
					verify = new X509Chain ();
				}

				bool result = false;

				try
				{
					result = verify.Build (leaf);
				}
				catch (Exception)
				{
					result = false;
				}

				if (!result)
				{
					switch (verify.Status)
					{
						case X509ChainStatusFlags.InvalidBasicConstraints:
							// WinError.h TRUST_E_BASIC_CONSTRAINTS 0x80096019
							errors.Add ((int)-2146869223);
							break;

						case X509ChainStatusFlags.NotSignatureValid:
							// WinError.h TRUST_E_BAD_DIGEST 0x80096010
							errors.Add ((int)-2146869232);
							break;

						case X509ChainStatusFlags.NotTimeNested:
							// WinError.h CERT_E_VALIDITYPERIODNESTING 0x800B0102
							errors.Add ((int)-2146762494);
							break;

						case X509ChainStatusFlags.NotTimeValid:
							// WinError.h CERT_E_EXPIRED 0x800B0101
							description = AlertDescription.CertificateExpired;
							errors.Add ((int)-2146762495);
							break;

						case X509ChainStatusFlags.PartialChain:
							// WinError.h CERT_E_CHAINING 0x800B010A
							description = AlertDescription.UnknownCA;
							errors.Add ((int)-2146762486);
							break;

						case X509ChainStatusFlags.UntrustedRoot:
							// WinError.h CERT_E_UNTRUSTEDROOT 0x800B0109
							description = AlertDescription.UnknownCA;
							errors.Add ((int)-2146762487);
							break;

						default:
							// unknown error
							description = AlertDescription.CertificateUnknown;
							errors.Add ((int)verify.Status);
							break;
					}
				}
				client = new SSCX.X509Certificate (leaf.RawData);
				certificateErrors = (int[])errors.ToArray (typeof (int));
			}
			else
			{
				certificateErrors = new int[0];
			}

			SSCX.X509CertificateCollection certCollection = new SSCX.X509CertificateCollection ();
			foreach (X509Certificate certificate in certificates) {
//.........这里部分代码省略.........

		private void validateCertificates(X509CertificateCollection certificates)
		{
			ClientContext		context			= (ClientContext)this.Context;
			AlertDescription	description		= AlertDescription.BadCertificate;

#if NET_2_0
			if (context.SslStream.HaveRemoteValidation2Callback) {
				if (context.SslStream.RaiseServerCertificateValidation2 (certificates))
					return;
				// Give a chance to the 1.x ICertificatePolicy callback
			}
#endif
			// the leaf is the web server certificate
			X509Certificate leaf = certificates [0];
			X509Cert.X509Certificate cert = new X509Cert.X509Certificate (leaf.RawData);

			ArrayList errors = new ArrayList();

			// SSL specific check - not all certificates can be 
			// used to server-side SSL some rules applies after 
			// all ;-)
			if (!checkCertificateUsage (leaf)) 
			{
				// WinError.h CERT_E_PURPOSE 0x800B0106
				errors.Add ((int)-2146762490);
			}

			// SSL specific check - does the certificate match 
			// the host ?
			if (!checkServerIdentity (leaf))
			{
				// WinError.h CERT_E_CN_NO_MATCH 0x800B010F
				errors.Add ((int)-2146762481);
			}

			// Note: building and verifying a chain can take much time
			// so we do it last (letting simple things fails first)

			// Note: In TLS the certificates MUST be in order (and
			// optionally include the root certificate) so we're not
			// building the chain using LoadCertificate (it's faster)

			// Note: IIS doesn't seem to send the whole certificate chain
			// but only the server certificate :-( it's assuming that you
			// already have this chain installed on your computer. duh!
			// http://groups.google.ca/groups?q=IIS+server+certificate+chain&hl=en&lr=&ie=UTF-8&oe=UTF-8&selm=85058s%24avd%241%40nnrp1.deja.com&rnum=3

			// we must remove the leaf certificate from the chain
			X509CertificateCollection chain = new X509CertificateCollection (certificates);
			chain.Remove (leaf);
			X509Chain verify = new X509Chain (chain);

			bool result = false;

			try
			{
				result = verify.Build (leaf);
			}
			catch (Exception)
			{
				result = false;
			}

			// Attempt to use OSX certificates
			//
			// Ideally we should return the SecTrustResult
#if !MONOTOUCH
			if (System.IO.File.Exists (OSX509Certificates.SecurityLibrary)){
#endif
				OSX509Certificates.SecTrustResult trustResult =  OSX509Certificates.TrustEvaluateSsl (certificates);

				// We could use the other values of trustResult to pass this extra information to the .NET 2 callback
				// for values like SecTrustResult.Confirm
				result = (trustResult == OSX509Certificates.SecTrustResult.Proceed ||
					  trustResult == OSX509Certificates.SecTrustResult.Unspecified);
#if !MONOTOUCH
			}
#endif
			
			if (!result) 
			{
				switch (verify.Status) 
				{
					case X509ChainStatusFlags.InvalidBasicConstraints:
						// WinError.h TRUST_E_BASIC_CONSTRAINTS 0x80096019
						errors.Add ((int)-2146869223);
						break;
					
					case X509ChainStatusFlags.NotSignatureValid:
						// WinError.h TRUST_E_BAD_DIGEST 0x80096010
						errors.Add ((int)-2146869232);
						break;
					
					case X509ChainStatusFlags.NotTimeNested:
						// WinError.h CERT_E_VALIDITYPERIODNESTING 0x800B0102
						errors.Add ((int)-2146762494);
						break;
					
					case X509ChainStatusFlags.NotTimeValid:
						// WinError.h CERT_E_EXPIRED 0x800B0101
//.........这里部分代码省略.........

        public static void X509CertificateCollectionAsIListBogusEntry()
        {
            using (X509Certificate2 c = new X509Certificate2())
            {
                IList il = new X509CertificateCollection();
                il.Add(c);

                string bogus = "Bogus";

                Assert.Throws<ArgumentException>(() => il[0] = bogus);
                Assert.Throws<ArgumentException>(() => il.Add(bogus));
                Assert.Throws<ArgumentException>(() => il.Remove(bogus));
                Assert.Throws<ArgumentException>(() => il.Insert(0, bogus));
            }
        }