C# X509Certificate2.GetCertHash方法代码示例

        private static void AddHttpsBinding(Session session, string installPath, X509Certificate2 cert, string certExportPath)
        {
            using (var mgr = new ServerManager())
            {
                session.Log("Searching for site in IIS.");
                var site = mgr.Sites.FirstOrDefault(s => s.Applications.Any(app => app.VirtualDirectories.Any(x => AreSameDirectory(x.PhysicalPath, installPath))));
                if(site == null)
                {
                    session.Log("Site not found.  This could be caused by the presence of IIS Express.");
                    throw new Exception("Could not find site.  This could be caused by the presence of IIS Express.");
                }

                session.Log("Site found ({0}), checking for https bindings.", site.Name);

                var httpsBinding = site.Bindings.FirstOrDefault(x => x.Protocol == "https" && x.BindingInformation.StartsWith("*:443"));
                if (httpsBinding != null)
                {
                    session.Log("Binding already present ({0}), it will not be changed.", httpsBinding.BindingInformation);
                    session.Log("Certificate sha1 fingerprint={0};", ToHex(httpsBinding.CertificateHash));
                    ExportPublicKey(session, certExportPath, httpsBinding.CertificateHash, httpsBinding.CertificateStoreName);
                    return;
                }

                session.Log("Usable https binding was not found, adding new one.");
                var storeName = new X509Store(StoreName.My, StoreLocation.LocalMachine).Name;
                site.Bindings.Add("*:443:", cert.GetCertHash(), storeName);
                ExportPublicKey(session, certExportPath, cert.GetCertHash(), storeName);
                session.Log("Certificate sha1 fingerprint={0};", ToHex(cert.GetCertHash()));
                mgr.CommitChanges();
                session.Log("Binding added.");
            }
        }

        public ClaimsIdentity ProcessClientCertificate(X509Certificate2 cert, string ipAddress)
        {
            using (var per = PersistenceFactory())
            {
                var hash = cert.GetCertHash();
                var client = per.ClientGetByCertificateHash(hash);

                // not found? add to pending certificates list
                if (client == null)
                {
                    TraceSource.TraceInformation("Pending certificate:\n{0} ({1})", ByteArrayHelper.ByteArrayToString(hash), ipAddress);
                    per.PendingCertificateAddOrUpdate(hash, ipAddress);
                    per.Save();
                }

                // build identity
                var identity = new ClaimsIdentity("ClientAuthentication");
                identity.AddClaim(new Claim(CertificateHashClaimType, ByteArrayHelper.ByteArrayToString(hash), ClaimValueTypes.HexBinary, ClaimIssuer));
                identity.AddClaim(new Claim(IsKnownClaimType, client == null ? "false" : "true", ClaimValueTypes.Boolean, ClaimIssuer)); // known client?

                // add details only if authenticated
                if (client != null)
                {
                    identity.AddClaim(new Claim(identity.NameClaimType, client.Name, ClaimValueTypes.String, ClaimIssuer)); // nick name
                    identity.AddClaim(new Claim(ClientIdClaimType, client.Id.ToString(), ClaimValueTypes.Integer, ClaimIssuer)); // ID
                    identity.AddClaims(client.ClientGroups.Select(group => new Claim(identity.RoleClaimType, group.Id.ToString(), ClaimValueTypes.Integer, ClaimIssuer))); // assigned groups
                    identity.AddClaims(client.ClientGroups.Select(group => new Claim(RoleNameClaimType, group.Name, ClaimValueTypes.String, ClaimIssuer))); // assigned groups (names - informative)
                }

                return identity;
            }
        }

        public string GetX509CertificateThumbprint(ClientAssertionCertificate credential)
        {
            X509Certificate2 x509Certificate = new X509Certificate2(credential.Certificate, credential.Password);

            // Thumbprint should be url encoded
            return Base64UrlEncoder.Encode(x509Certificate.GetCertHash());            
        }

		public X509CertificateEndpointIdentity (X509Certificate2 cert)
		{
			if (cert == null)
				throw new ArgumentNullException ("cert");
			primary = cert;
			Initialize (Claim.CreateThumbprintClaim (cert.GetCertHash ()));
		}

        static byte[] GetHash(X509Certificate2 certificate)
        {
            if (certificate == null)
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("certificate");

            return certificate.GetCertHash();
        }

        internal X509CertificateEndpointIdentity(XmlDictionaryReader reader)
        {
            if (reader == null)
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("reader");

            reader.MoveToContent();
            if (reader.IsEmptyElement)
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new XmlException(SR.Format(SR.UnexpectedEmptyElementExpectingClaim, XD.AddressingDictionary.X509v3Certificate.Value, XD.AddressingDictionary.IdentityExtensionNamespace.Value)));

            reader.ReadStartElement(XD.XmlSignatureDictionary.X509Data, XD.XmlSignatureDictionary.Namespace);
            while (reader.IsStartElement(XD.XmlSignatureDictionary.X509Certificate, XD.XmlSignatureDictionary.Namespace))
            {
                reader.MoveToContent();
                X509Certificate2 certificate = new X509Certificate2(Convert.FromBase64String(reader.ReadContentAsString()));
                if (certificateCollection.Count == 0)
                {
                    // This is the first certificate. We assume this as the primary 
                    // certificate and initialize the base class.
                    Initialize(new Claim(ClaimTypes.Thumbprint, certificate.GetCertHash(), Rights.PossessProperty));
                }

                certificateCollection.Add(certificate);
            }

            reader.ReadEndElement();

            if (certificateCollection.Count == 0)
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new XmlException(SR.Format(SR.UnexpectedEmptyElementExpectingClaim, XD.AddressingDictionary.X509v3Certificate.Value, XD.AddressingDictionary.IdentityExtensionNamespace.Value)));
        }

        private IReadOnlyList<Certificate> GetCertificatesFromWinRTStore(X509Certificate2 dotNetCertificate)
        {
            var query = new CertificateQuery
            {
                Thumbprint = dotNetCertificate.GetCertHash(),
                IncludeDuplicates = false
            };

            return CertificateStores.FindAllAsync(query).AsTask().GetAwaiter().GetResult();
        }

		public bool Matches (X509Certificate2 certificate)
		{
			if (certificate == null)
				throw new ArgumentNullException ("certificate");
			byte [] b1 = GetRawBuffer ();
			byte [] b2 = certificate.GetCertHash ();
			if (b1.Length != b2.Length)
				return false;
			for (int i = 0; i < b1.Length; i++)
				if (b1 [i] != b2 [i])
					return false;
			return true;
		}

        public byte[] InstallCertificateWithPrivateKey(string certificatePath, string certificateStoreName, RSAParameters privateKey)
        {            
            var certificateBytes = File.ReadAllBytes(certificatePath);
            var x509 = new X509Certificate2(certificateBytes, (string)null, X509KeyStorageFlags.Exportable | X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.PersistKeySet);
            var csp = new CspParameters { KeyContainerName = x509.GetCertHashString(), Flags = CspProviderFlags.UseMachineKeyStore };
            var rsa = new RSACryptoServiceProvider(csp);
            rsa.ImportParameters(privateKey);
            x509.PrivateKey = rsa;

            Info($"Installing certificate private key to localmachine\\{certificateStoreName}, container name {csp.KeyContainerName}");

            InstallCertificateToStore(x509, certificateStoreName);
            return x509.GetCertHash();
        }

		public void CreateClaims ()
		{
			Claim c;

			// premises
			Assert.AreEqual ("http://schemas.xmlsoap.org/ws/2005/05/identity/right/identity", Rights.Identity, "#1");
			Assert.AreEqual ("http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty", Rights.PossessProperty, "#2");

			c = Claim.CreateDnsClaim ("123.45.6.7");
			AssertClaim ("Dns", c, ClaimTypes.Dns, "123.45.6.7", Rights.PossessProperty);

			Uri uri = new Uri ("http://www.mono-project.com");
			c = Claim.CreateUriClaim (uri);
			AssertClaim ("Uri", c, ClaimTypes.Uri, uri, Rights.PossessProperty);

			MailAddress mail = new MailAddress ("[email protected]");
			c = Claim.CreateMailAddressClaim (mail);
			AssertClaim ("Mail", c, ClaimTypes.Email, mail, Rights.PossessProperty);

			c = Claim.CreateNameClaim ("Rupert");
			AssertClaim ("Name", c, ClaimTypes.Name, "Rupert", Rights.PossessProperty);

			c = Claim.CreateSpnClaim ("foo");
			AssertClaim ("Spn", c, ClaimTypes.Spn, "foo", Rights.PossessProperty);

			c = Claim.CreateUpnClaim ("foo");
			AssertClaim ("Upn", c, ClaimTypes.Upn, "foo", Rights.PossessProperty);

			//SecurityIdentifier sid = new SecurityIdentifier (blah);
			//c = Claim.CreateWindowsSidClaim (sid);
			//AssertClaim ("Sid", c, ClaimTypes.Sid, blah, Rights.PossessProperty);

			byte [] hash = new byte [] {1, 2, 3, 4, 5, 6, 7, 8, 9};
			c = Claim.CreateHashClaim (hash);
			AssertClaim ("Hash", c, ClaimTypes.Hash, hash, Rights.PossessProperty);

			RSA rsa = RSA.Create ();
			c = Claim.CreateRsaClaim (rsa);
			AssertClaim ("Rsa", c, ClaimTypes.Rsa, rsa, Rights.PossessProperty);

			X509Certificate2 cert = new X509Certificate2 ("Test/Resources/test.pfx", "mono");
			byte [] chash = cert.GetCertHash ();
			c = Claim.CreateThumbprintClaim (chash);
			AssertClaim ("Thumbprint", c, ClaimTypes.Thumbprint, chash, Rights.PossessProperty);

			c = Claim.CreateX500DistinguishedNameClaim (cert.SubjectName);
			AssertClaim ("X500Name", c, ClaimTypes.X500DistinguishedName, cert.SubjectName, Rights.PossessProperty);
		}

        private static bool StoreContainsCertificate(string storeName, X509Certificate2 certificate)
        {
            var store = new X509Store(storeName, StoreLocation.LocalMachine);

            try
            {
                store.Open(OpenFlags.ReadOnly);
                var result =
                    store.Certificates.OfType<X509Certificate2>().Any(x => x.GetCertHash() == certificate.GetCertHash());
                return result;
            }
            finally
            {
                store.Close();
            }
        }

		public X509CertificateClaimSet (X509Certificate2 certificate)
		{
			if (certificate == null)
				throw new ArgumentNullException ("certificate");
			this.cert = certificate;
			Claim ident = new Claim (ClaimTypes.Thumbprint, cert.Thumbprint, Rights.Identity);
//			issuer = new X509IdentityClaimSet (ident);
			claims.Add (ident);
			//claims.Add (Claim.CreateX500DistinguishedNameClaim (cert.SubjectName));
			//claims.Add (Claim.CreateNameClaim (cert.SubjectName.Name));
			RSA rsa = cert.PublicKey.Key as RSA;
			if (rsa != null)
				claims.Add (Claim.CreateRsaClaim (rsa));
			claims.Add (Claim.CreateThumbprintClaim (cert.GetCertHash ()));
			// FIXME: where is DNS info for X509 cert?
			claims.Add (Claim.CreateDnsClaim (null));
		}

 private static IEnumerable<Claim> ExtractClaims(X509Certificate2 cert, string issuer)
 {
     var claims = new Collection<Claim>
     {
         new Claim(ClaimTypes.Thumbprint,Convert.ToBase64String(cert.GetCertHash()),
             ClaimValueTypes.Base64Binary, issuer),
         new Claim(ClaimTypes.X500DistinguishedName, cert.SubjectName.Name, 
             ClaimValueTypes.String, issuer),
         new Claim(ClaimTypes.SerialNumber, cert.SerialNumber, 
             ClaimValueTypes.String, issuer),
         new Claim(ClaimTypes.AuthenticationMethod, X509AuthnMethod,
             ClaimValueTypes.String, issuer)
     };
     var email = cert.GetNameInfo(X509NameType.EmailName, false);
     if (email != null)
     {
         claims.Add(new Claim(ClaimTypes.Email, email, ClaimValueTypes.String, issuer));
     }
     return claims;
 }

        protected override void ProcessRecord()
        {
            if (!System.IO.Path.IsPathRooted(CertPath))
            {
                CertPath = System.IO.Path.Combine(SessionState.Path.CurrentFileSystemLocation.Path, CertPath);
            }
            var cert = new X509Certificate2(CertPath);

            var rawCert = cert.GetRawCertData();

            var base64Cert = Convert.ToBase64String(rawCert);

            var rawCertHash = cert.GetCertHash();

            var base64CertHash = Convert.ToBase64String(rawCertHash);

            var keyId = Guid.NewGuid().ToString();

            var output = string.Format("\"keyCredentials\": [\n\t{{\n\t\t\"customKeyIdentifier\": \"{0}\",\n\t\t\"keyId\": \"{1}\",\n\t\t\"type\": \"AsymmetricX509Cert\",\n\t\t\"usage\": \"Verify\",\n\t\t\"value\": \"{2}\"\n\t}}\n],", base64CertHash, keyId, base64Cert);

            WriteObject(output);
        }

        public override void Install(Target target, string pfxFilename, X509Store store, X509Certificate2 certificate)
        {
            using (var iisManager = new ServerManager())
            {
                var site = GetSite(target, iisManager);
                var existingBinding = (from b in site.Bindings where b.Host == target.Host && b.Protocol == "https" select b).FirstOrDefault();
                if (existingBinding != null)
                {
                    Console.WriteLine($" Updating Existing https Binding");
                    existingBinding.CertificateHash = certificate.GetCertHash();
                    existingBinding.CertificateStoreName = store.Name;
                }
                else
                {
                    Console.WriteLine($" Adding https Binding");
                    var iisBinding = site.Bindings.Add(":443:" + target.Host, certificate.GetCertHash(), store.Name);
                    iisBinding.Protocol = "https";
                }

                Console.WriteLine($" Commiting binding changes to IIS");
                iisManager.CommitChanges();
            }
        }