Question

我有一些守则需要与X509证书资料合作。我下载了一个样本:

const string CertWithoutPrivateKey = "MII....";
const string CertWithPrivateKey = "MII...";

public static SecurityToken GetSigningToken(bool includePrivateKey)
{
    X509Certificate2 cert = null;
    if (includePrivateKey)
    {
        cert = new X509Certificate2(
            Convert.FromBase64String(CertWithPrivateKey), 
            "pw", X509KeyStorageFlags.PersistKeySet);
    }
    else
    {
        cert = new X509Certificate2(
            Convert.FromBase64String(CertWithoutPrivateKey));
    }
    return cert;
}

该法典需要能够与私人钥匙接触。 2. Saml2Authentication 模块(从《SAML2.0议定书》的WIF延伸到)依靠这一私人钥匙来解脱从SAML识别供应商发送的加密信息。

我不知道证书或加密,但在我看来,将证书硬化为一类并不可靠。

www.un.org/Depts/DGACM/index_spanish.htm 因此,我的法典应如何把ert子与私人钥匙重新联系起来? Afaik,这部法律只是一个时间来评估启动(很可能也是在回收池之后)。

我可以:

Store the cert as an appSetting in config file. As long as appSettings are config encrypted, is this secure?
Store the cert in a database.
Store the cert as a file in bin/App_Data. Afaik this means it could not be read over the web, but would be in plain view to anyone who can access the host server. Imo if someone can get into my server, letting them read this cert is probably the least of my worries.

是否有任何其他选择? 本案最合适些什么?

Answer 1

我不敢肯定世界投资论坛是如何做到的(你可能利用反光镜来了解它如何与证书库互动的内部),但正如你在国际投资协议的主办申请中使用世界投资论坛一样。如果是, WIF应当照顾到您的所有证书互动。你必须保证:

The identity model configuration section set up with references to the thumbprint of the certificate you are using to either encrypt or verify the digital signature of the token.

The certificate needs to be registered in IIS

The application pool s hosting identity needs to have permission to "read" the certificate to extract the private key information (see the accepted answer here)

Answer 2

具有私人钥匙或没有私人钥匙的证书可节省到用户或计算机的X509储存。这已经建立了“视窗”安全,应当足够。您可以使用证书的<代码>mmc,在储存和管理证书上添加证书。

例如,提及证书,其名称或thumbnail,可以保存到公交档案中,并用于检索证书。检索情况如下:

public static X509Certificate2 GetCertificate(string name)
{
    try
    {
        X509Store store = new X509Store (StoreLocation.LocalMachine);
        X509Certificate2Collection collection = store.Certificates;
        foreach (X509Certificate2 x509 in collection)
        {
            if (x509.FriendlyName.Equals(name)) 
            {
                return x509;
            }
        }
    }
    finally
    {
        store.Close();
    }
    return null;
}

使用<代码>Find进行收集是另一个(更清洁的)查询证书的方法。

友情链接