SignedXml生成无效签名

Question

我一直在尝试让.NET中的XMLDSIG支持正确运行，更具体地说是SignedXml类。我正在实现一个第三方服务，他们最近刚刚开始要求所有消息都必须经过数字签名……

我的问题是，我似乎不能生成有效的签名。第三方服务和我找到的在线签名验证器都报告签名无效。验证服务(http://www.aleksey.com/xmlsec/xmldsig-verifier.html)报告摘要和数据之间存在不匹配，到目前为止，我还无法找出我做错了什么。

这是相关的代码--希望有人能发现我的错误；

public static XDocument SignDocument(XDocument originalDocument, X509Certificate2 certificate)
{
    var document = new XmlDocument();
    document.LoadXml(originalDocument.ToString(SaveOptions.DisableFormatting));
    if (document.DocumentElement == null)
        throw new InvalidOperationException("Invalid XML document; no root element found.");

    var signedDocument = new SignedXml(document);
    Reference signatureReference = GetSignatureReference();
    KeyInfo certificateKeyInfo = GetCertificateKeyInfo(certificate);
    var dataObject = new DataObject("", "text/xml", "utf-8", document.DocumentElement);

    signedDocument.AddReference(signatureReference);
    signedDocument.AddObject(dataObject);
    signedDocument.SigningKey = certificate.PrivateKey;
    signedDocument.KeyInfo = certificateKeyInfo;
    signedDocument.ComputeSignature();

    return XDocument.Parse(signedDocument.GetXml().OuterXml, LoadOptions.PreserveWhitespace);
}


private static Reference GetSignatureReference()
{
    var signatureReference = new Reference("");
    signatureReference.AddTransform(new XmlDsigEnvelopedSignatureTransform());

    return signatureReference;
}


private static KeyInfo GetCertificateKeyInfo(X509Certificate certificate)
{
    var certificateKeyInfo = new KeyInfo();
    certificateKeyInfo.AddClause(new KeyInfoX509Data(certificate));

    return certificateKeyInfo;
}

Answer 1

如果有人感兴趣，我解决了这个问题，并把它写在我的博客上：http://thomasjo.com/blog/2009/08/04/xmldsig-in-the-net-framework.html