如何以编程方式设置X509Certificate2的个人识别码？

Question

我每天都需要向send服务发送数据，所以我制定了一个计划任务来运行我的代码。问题是with服务需要一个带有PIN码的证书。我已经附上了证书，但我找不到一种方法来设置它的个人识别码，因此它显示弹出每次手动输入它。

下面是我的证书代码：

private void SendData(string data)
    {
        using (SerWSService webService = new SerWSService())
        {
            string certificateSN = "serial number for the certificate";
            webService.ClientCertificates.Add(FindCertificate(certificateSN));

            webService.SendData(data);
        }
    }

private X509Certificate2 FindCertificate(string certserial)
    {
        X509Certificate2 WPE_UserCert = null;
        X509Store wstore = default(X509Store);
        wstore = new X509Store(StoreName.My, StoreLocation.CurrentUser);
        wstore.Open(OpenFlags.ReadOnly);
        var wcerts = wstore.Certificates;
        foreach (var wcert in wcerts)
        {
            if (wcert.SerialNumber.ToUpper() == certserial.Replace(" ", "").ToUpper())
            {
                WPE_UserCert = wcert;
                break;
            }
        }
        wstore.Close();

        if (WPE_UserCert != null)
        {
            //TO DO: add PIN code to certificate

        }

        return WPE_UserCert;
    }

有什么方法可以将PIN设置为证书吗？

Answer 1

不，因为证书没有PIN；(私有)密钥有。

如果你正在寻找一个具有私钥的证书，并且你将该证书传递给一个需要统一密钥对的类(例如SslStream，HttpClient)，那么就没有真正/好的解决方案了。

如果您自己使用私钥，则有一些回旋余地：

using (RSA rsa = cert.GetRSAPrivateKey())
{
    RSACng rsaCng = rsa as RSACng;
    RSACryptoServiceProvider rsaCsp = rsa as RSACryptoServiceProvider;

    if (rsaCng != null)
    {
        // Set the PIN, an explicit null terminator is required to this Unicode/UCS-2 string.

        byte[] propertyBytes;

        if (pin[pin.Length - 1] == '\0')
        {
            propertyBytes = Encoding.Unicode.GetBytes(pin);
        }
        else
        {
            propertyBytes = new byte[Encoding.Unicode.GetByteCount(pin) + 2];
            Encoding.Unicode.GetBytes(pin, 0, pin.Length, propertyBytes, 0);
        }

        const string NCRYPT_PIN_PROPERTY = "SmartCardPin";

        CngProperty pinProperty = new CngProperty(
            NCRYPT_PIN_PROPERTY,
            propertyBytes,
            CngPropertyOptions.None);

        rsaCng.Key.SetProperty(pinProperty);
    }
    else if (rsaCsp != null)
    {
        // This is possible, but painful.
        // Copy out the CspKeyContainerInfo data into a new CspParameters,
        // build the KeyPassword value on CspParameters,
        // Dispose() the existing instance,
        // and open a new one to replace it.
        //
        // But if you really called GetRSAPrivateKey() and it has returned an RSACng for
        // your device once, it pretty much will forever (until the next
        // new RSA type for Windows is invented... at which point it still
        // won't return an RSACryptoServiceProvider).
    }
    else
    {
        // No other built-in RSA types support setting a PIN programmatically.
    }

    // Use the key here.
    // If you needed to return it, don't put it in a using :)
}

Answer 2

对于CSP私钥，使用CryptAcquireCertificatePrivateKey获取PIN句柄，然后使用CryptSetProvParam(h,PP_SIGNATURE_PIN,pin,0)设置CryptoProv。