kpyk/vendor/alipaysdk/easysdk/kernel/csharp/EasySDKKernel/Kernel/Util/AntCertificationUtil.cs

using System.Collections.Generic;
using System;
using Org.BouncyCastle.X509;
using Org.BouncyCastle.Asn1.X509;
using Org.BouncyCastle.Crypto;
using System.Security.Cryptography;
using System.Text;
using System.Linq;

namespace Alipay.EasySDK.Kernel.Util
{
    /// <summary>
    /// 证书相关工具类
    /// </summary>
    public static class AntCertificationUtil
    {
        /// <summary>
        /// 提取根证书序列号
        /// </summary>
        /// <param name="rootCertContent">根证书文本</param>
        /// <returns>根证书序列号</returns>
        public static string GetRootCertSN(string rootCertContent)
        {
            string rootCertSN = "";
            try
            {
                List<X509Certificate> x509Certificates = ReadPemCertChain(rootCertContent);
                foreach (X509Certificate cert in x509Certificates)
                {
                    //只提取与指定算法类型匹配的证书的序列号
                    if (cert.SigAlgOid.StartsWith("1.2.840.113549.1.1", StringComparison.Ordinal))
                    {
                        string certSN = GetCertSN(cert);
                        if (string.IsNullOrEmpty(rootCertSN))
                        {
                            rootCertSN = certSN;
                        }
                        else
                        {
                            rootCertSN = rootCertSN + "_" + certSN;
                        }
                    }
                }
            }
            catch (Exception ex)
            {
                throw new Exception("提取根证书序列号失败。" + ex.Message);
            }
            return rootCertSN;
        }

        /// <summary>
        /// 反序列化证书文本
        /// </summary>
        /// <param name="certContent">证书文本</param>
        /// <returns>X509Certificate证书对象</returns>
        public static X509Certificate ParseCert(string certContent)
        {
            return new X509CertificateParser().ReadCertificate(Encoding.UTF8.GetBytes(certContent));
        }

        /// <summary>
        /// 计算指定证书的序列号
        /// </summary>
        /// <param name="cert">证书</param>
        /// <returns>序列号</returns>
        public static string GetCertSN(X509Certificate cert)
        {
            string issuerDN = cert.IssuerDN.ToString();
            //提取出的证书的issuerDN本身是以CN开头的，则无需逆序，直接返回
            if (issuerDN.StartsWith("CN", StringComparison.Ordinal))
            {
                return CalculateMd5(issuerDN + cert.SerialNumber);
            }
            List<string> attributes = issuerDN.Split(',').ToList();
            attributes.Reverse();
            return CalculateMd5(string.Join(",", attributes.ToArray()) + cert.SerialNumber);
        }

        /// <summary>
        /// 校验证书链是否可信
        /// </summary>
        /// <param name="certContent">需要验证的目标证书或者证书链文本</param>
        /// <param name="rootCertContent">可信根证书列表文本</param>
        /// <returns>true：证书可信；false：证书不可信</returns>
        public static bool IsTrusted(string certContent, string rootCertContent)
        {
            List<X509Certificate> certs = ReadPemCertChain(certContent);
            List<X509Certificate> rootCerts = ReadPemCertChain(rootCertContent);
            return VerifyCertChain(certs, rootCerts);
        }

        /// <summary>
        /// 从证书链文本反序列化证书链集合
        /// </summary>
        /// <param name="cert">证书链文本</param>
        /// <returns>证书链集合</returns>
        private static List<X509Certificate> ReadPemCertChain(string cert)
        {
            System.Collections.ICollection collection = new X509CertificateParser().ReadCertificates(Encoding.UTF8.GetBytes(cert));
            List<X509Certificate> result = new List<X509Certificate>();
            foreach (var each in collection)
            {
                result.Add((X509Certificate)each);
            }
            return result;
        }

        /// <summary>
        /// 将证书链按照完整的签发顺序进行排序，排序后证书链为：[issuerA, subjectA]-[issuerA, subjectB]-[issuerB, subjectC]-[issuerC, subjectD]...
        /// </summary>
        /// <param name="certChain">未排序的证书链</param>
        /// <returns>true：排序成功；false：证书链不完整</returns>
        private static bool SortCertChain(List<X509Certificate> certChain)
        {
            //主题和证书的映射
            Dictionary<X509Name, X509Certificate> subject2CertMap = new Dictionary<X509Name, X509Certificate>();
            //签发者和证书的映射
            Dictionary<X509Name, X509Certificate> issuer2CertMap = new Dictionary<X509Name, X509Certificate>();
            //是否包含自签名证书
            bool hasSelfSignedCert = false;
            foreach (X509Certificate cert in certChain)
            {
                if (IsSelfSigned(cert))
                {
                    if (hasSelfSignedCert)
                    {
                        //同一条证书链中只能有一个自签名证书
                        return false;
                    }
                    hasSelfSignedCert = true;
                }
                subject2CertMap[cert.SubjectDN] = cert;
                issuer2CertMap[cert.IssuerDN] = cert;
            }

            List<X509Certificate> orderedCertChain = new List<X509Certificate>();

            X509Certificate current = certChain[0];

            AddressingUp(subject2CertMap, orderedCertChain, current);
            AddressingDown(issuer2CertMap, orderedCertChain, current);

            //说明证书链不完整
            if (certChain.Count != orderedCertChain.Count)
            {
                return false;
            }

            //用排序后的结果覆盖传入的证书链集合
            for (int i = 0; i < orderedCertChain.Count; i++)
            {
                certChain[i] = orderedCertChain[i];
            }
            return true;
        }

        private static bool IsSelfSigned(X509Certificate cert)
        {
            return cert.SubjectDN.Equivalent(cert.IssuerDN);
        }

        /// <summary>
        /// 向上构造证书链
        /// </summary>
        /// <param name="subject2CertMap">主题与证书的映射</param>
        /// <param name="orderedCertChain">储存排序后的证书链集合</param>
        /// <param name="current">当前需要插入排序后的证书链集合中的证书</param>
        private static void AddressingUp(Dictionary<X509Name, X509Certificate> subject2CertMap,
            List<X509Certificate> orderedCertChain, X509Certificate current)
        {
            orderedCertChain.Insert(0, current);
            if (IsSelfSigned(current))
            {
                return;
            }

            if (!subject2CertMap.ContainsKey(current.IssuerDN))
            {
                return;
            }

            X509Certificate issuer = subject2CertMap[current.IssuerDN];
            AddressingUp(subject2CertMap, orderedCertChain, issuer);
        }

        /// <summary>
        /// 向下构造证书链
        /// </summary>
        /// <param name="issuer2CertMap">签发者和证书的映射</param>
        /// <param name="certChain">储存排序后的证书链集合</param>
        /// <param name="current">当前需要插入排序后的证书链集合中的证书</param>
        private static void AddressingDown(Dictionary<X509Name, X509Certificate> issuer2CertMap,
            List<X509Certificate> certChain, X509Certificate current)
        {
            if (!issuer2CertMap.ContainsKey(current.SubjectDN))
            {
                return;
            }

            X509Certificate subject = issuer2CertMap[current.SubjectDN];
            if (IsSelfSigned(subject))
            {
                return;
            }
            certChain.Add(subject);
            AddressingDown(issuer2CertMap, certChain, subject);
        }

        /// <summary>
        /// 验证证书是否是信任证书库中的证书签发的
        /// </summary>
        /// <param name="cert">待验证证书</param>
        /// <param name="rootCerts">可信根证书列表</param>
        /// <returns>true：验证通过；false：验证不通过</returns>
        private static bool VerifyCert(X509Certificate cert, List<X509Certificate> rootCerts)
        {
            if (!cert.IsValidNow)
            {
                return false;
            }

            Dictionary<X509Name, X509Certificate> subject2CertMap = new Dictionary<X509Name, X509Certificate>();
            foreach (X509Certificate root in rootCerts)
            {
                subject2CertMap[root.SubjectDN] = root;
            }

            X509Name issuerDN = cert.IssuerDN;
            if (!subject2CertMap.ContainsKey(issuerDN))
            {
                return false;
            }

            X509Certificate issuer = subject2CertMap[issuerDN];
            try
            {
                AsymmetricKeyParameter publicKey = issuer.GetPublicKey();
                cert.Verify(publicKey);
            }
            catch (Exception ex)
            {
                Console.WriteLine("证书验证出现异常。" + ex.Message);
                return false;
            }
            return true;
        }

        /// <summary>
        /// 验证证书列表
        /// </summary>
        /// <param name="certs">待验证的证书列表</param>
        /// <param name="rootCerts">可信根证书列表</param>
        /// <returns>true：验证通过；false：验证不通过</returns>
        private static bool VerifyCertChain(List<X509Certificate> certs, List<X509Certificate> rootCerts)
        {
            //证书列表排序，形成排序后的证书链
            bool sorted = SortCertChain(certs);
            if (!sorted)
            {
                //不是完整的证书链
                return false;
            }

            //先验证第一个证书是不是信任库中证书签发的
            X509Certificate previous = certs[0];
            bool firstOK = VerifyCert(previous, rootCerts);
            if (!firstOK || certs.Count == 1)
            {
                return firstOK;
            }

            //验证证书链
            for (int i = 1; i < certs.Count; i++)
            {
                try
                {
                    X509Certificate cert = certs[i];
                    if (!cert.IsValidNow)
                    {
                        return false;
                    }

                    //用上级证书的公钥验证本证书是否是上级证书签发的
                    cert.Verify(previous.GetPublicKey());

                    previous = cert;
                }
                catch (Exception ex)
                {
                    //证书链验证失败
                    Console.WriteLine("证书链验证失败。" + ex.Message);
                    return false;
                }
            }

            return true;
        }


        private static string CalculateMd5(string input)
        {
            using (MD5 md5 = new MD5CryptoServiceProvider())
            {
                string result = "";
                byte[] bytes = md5.ComputeHash(Encoding.GetEncoding("utf-8").GetBytes(input));
                for (int i = 0; i < bytes.Length; i++)
                {
                    result += bytes[i].ToString("x2");
                }
                return result;
            }
        }

        /// <summary>
        /// 从证书中提取公钥并转换为PEM编码
        /// </summary>
        /// <param name="input">证书</param>
        /// <returns>PEM编码公钥</returns>
        public static string ExtractPemPublicKeyFromCert(X509Certificate input)
        {
            SubjectPublicKeyInfo subjectPublicKeyInfo = SubjectPublicKeyInfoFactory.CreateSubjectPublicKeyInfo(input.GetPublicKey());
            return Convert.ToBase64String(subjectPublicKeyInfo.GetDerEncoded());
        }
    }
}