在 C# 中，如何创建无效的 X509Chain？

Question

X509ChainStatusFlags 枚举包含很多可能的值：https://docs.microsoft.com/en-us/dotnet/api/system.security.cryptography.x509certificates.x509chainstatusflags?view=netframework-4.8

是否有简单的方法来构建生成其中一些标志的证书和链？我想构建它们以便集成测试我的证书验证逻辑。

Answer 1

每种不同类型的故障需要不同数量的工作来测试。有些很容易，有些需要付出巨大的努力。

最简单：错误代码 1：X509ChainStatusFlags.NotTimeValid.

X509Certificate2 cert = ...;
X509Chain chain = new X509Chain();
chain.ChainPolicy.VerificationTime = cert.NotBefore.AddSeconds(-1);
bool valid = chain.Build();
// valid is false, and the 0 element will have NotTimeValid as one of the reasons.

下一个：X509ChainStatusFlags.NotValidSignature.

X509Certificate2 cert = ...;
byte[] certBytes = cert.RawData;
// flip all the bits in the last byte
certBytes[certBytes.Length - 1] ^= 0xFF;
X509Certificate2 badCert = new X509Certificate2(certBytes);
chain.ChainPolicy.ApplicationPolicy.Add(new Oid("0.0", null));
bool valid = chain.Build();
// valid is false. On macOS this results in PartialChain,
// on Windows and Linux it reports NotValidSignature in element 0

下一个：X509ChainStatusFlags.NotValidForUsage.

X509Certificate2 cert = ...;
X509Chain chain = new X509Chain();
chain.ChainPolicy.ApplicationPolicy.Add(new Oid("0.0", null));
bool valid = chain.Build();
// valid is false if the certificate has an EKU extension,
// since it shouldn't contain the 0.0 OID.
// and the 0 element will report NotValidForUsage.

一些更复杂的需要错误地构建证书链，例如使子证书具有 NotBefore/NotAfter 而不是位于 CA 的 NotBefore/NotAfter 中。 https://github.com/dotnet/runtime/blob/4f9ae42d861fcb4be2fcd5d3d55d5f227d30e723/src/libraries/System.Security.Cryptography.X509Certificates/tests/DynamicChainTests.cs and/or https://github.com/dotnet/runtime/blob/4f9ae42d861fcb4be2fcd5d3d55d5f227d30e723/src/libraries/System.Security.Cryptography.X509Certificates/tests/RevocationTests/DynamicRevocationTests.cs.

测试了其中一些英勇的努力

在 C# 中，如何创建无效的 X509Chain？

In C#, how do I create an invalid X509Chain?

integration-testing

x509certificate2

x509