调用 Org.BouncyCastle.Security.DotNetUtilities.GetKeyPair 时 C#“密钥集不存在”答案

【问题标题】：C# "Keyset does not exist" when call Org.BouncyCastle.Security.DotNetUtilities.GetKeyPair调用 Org.BouncyCastle.Security.DotNetUtilities.GetKeyPair 时 C#“密钥集不存在”
【发布时间】：2020-06-24 08:59:25
【问题描述】：

我在 C# windows 窗体中创建了一个测试项目，并集成了获取文档并使用证书对其进行签名的方法，但是当我调用 DotNetUtils.GetKeyPair() 时它返回 "Keyset 没有存在”。我发现我必须将证书“安装”为“可导出”，但是没有办法不删除并重新导入证书吗？有什么办法让它在我现在的情况下工作？这是我的代码：

private byte[] SignDocumentWithCertificate(byte[] myPdf, X509Certificate2 myCertificate)
        {
            PdfReader reader = new PdfReader(myPdf);
            using (MemoryStream msOutput = new MemoryStream())
            {
                PdfStamper stamper = PdfStamper.CreateSignature(reader, msOutput, '\0');

                PdfSignatureAppearance sap = stamper.SignatureAppearance;

                sap.Reason = "Documento firmato con certificato '" + myCertificate.FriendlyName.ToString() + "' .";
                sap.Location = "Italy";

                X509Certificate2 signatureCert = new X509Certificate2(myCertificate);

                var pk = DotNetUtils.GetKeyPair(signatureCert.PrivateKey).Private; //NON FUNZIONA, VA IN EXCEPTION

                BcX509.X509Certificate bcCert = DotNetUtils.FromX509Certificate(signatureCert);
                var chain = new List<BcX509.X509Certificate> { bcCert };

                IExternalSignature signature = new PrivateKeySignature(pk, "SHA-256");

                MakeSignature.SignDetached(sap, signature, chain, null, null, null, 0, CryptoStandard.CMS);

                return msOutput.ToArray();
            }
        }

【问题讨论】：

证书可以存放在用户临时存储（IE设置）区域，程序运行时可以提取密钥。但必须在浏览器 IE 设置中手动添加一次或通过应用程序添加一次。
当您从X509Certificate2 开始时，您是否考虑过使用X509Certificate2Signature 类而不是PrivateKeySignature 类？您只需使用您的 X509Certificate2 实例和所需的哈希算法对其进行实例化，而无需提取密钥。但请注意，X509Certificate2Signature 仅支持 DSA 和 RSA。

标签： c# itext x509certificate bouncycastle x509certificate2

【解决方案1】：

@mkl 最后根据你的建议，我用这段代码搜索并解决了：

private byte[] SignDocumentWithCertificate_VCertificate(byte[] myPdf, X509Certificate2 myCertificate)
{
    using (MemoryStream msOutput = new MemoryStream())
    {
        PdfReader Reader = new PdfReader(myPdf);
        PdfStamper Stamper = PdfStamper.CreateSignature(Reader, msOutput, '\0');
        PdfSignatureAppearance SAP = Stamper.SignatureAppearance;
        BcX509.X509Certificate BouncyCertificate = DotNetUtils.FromX509Certificate(myCertificate);
        var chain = new List<BcX509.X509Certificate> { BouncyCertificate };

        IExternalSignature ES = new X509Certificate2Signature(myCertificate, DigestAlgorithms.SHA1);
        MakeSignature.SignDetached(SAP, ES, chain, null, null, null, 0, CryptoStandard.CMS);
        Stamper.Close();
        Reader.Close();
        return msOutput.ToArray();
    }
}

我使用证书而不是私钥签署了文档。非常感谢。

【讨论】：