CertificateIssuer Class

Namespace: Rebex.Security.Cryptography.Pkcs

Assembly: Rebex.Common.dll (version 8.0.9673)

A utility class that features a certificate issuer functionality. This can be used as a base of simple custom certification authority.

Syntax

public class CertificateIssuer

Inheritance

Object

CertificateIssuer

Inherited Members

Object.Equals(Object)

Object.Equals(Object, Object)

Object.GetHashCode()

Object.GetType()

Object.MemberwiseClone()

Object.ReferenceEquals(Object, Object)

Object.ToString()

Examples

See https://www.rebex.net/security.net/features/certificates.aspx for more code snippets.

Following sample code can issue three kinds of certificates:

• Root Certification Authority:
  Specify issueRootCA = true and commonName like "My Root Authority #1".
• Self-signed Server certificate:
  Specify issueRootCA = false, isForServer = true and commonName like "myweb.com".
• Self-signed Client certificate:
  Specify issueRootCA = false, isForServer = false and commonName like "Name Surname".

Issuing self-signed certificates

// prepare certificate info
var info = new CertificateInfo();
info.SetSerialNumber(Guid.NewGuid().ToByteArray());
info.EffectiveDate = DateTime.Now.AddDays(-1);
info.ExpirationDate = info.EffectiveDate.AddYears(1);
info.Subject = new DistinguishedName($"CN={commonName}, E={email}");
info.SignatureHashAlgorithm = HashingAlgorithmId.SHA256;

// specify certificate usage
if (issueRootCA)
{
    // usage for CA certificate
    info.Usage = KeyUses.DigitalSignature | KeyUses.KeyCertSign | KeyUses.CrlSign;
}
else
{
    // usage for leaf certificate
    info.Usage = KeyUses.DigitalSignature | KeyUses.KeyEncipherment | KeyUses.DataEncipherment;

    // specify certificate extended usage
    if (isForServer)
    {
        // set SAN extension (CN typically equals to desired hostname)
        info.SetAlternativeHostnames(commonName);
        info.SetExtendedUsage(ExtendedUsageOids.ServerAuthentication);
    }
    else
    {
        info.MailAddress = email; // optionally set e-mail
        info.SetExtendedUsage(ExtendedUsageOids.ClientAuthentication,
                              ExtendedUsageOids.EmailProtection);
    }
}

// generate a 2048-bit RSA key for the certificate
PrivateKeyInfo privateKey;
using (var alg = new AsymmetricKeyAlgorithm())
{
    alg.GenerateKey(AsymmetricKeyAlgorithmId.RSA, 2048);
    privateKey = alg.GetPrivateKey();
}

// create the self-signed certificate and associate the private key with it
var certificate = CertificateIssuer.Issue(info, privateKey);
certificate.Associate(privateKey);

// save the certificate along with its private key to an encrypted PFX/P12 file
// (make sure to keep this in a secure location)
certificate.Save("cert.pfx", CertificateFormat.Pfx, "password");

// save the certificate (without the private key) to a file
certificate.Save("cert.cer", CertificateFormat.Base64Der);

Methods

Name	Description
Issue(Certificate, CertificateInfo, PublicKeyInfo)	Issues a certificate signed by the specified certification authority.
Issue(CertificateInfo, PrivateKeyInfo)	Issues a self-signed certificate.
IssueRevocationList(Certificate, SignatureHashAlgorithm, RevocationListInfo, IEnumerable)	Issues a certificate signed by the specified certification authority using the specified signature hash algorithm.