Bouncycastle在C#的證書處理

Bouncy Castle是一個流行的加密庫，提供了許多加密算法和密碼學功能。在C#中，你可以使用Bouncy Castle來處理證書，例如驗證證書、創建證書簽名請求（CSR）或生成自簽名證書等。

要在C#中使用Bouncy Castle，首先需要將其添加到項目中。你可以通過NuGet包管理器安裝Bouncy Castle庫。在Visual Studio中，右鍵單擊項目，選擇“管理NuGet程序包”，然后搜索并安裝“BouncyCastle”包。

以下是一些使用Bouncy Castle處理證書的示例：

1. 驗證證書：

using System;
using System.Security.Cryptography.X509Certificates;
using BouncyCastle.Crypto.Parameters;
using BouncyCastle.X509;

public bool ValidateCertificate(string certificatePath, string certificatePassword)
{
    var certStore = new X509Store(StoreName.Root, StoreLocation.LocalMachine);
    certStore.Open(OpenFlags.ReadOnly);
    var cert = certStore.FindCertificateBySubjectName(new X509Name("CN=" + certificateSubject));
    certStore.Close();

    if (cert == null)
        return false;

    var certBytes = cert.Export(X509ContentType.Pfx);
    var certParams = new Pkcs12Parameters(Convert.FromBase64String(certificatePassword), certBytes);
    var certDecryptor = new Pkcs12SafeBagDecryptor(certParams);
    var cert = (X509Certificate2)certDecryptor.Decrypt(certBytes);

    return cert.Verify();
}

2. 創建證書簽名請求（CSR）：

using System;
using System.Security.Cryptography.X509Certificates;
using BouncyCastle.Crypto.Parameters;
using BouncyCastle.X509;

public X509Certificate2 CreateCsr(string subjectName, string privateKeyPassword)
{
    var keyPair = GenerateKeyPair();
    var subjectPublicKeyInfo = new SubjectPublicKeyInfo(keyPair.Public);
    var certRequest = new X509CertificateRequest("CN=" + subjectName, subjectPublicKeyInfo, keyPair.Private);

    var certBuilder = new X509v3CertificateBuilder(
        certRequest.Issuer,
        new BigInteger(DateTime.UtcNow.Ticks),
        DateTime.UtcNow,
        DateTime.UtcNow.AddYears(1),
        new DerSequence(new DerInteger(0)),
        subjectPublicKeyInfo);

    var signatureAlgorithm = new AlgorithmIdentifier("SHA256WithRSA", null);
    var signature = keyPair.Private.Sign(certBuilder, signatureAlgorithm);

    var certBytes = certBuilder.Build(signature);
    return new X509Certificate2(certBytes, privateKeyPassword);
}

3. 生成自簽名證書：

using System;
using System.Security.Cryptography.X509Certificates;
using BouncyCastle.Crypto.Parameters;
using BouncyCastle.X509;

public X509Certificate2 GenerateSelfSignedCertificate(string subjectName, string privateKeyPassword)
{
    var keyPair = GenerateKeyPair();
    var subjectPublicKeyInfo = new SubjectPublicKeyInfo(keyPair.Public);
    var certBuilder = new X509v3CertificateBuilder(
        new X509Name("CN=" + subjectName),
        new BigInteger(DateTime.UtcNow.Ticks),
        DateTime.UtcNow,
        DateTime.UtcNow.AddYears(1),
        new DerSequence(new DerInteger(0)),
        subjectPublicKeyInfo);

    var signatureAlgorithm = new AlgorithmIdentifier("SHA256WithRSA", null);
    var signature = keyPair.Private.Sign(certBuilder, signatureAlgorithm);

    var certBytes = certBuilder.Build(signature);
    return new X509Certificate2(certBytes, privateKeyPassword);
}

注意：這些示例中的GenerateKeyPair方法需要你自己實現，用于生成RSA密鑰對。你可以使用Bouncy Castle的RsaKeyPairGenerator類來生成密鑰對。