10

I've been pouring through article after article on x509 cert creation, signing, etc. but I've yet to find a solution to my problem - wondering if anyone can point me in the right direction because I'm thoroughly confused at this point. Here's what I'm trying to do:

For the client app:

  1. Generate a public/private keypair
  2. Grab the keys as byte[] and store them on the file system.
  3. Generate an x509 certificate
  4. Generate a signing request

For the server app:

  1. Generate a public/private keypair
  2. Grab the keys as byte[] and store them on the file system.
  3. Create a self-signed X509 certificate
  4. Sign client certificates
  5. Validate client certificates as being signed by self-signed cert in #3 above.

I need to do this all programmatically in .Net and without external .exe's like makecert.exe or openssl.exe - I need to use an in-process library, etc.

I have bits and pieces worked out using various libs like Bouncy Castle, .Net Crypto, openssl, etc. - but I always hit a roadblock either with lack of documention or not being able to get to the keypairs as byte[] so I can persist them, etc. Either I'm making this a lot harder than it is, or there's a severe lack of documentation out there - or both.

I figure someone has to have done this before and I'd really appreciate some help - I'm open to any and all suggestions - thanks!

.. and PKIBlackbox isn't an option - it costs too much :(

2

2 Answers 2

3

You can use the Bouncycastle C# library. Documentation is not good, but I believe it is not too difficult to work with. You can first go to the Javadocs for the java version of the library; the java and C# version are very similar. Secondly, look at the source code, as it is relatively easy to read.

The class you want is Org.BouncyCastle.X509.X509V3CertificateGenerator. There are some java examples out there on the net that you can use as a guide to creating a C# version. Here is one simple straightforward one.

Finally, Bouncycastle has a very useful class Org.BouncyCastle.Security.DotNetUtilities that helps to map between Bouncycastle objects and .NET objects. One such pair of methods are ToX509Certificate() and FromX509Certificate(). Also, note that the .NET X509Certificate class has Import() and Export() methods.

Together these should be sufficient to allow you to solve your problem.

0

I have done X.509 certificate creation and storing into the windows keystore. Other than makecert there is very little good documentation available and makecert is not a viable option under most circumstances. I found the pluralsight APIs very helpful as they support certificate generation as well as storage of the certificate into the windows key store. There is virtually no documentation (of course) but if you search for it you will find some blogs that show how to use it. Here are some links.

http://www.pluralsight-training.net/community/blogs/keith/archive/2009/01/22/create-self-signed-x-509-certificates-in-a-flash-with-self-cert.aspx

http://mikehadlow.blogspot.com/2010/02/creating-x509-certificates-with.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.