Question

我正在尝试创建智能卡证书并将其添加回Yubikey（我正在使用Yubico的Mini驱动程序，因此yubikey的行为类似于智能卡，无法使用其PIVManager或YKMan）。我可以使用以下代码用yubikey成功签署CSR：

certificateRequest.CertRequest = new CX509CertificateRequestPkcs10();
certificateRequest.CertRequest.Initialize(X509CertificateEnrollmentContext.ContextUser);
certificateRequest.CertRequest.PrivateKey.ExportPolicy = X509PrivateKeyExportFlags.XCN_NCRYPT_ALLOW_EXPORT_NONE;
certificateRequest.CertRequest.PrivateKey.Length = 2048;
certificateRequest.CertRequest.PrivateKey.ProviderName = "Microsoft Smart Card Key Storage Provider";
certificateRequest.CertRequest.PrivateKey.KeyUsage = X509PrivateKeyUsageFlags.XCN_NCRYPT_ALLOW_SIGNING_FLAG;
certificateRequest.CertRequest.PrivateKey.KeySpec = X509KeySpec.XCN_AT_NONE;
certificateRequest.CertRequest.PrivateKey.MachineContext = false;
var subjectEncoded = new CX500DistinguishedNameClass();
subjectEncoded.Encode(certificateRequest.SubjectName);
certificateRequest.CertRequest.Subject = subjectEncoded;
certificateRequest.CertRequest.Encode();
certificateRequest.CSR = certificateRequest.CertRequest.RawData[EncodingType.XCN_CRYPT_STRING_BASE64REQUESTHEADER];

然后我去CA并取回证书。当我尝试将证书添加回Yubikey时，出现以下错误：

CertEnroll :: CX509Enrollment :: InstallResponse：无法找到对象或属性。 0x80092004（-2146885628 CRYPT_E_NOT_FOUND）

根据我在google上的发现，这意味着系统无法找到用于签署证书的私钥。我正在使用初始化容器的请求，但仍然找不到它是由智能卡完成的，下面是供参考的代码：

CX509Enrollment objEnroll = new CX509EnrollmentClass();
objEnroll.InitializeFromRequest(certificateRequest.CertRequest);
objEnroll.InstallResponse(
    InstallResponseRestrictionFlags.AllowUntrustedRoot,
    certificateRequest.StringCert,
    EncodingType.XCN_CRYPT_STRING_BASE64,
    null
);

有没有办法告诉窗口在YubiKey中查找私钥？

Answer 1

我错过了实际创建私钥的请求，这里的请求是新的完整代码：

certificateRequest.CertRequest = new CX509CertificateRequestPkcs10();
certificateRequest.CertRequest.Initialize(X509CertificateEnrollmentContext.ContextUser);
certificateRequest.CertRequest.PrivateKey.ExportPolicy = X509PrivateKeyExportFlags.XCN_NCRYPT_ALLOW_EXPORT_NONE;
certificateRequest.CertRequest.PrivateKey.Length = 2048;
certificateRequest.CertRequest.PrivateKey.ProviderName = "Microsoft Smart Card Key Storage Provider";
certificateRequest.CertRequest.PrivateKey.KeyUsage = X509PrivateKeyUsageFlags.XCN_NCRYPT_ALLOW_SIGNING_FLAG;
certificateRequest.CertRequest.PrivateKey.KeySpec = X509KeySpec.XCN_AT_NONE;
certificateRequest.CertRequest.PrivateKey.MachineContext = false;
certificateRequest.CertRequest.PrivateKey.Create();
var subjectEncoded = new CX500DistinguishedNameClass();
subjectEncoded.Encode(certificateRequest.SubjectName);
certificateRequest.CertRequest.Subject = subjectEncoded;
certificateRequest.CertRequest.Encode();
certificateRequest.CSR = certificateRequest.CertRequest.RawData[EncodingType.XCN_CRYPT_STRING_BASE64REQUESTHEADER];

然后我去CA并取回证书。当我尝试将证书添加回Yubikey时：

CX509Enrollment objEnroll = new CX509EnrollmentClass();
objEnroll.InitializeFromRequest(certificateRequest.CertRequest);
objEnroll.CreateRequest(EncodingType.XCN_CRYPT_STRING_BASE64);
objEnroll.InstallResponse(
    InstallResponseRestrictionFlags.AllowUntrustedRoot,
    certificateRequest.StringCert,
    EncodingType.XCN_CRYPT_STRING_BASE64,
    null
);

无法将智能卡证书添加到Yubikey

1 个答案: