MVC中的客户端证书颁发者（指纹）

Question

在MVC应用程序中，我需要验证客户端证书是否由特定CA签名/发布。

我知道如何从中获取Request.ClientCertificate和X509Certificate2，但我无法弄清楚如何检查发卡行。
Request.ClientCertificate.Issuer给出了发行人的主题，但我认为这不够安全。

我希望能够检查发行人指纹，那么如何从客户端证书中检索它？

Answer 1

// get the X509 from HTTP client certificate
var x509 = new X509Certificate2(this.Request.ClientCertificate.Certificate);

// create the certificate chain by using the machine store
var chain = new X509Chain(true);
chain.ChainPolicy.RevocationMode = X509RevocationMode.Offline;
chain.Build(x509);

// at this point chain.ChainElements[0] will contain the original
// certificate, the higher indexes are the issuers.
// note that if the certificate is self-signed, there will be just one entry.
var issuer = chain.ChainElements[1].Certificate.Thumbprint;