Question

我想以编程方式将计算机上所有我的软件证书分别导出到 .pfx 文件中，以对已经在另一台PC上进行最终构建的2个新软件进行签名。

为此，我找到了一个C ++代码示例（在我翻译成Delphi之后）。

我的Delphi版本仍然没有经过测试，但是即使如此，我仍然认为效果很好。

program CertToPFX;

{$APPTYPE CONSOLE}
{$R *.res}

uses
  Windows,
  WinCrypt,
  Classes,
  SysUtils;

var
  CertContext: PCCERT_CONTEXT;
  CertPropId: DWORD;
  Data: array [0 .. 511] of Char;
  DataLen: DWORD;

procedure DisplayCertContext(Cert: PCertContext);
var
  CertName: array [0 .. 255] of Char;
begin
  if CertGetNameString(CertContext, CERT_NAME_EMAIL_TYPE, 0, nil, CertName,
    256) = 0 then
    RaiseLastOSError;
  Writeln('Subject CERT_NAME_EMAIL_TYPE: ', CertName);
  if CertGetNameString(CertContext, CERT_NAME_SIMPLE_DISPLAY_TYPE, 0, nil,
    CertName, 256) = 0 then
    RaiseLastOSError;
  Writeln('Subject CERT_NAME_SIMPLE_DISPLAY_TYPE: ', CertName);
  if CertGetNameString(CertContext, CERT_NAME_FRIENDLY_DISPLAY_TYPE, 0, nil,
    CertName, 256) = 0 then
    RaiseLastOSError;
  Writeln('Subject CERT_NAME_FRIENDLY_DISPLAY_TYPE: ', CertName);

  if CertGetNameString(CertContext, CERT_NAME_EMAIL_TYPE, CERT_NAME_ISSUER_FLAG,
    nil, CertName, 256) = 0 then
    RaiseLastOSError;
  Writeln('Issuer CERT_NAME_EMAIL_TYPE: ', CertName);
  if CertGetNameString(CertContext, CERT_NAME_SIMPLE_DISPLAY_TYPE,
    CERT_NAME_ISSUER_FLAG, nil, CertName, 256) = 0 then
    RaiseLastOSError;
  Writeln('Issuer CERT_NAME_SIMPLE_DISPLAY_TYPE: ', CertName);
  if CertGetNameString(CertContext, CERT_NAME_FRIENDLY_DISPLAY_TYPE,
    CERT_NAME_ISSUER_FLAG, nil, CertName, 256) = 0 then
    RaiseLastOSError;
  Writeln('Issuer CERT_NAME_FRIENDLY_DISPLAY_TYPE: ', CertName);
end;

procedure ExportCertToPFX(NameStore, Password: string);
var
  TmpPFX: CRYPT_DATA_BLOB;
  hStore: HCERTSTORE;
  Mem: TMemoryStream;
  i, J: Integer;
begin
  hStore := CertOpenSystemStore(0, PChar(NameStore));
  if (hStore = nil) then
    RaiseLastOSError;
  Mem := TMemoryStream.Create;
  J := 0;
  try
    try
      CertContext := CertEnumCertificatesInStore(hStore, nil);
      while (CertContext <> nil) do
      begin
        DisplayCertContext(CertContext);
        CertPropId := CertEnumCertificateContextProperties(CertContext, 0);
        while CertPropId <> 0 do
        begin
          DataLen := 512;
          case CertPropId of
            CERT_KEY_PROV_HANDLE_PROP_ID:
              begin
                CertGetCertificateContextProperty(CertContext, CertPropId,
                  @Data[0], DataLen);
                Writeln(Format('KEY_PROV_HANDLE: $%.8x', [PDWORD(@Data[0])^]));
              end;
            CERT_KEY_PROV_INFO_PROP_ID:
              begin
                CertGetCertificateContextProperty(CertContext, CertPropId,
                  @Data[0], DataLen);
                with PCryptKeyProvInfo(@Data[0])^ do
                begin
                  Writeln(Format('pwszContainerName = %s',
                    [pwszContainerName]));
                  Writeln(Format('pwszProvName = %s', [pwszProvName]));
                  Writeln(Format('dwFlags = %d', [dwFlags]));
                  Writeln(Format('cProvParams = %d', [cProvParam]));
                  Writeln(Format('dwKeySpec = %d', [dwKeySpec]));
                end;
                Writeln(Format('KEY_PROV_INFO: %d', [@Data[0]]));
              end;
            CERT_FRIENDLY_NAME_PROP_ID:
              begin
                CertGetCertificateContextProperty(CertContext, CertPropId,
                  @Data[0], DataLen);
                Writeln(Format('FRIENDLY_NAME: %s', [PChar(@Data[0])]));
              end;
            CERT_KEY_IDENTIFIER_PROP_ID:
              begin
                CertGetCertificateContextProperty(CertContext, CertPropId,
                  @Data[0], DataLen);
                Write('KEY_IDENTIFIER: ');
                for i := 1 to DataLen do
                  Write(Format('%.2x ', [PBYTE(@Data[i - 1])^]));
                Writeln;
              end;
            CERT_SHA1_HASH_PROP_ID:
              begin
                CertGetCertificateContextProperty(CertContext, CertPropId,
                  @Data[0], DataLen);
                Write('SHA1_HASH: ');
                for i := 1 to DataLen do
                  Write(Format('%.2x ', [PBYTE(@Data[i - 1])^]));
                Writeln;
              end;
            CERT_MD5_HASH_PROP_ID:
              begin
                CertGetCertificateContextProperty(CertContext, CertPropId,
                  @Data[0], DataLen);
                Write('MD5_HASH: ');
                for i := 1 to DataLen do
                  Write(Format('%.2x ', [PBYTE(@Data[i - 1])^]));
                Writeln;
              end;
          else
          end;
          CertPropId := CertEnumCertificateContextProperties(CertContext,
            CertPropId);
        end;
        Inc(J);
        CertContext := CertEnumCertificatesInStore(hStore, CertContext);
      end;

      if (J = 0) then
        Exit;

      Writeln(Format('CertificatesInStore = [%d]', [J]));
      Writeln('');

      TmpPFX.cbData := 0;
      TmpPFX.pbData := nil;

      if (PFXExportCertStoreEx(hStore, @TmpPFX, PChar(Password), nil,
        EXPORT_PRIVATE_KEYS)) then

        TmpPFX.pbData := CryptMemAlloc(SizeOf(BYTE) * TmpPFX.cbData);

      if (TmpPFX.pbData <> nil) then
      begin

        if (PFXExportCertStoreEx(hStore, @TmpPFX, PChar(Password), nil,
          EXPORT_PRIVATE_KEYS)) then
        begin

          Mem.WriteBuffer(TmpPFX.pbData^, TmpPFX.cbData);

          Mem.SaveToFile(NameStore + '_' + IntToStr(J) + '_' + Format('%08x',
            [GetTickCount]) + '.pfx');
        end;
        CryptMemFree(TmpPFX.pbData);
      end;
    except
      on E: Exception do
        Writeln(Format('[%s] %s', [E.ClassName, E.Message]));
    end;
  finally
    CertCloseStore(hStore, 0);
    Mem.Free;
  end;
end;

begin
  try
    ExportCertToPFX('MY', '123');
  except
    on E: Exception do
      Writeln(E.ClassName, ': ', E.Message);
  end;
  Readln;

end.

参考文献：

我的麻烦是，显然我的Delphi版本（以及C ++示例）都将所有证书导出到唯一的.pfx文件，直到我知道（如果我错了，请修复我）才可以使用1。 pfx文件/软件，然后如何将这些代码导出的所有这些证书分离到唯一的.pfx文件中？

我相信为CertEnumCertificatesInStore中找到的每个证书生成1个.pfx文件都可以解决此问题，但是对此不确定。有人可以给我一个建议吗？

Answer 1

嗯，这是基于 @bartonjs

的建议的可能解决方案

var
  CertContext: PCCERT_CONTEXT;

procedure ExportCertToPFX(NameStore, Password: string);
var
  TmpPFX: CRYPT_DATA_BLOB;
  hTempStore: HCERTSTORE;
begin

  hTempStore := CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
    CERT_STORE_CREATE_NEW_FLAG, nil);
  if (hTempStore = nil) then
    RaiseLastOSError;

  try
    CertContext := CertEnumCertificatesInStore(hStore, nil);
    while (CertContext <> nil) do
    begin

      if not CertAddCertificateContextToStore(hTempStore, CertContext,
        CERT_STORE_ADD_NEW, nil) then
        Continue;

      TmpPFX.cbData := 0;
      TmpPFX.pbData := nil;

      if (PFXExportCertStoreEx(hTempStore, @TmpPFX, PChar(Password), nil,
        EXPORT_PRIVATE_KEYS)) then

        TmpPFX.pbData := CryptMemAlloc(SizeOf(BYTE) * TmpPFX.cbData);

      if (TmpPFX.pbData <> nil) then
      begin

        if (PFXExportCertStoreEx(hTempStore, @TmpPFX, PChar(Password), nil,
          EXPORT_PRIVATE_KEYS)) then
        begin

          // Save to .pfx file

        end;

        CryptMemFree(TmpPFX.pbData);
      end;

      if not CertDeleteCertificateFromStore
        (CertDuplicateCertificateContext(CertContext)) then
        if (GetLastError = Cardinal(E_ACCESSDENIED)) then
          Continue;

      CertContext := CertEnumCertificatesInStore(hStore, CertContext);
    end;
  except
    on E: Exception do
      Writeln(Format('[%s] %s', [E.ClassName, E.Message]));
  CertCloseStore(hTempStore, 0);
  end;
CertCloseStore(hTempStore, 0);
end;

如何将我所有的软件证书分别导出到.pfx文件？

1 个答案: