c# – 使用OpenSSL .Net检索证书

>如何检索服务器的证书
>如何检索证书链

要重新获得服务器的证书,请使用SslStream,其方法类似于.NET自己的SslStream

var serverName = "...;
var client = new TcpClient(serverName,443);            

// Create an SSL stream that will close the client's stream.
using (var sslStream = new SslStream(client.GetStream(),true))
{
    sslStream.AuthenticateAsClient(serverName);                
    var serverCertificate = sslStream.RemoteCertificate;
 }

似乎OpenSSL.Net无法检索证书的链. -showcerts参数使用SSL_get_peer_cert_chain函数,该函数未在OpenSSL.NET中实现.

如果您不介意混合使用OpenSSL.Net和内置的.NET类,可以将OpenSSL.Net证书转换为.NET证书并使用.NET的X509Chain.Build检索链.您可以使用.NET证书的RawData属性将.NET证书转换回OpenSSL.NET证书.

var managedCert = new System.Security.Cryptography.X509Certificates.X509Certificate2(serverCertificate.DER);
var chain = new System.Security.Cryptography.X509Certificates.X509Chain();
chain.Build(managedCert);


foreach (var element in chain.ChainElements)
{
    var raw = element.Certificate.RawData;
    using (var bio = new BIO(raw))
    {
        var oc = OpenSSL.X509.X509Certificate.FromDER(bio);
    }
}

也许您可以使用.NET的SslStream和X509Certificate2对象来使用原始证书数据执行您想要的操作而不使用OpenSSL.Net.