如何從特定證書綁定C＃

Question

我發現在互聯網上只有這樣，才能得到從IIS的所有證書，我這樣做以下（C＃）：

var store = new X509Store(StoreName.My, StoreLocation.LocalMachine); 
store.Open(OpenFlags.ReadOnly); 
store.Certificates; 

現在我試圖得到一個特定綁定的特定證書，我如何在C＃中執行此操作？

Answer 1

自己保持絕對沒有任何有關在IIS中使用的綁定信息，這樣你就不能檢索從機器證書，並期望他們有IIS相關的任何證書。您需要從IIS中查詢該信息。

要做到這一點，您需要在%windir%\system32\inetsrv\Microsoft.Web.Administration.dll（注意：必須安裝IIS 7或更新版本）中找到的庫中添加引用。在此之後，你可以像下面這樣拿到證書：

ServerManager manager = new ServerManager(); 
Site yourSite = manager.Sites["yourSiteName"]; 

X509Certificate2 yourCertificate = null; 

foreach (Binding binding in yourSite.Bindings) 
{ 
    if (binding.Protocol == "https" && binding.EndPoint.ToString() == "127.0.0.1" /*your binding IP*/) 
    { 
     var store = new X509Store(StoreName.My, StoreLocation.LocalMachine); 
     store.Open(OpenFlags.ReadOnly); 
     yourCertificate = store.Certificates.Find(X509FindType.FindByThumbprint, ToHex(binding.CertificateHash), true)[0]; 
     break; 
    } 
} 

public static string ToHex(byte[] ba) 
{ 
    var hex = new StringBuilder(ba.Length * 2); 
    foreach (byte b in ba) 
    { 
     hex.AppendFormat("{0:x2}", b); 
    } 

    return hex.ToString(); 
} 

Answer 2

以下鏈接應該有所幫助：

基本上store.Certificates返回在特定的商店中的所有證書的集合，然後你可以爲你想要的搜索通過。如果知道所需證書的主題名稱，該鏈接將顯示如何執行此操作。

How to get X509Certificate from certificate store and generate xml signature data?

Answer 3

我認爲卡米洛的答案有一個小問題。據我所見（測試它）找到證書的代碼不起作用，因爲System.Convert.ToBase64String(binding.CertificateHash)沒有返回有效的證書指紋。

我的版本：

/// <summary> 
    /// Returns the https certificate used for a given local IIS website. 
    /// </summary> 
    /// <param name="sWebsite">Website url, e.g., "https://myserver.company.com"</param> 
    /// <returns>certificate, null if not found</returns> 
    private X509Certificate2 FindIisHttpsCert(string sWebsite) 
    { 
     Uri uriWebsite = new Uri(sWebsite); 
     using (ServerManager sm = new ServerManager()) 
     { 
     string sBindingPort = string.Format(":{0}:", uriWebsite.Port); 
     Binding bdBestMatch = null; 
     foreach (Site s in sm.Sites) 
     { 
      foreach (Binding bd in s.Bindings) 
      { 
      if (bd.BindingInformation.IndexOf(sBindingPort) >= 0) 
      { 
       string sBindingHostInfo = bd.BindingInformation.Substring(bd.BindingInformation.LastIndexOf(':') + 1); 
       if (uriWebsite.Host.IndexOf(sBindingHostInfo, StringComparison.InvariantCultureIgnoreCase) == 0) 
       { 
       if ((bd.Protocol == "https") && ((bdBestMatch == null) || (bdBestMatch.BindingInformation.Length < bd.BindingInformation.Length))) 
        bdBestMatch = bd; 
       } 
      } 
      } 
     } 
     if (bdBestMatch != null) 
     { 
      StringBuilder sbThumbPrint = new StringBuilder(); 
      for (int i = 0; i < bdBestMatch.CertificateHash.Length; i++) 
      sbThumbPrint.AppendFormat("{0:X2}", bdBestMatch.CertificateHash[i]); 

      X509Store store = new X509Store(bdBestMatch.CertificateStoreName, StoreLocation.LocalMachine); 
      store.Open(OpenFlags.ReadOnly); 
      X509Certificate2Collection coll = store.Certificates.Find(X509FindType.FindByThumbprint, sbThumbPrint.ToString(), true); 
      if (coll.Count > 0) 
      return coll[0]; 
     } 
     } 
     return null; // if no matching site was found 
    } 

如果多個HTTPS協議的網站在同一臺服務器上承載這個功能也可以（測試），如果網站使用了超過443（未測試）以外的端口應該工作。要獲取綁定信息，使用%windir%\system32\inetsrv\Microsoft.Web.Administration.dll，就像在Camilo的答案中一樣。