如何以编程方式获取用于对 .NET 中的程序集进行数字签名的公司信息？
作为一种简单的安全手段，我之前根据其公钥检查了我的程序下载的更新包的数字签名，以确保它源自我。但是，由于我使用廉价的代码签名证书（Tucows），我无法续订现有证书，因此每次需要续订时密钥都会发生变化。
因此，更可靠的方法是根据我熟知的组织字符串来验证签名程序集中嵌入的组织信息（显示在 UAC 对话框中），因为这将继续保持不变。
有谁知道如何从数字签名的程序集中获取此信息？
As a means of simple security, I was previously checking the digital signature of a downloaded update package for my program against its public key to ensure that it originated from me. However, as I'm using cheap code signing certs (Tucows), I am unable to renew an existing cert and therefore the keys change every time I need to renew.
Therefore, a more reliable means would be to verify the organization information embedded in the signed assembly (which is displayed in the UAC dialog) against my well-known organization string, as this will continue to be the same.
Does anyone know how to obtain this information from a digitally-signed assembly?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
仅使用您的密钥检查程序集是否具有强命名还不够吗？ Authenticode 主要有利于最终用户，他们可以识别您的身份（由于证书颁发机构的努力）。在我看来，在您的情况下，与简单的强名称相比，authenticode 证书没有额外的安全性。
我认为强名称更容易验证，并且您不必担心密钥更改。
Isn't it enough to just check that the assembly is strong named using your key? Authenticode mostly benefits the end user who can identify that you are who you say you are (due to the efforts of the cert. authority). To my mind, in your situation, there's no extra security in an authenticode certificate over a simple strong name.
I assume a strong name is much simpler to verify, and you won't have to worry about your key changing.
假设程序集使用 Authenticode 技术和 X.509 证书（而不仅仅是强名称）进行签名，您需要 Authenticode 读取器代码（或组件）来提取证书并验证它。之后，您将在证书的SubjectName 或SubjectRDN 记录的字段之一中找到组织名称。
我们在 PKIBlackbox 包中提供Authenticode 阅读器类和证书操作类。
Assuming that the assembly is signed using Authenticode technology and X.509 certificates (and not just strong-named), you need an Authenticode reader code (or component) to extract the certificate and validate it. After that you will find organization name in one of the fields of certificate's SubjectName or SubjectRDN record.
We offer Authenticode reader class and certificate manipulation class in PKIBlackbox package.