Windows CryptoAPI 和 OpenSSL x509 格式之间的转换
我有一个 CERT_CONTEXT 结构通过 CryptoAPI 从 Windows 上的智能卡中提取。我需要将此结构转换为与 OpenSSL 一致的 DER 编码字节数组。到目前为止，我得到的最接近的匹配是通过 CryptEncodeObject 使用 X509_ASN_ENCODING 和 X509_CERT_TO_BE_SIGNED 修饰符，该修饰符采用 CERT_INFO 结构作为输入。
问题是它与 OpenSSL i2d_X509 生成的输出不匹配功能。使用 2048 位 x509 证书作为输入，OpenSSL 生成 1789 字节的编码输出，而 Windows CryptoAPI 生成 1638 字节的编码输出。
我能看到的唯一选项是使用 CERT_CONTEXT 结构，并直接使用 i2d_X509 功能。唯一的问题是我无法从智能卡中提取私钥，因此这可能会导致 x509 证书创建例程出现问题。
如果有人可以对这些问题提供任何见解/建议/提示，我将非常感激。
I have a CERT_CONTEXT structure which I've extracted from a smart card on Windows via the CryptoAPI. I need to convert this structure into a DER encoded byte array which is consistent with OpenSSL. The closest match I've got so far is via CryptEncodeObject using X509_ASN_ENCODING and the X509_CERT_TO_BE_SIGNED modifier which takes the CERT_INFO structure as input.
The problem is that it doesn't match with the output produced by the OpenSSL i2d_X509 function. Using a 2048 bit x509 certificate as input, OpenSSL produces 1789 bytes of encoded output whilst the Windows CryptoAPI produces 1638 bytes of encoded output.
The only option left that I can see is to create an X509 cert on the fly using the values from the CERT_CONTEXT structure and the encode the resulting object directly with the i2d_X509 function. The only problem with this is that I can't extract the private key from the smart card, so this may cause problems with the x509 cert creation routines.
If anyone can provide any insight/advice/tips into these matters, I'd be much obliged.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
DER 编码证书可以从 (ctx->pbCertEncoded, ctx->cbCertEncoded) 缓冲区获取，其中 ctx 是 PCCERT_CONTEXT 对象。您仍然无法恢复私钥。
DER encoded certificate can be obtained from (ctx->pbCertEncoded, ctx->cbCertEncoded) buffer where ctx is a PCCERT_CONTEXT object. Still you won't be able to recover the private key.