private static X509Certificate2 CreateCA(CertificateOptions options)
{
string CAFilePath = options.ExportDirectory + "\\" + options.CACertName;
bool create = false;
if (File.Exists(CAFilePath) == true)
{
X509Certificate2 CA = new X509Certificate2(CAFilePath, options.Password, X509KeyStorageFlags.Exportable);
if (CertHelper.IsExpired(CA) == false)
{
return(CA);
}
else
{
create = true;
}
}
else
{
create = true;
}
if (create)
{
X500DistinguishedName distinguishedName = new X500DistinguishedName($"CN=" + string.Concat(options.FriendlyName, options.Suffix));
using (RSA rsa = RSA.Create(2048))
{
CertificateRequest parentReq = new CertificateRequest(distinguishedName, rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
parentReq.CertificateExtensions.Add(
new X509BasicConstraintsExtension(true, true, 1, true));
parentReq.CertificateExtensions.Add(
new X509SubjectKeyIdentifierExtension(parentReq.PublicKey, false));
parentReq.CertificateExtensions.Add(
new X509EnhancedKeyUsageExtension(new OidCollection {
new Oid("1.3.6.1.5.5.7.3.1")
}, true));
parentReq.CertificateExtensions.Add(
new X509KeyUsageExtension(X509KeyUsageFlags.KeyCertSign | X509KeyUsageFlags.CrlSign | X509KeyUsageFlags.DigitalSignature, false));
X509Certificate2 caCert = parentReq.CreateSelfSigned(new DateTimeOffset(options.ValidStartDate), new DateTimeOffset(options.ValidEndDate));
caCert.FriendlyName = string.Concat(options.FriendlyName, options.Suffix);
byte[] caExported = caCert.Export(X509ContentType.Pfx, options.Password);
using (Stream stream = File.Create(CAFilePath))
{
stream.Write(caExported, 0, caExported.Length);
}
return(new X509Certificate2(caCert.Export(X509ContentType.Pfx, options.Password), options.Password, X509KeyStorageFlags.MachineKeySet));
}
}
else
{
return(null);
}
}