private X509Certificate2 CreateAddressBoundCertificate(X509Certificate2 issuer, string emailAddress)
{
var domain = issuer.GetNameInfo(X509NameType.DnsName, false);
var builder = new CertificateBuilder(issuer)
{
AuthorityInformationAccessUri = new Uri($"http://{domain}/pki/{domain}.cer"),
CrlDistributionPointUri = new Uri($"http://{domain}/pki/{domain}.crl"),
SubjectDN = new X509Name($"CN={emailAddress}")
};
builder.SetSubjectAlternativeNameToEmail(emailAddress);
builder.Policies.Add(DirectTrustCertificatePolicies.DTorgCPVersions);
return(builder.Generate());
}
public void TestCertsCreate(string[] args)
{
// Initialize the names.
var rootDomain = "hsgincubator.com";
var redmondDomain = $"redmond.{rootDomain}";
var nhindDomain = $"nhind.{rootDomain}";
var testEmailAddress = $"test@{nhindDomain}";
var testDomain = testEmailAddress.Replace('@', '.');
string path = args.GetOptionalValue(0, Path.Combine(Directory.GetCurrentDirectory(), "Certificates"));
if (!Directory.Exists(path))
{
Directory.CreateDirectory(path);
}
// Create a self-signed certificate authority.
var rootCaBuilder = new CertificateBuilder(1)
{
SubjectDN = new X509Name($"CN={rootDomain}")
};
rootCaBuilder.SetSubjectAlternativeNameToDomain(rootDomain);
var rootCa = rootCaBuilder.Generate();
File.WriteAllBytes(Path.Combine(path, $"{rootDomain}.pfx"), rootCa.Export(X509ContentType.Pfx));
File.WriteAllBytes(Path.Combine(path, $"{rootDomain}.cer"), rootCa.Export(X509ContentType.Cert));
// Create valid organizational certificate.
var redmondValidCertBuilder = new CertificateBuilder(rootCa)
{
AuthorityInformationAccessUri = new Uri($"http://{rootDomain}/pki/{rootDomain}.cer"),
CrlDistributionPointUri = new Uri($"http://{rootDomain}/pki/{rootDomain}.crl"),
SubjectDN = new X509Name($"CN={redmondDomain}")
};
redmondValidCertBuilder.SetSubjectAlternativeNameToDomain(redmondDomain);
var redmondValidCert = redmondValidCertBuilder.Generate();
File.WriteAllBytes(Path.Combine(path, $"{redmondDomain}-valid.pfx"), redmondValidCert.Export(X509ContentType.Pfx));
File.WriteAllBytes(Path.Combine(path, $"{redmondDomain}-valid.cer"), redmondValidCert.Export(X509ContentType.Cert));
// Create revoked organizational certificate.
var redmondRevokedCertBuilder = new CertificateBuilder(rootCa)
{
AuthorityInformationAccessUri = new Uri($"http://{rootDomain}/pki/{rootDomain}.cer"),
CrlDistributionPointUri = new Uri($"http://{rootDomain}/pki/{rootDomain}.crl"),
SubjectDN = new X509Name($"CN={redmondDomain}")
};
redmondRevokedCertBuilder.SetSubjectAlternativeNameToDomain(redmondDomain);
var redmondRevokedCert = redmondRevokedCertBuilder.Generate();
File.WriteAllBytes(Path.Combine(path, $"{redmondDomain}-revoked.pfx"), redmondRevokedCert.Export(X509ContentType.Pfx));
File.WriteAllBytes(Path.Combine(path, $"{redmondDomain}-revoked.cer"), redmondRevokedCert.Export(X509ContentType.Cert));
// Create a certificate revocation list.
var rootCrlBuilder = new CertificateRevocationListBuilder(rootCa, 1)
{
AuthorityInformationAccessUri = new Uri($"http://{rootDomain}/pki/{rootDomain}.cer")
};
rootCrlBuilder.AddRevokedCertificate(redmondRevokedCert);
var rootCrl = rootCrlBuilder.Generate();
var rootCrlBytes = rootCrl.GetEncoded();
File.WriteAllBytes(Path.Combine(path, $"{rootDomain}.crl"), rootCrlBytes);
// Intermediate certificate authority.
var nhindCaBuilder = new CertificateBuilder(rootCa, 0)
{
AuthorityInformationAccessUri = new Uri($"http://{rootDomain}/pki/{rootDomain}.cer"),
CrlDistributionPointUri = new Uri($"http://{rootDomain}/pki/{rootDomain}.crl"),
SubjectDN = new X509Name($"CN={nhindDomain}")
};
nhindCaBuilder.SetSubjectAlternativeNameToDomain(nhindDomain);
var nhindCa = nhindCaBuilder.Generate();
File.WriteAllBytes(Path.Combine(path, $"{nhindDomain}.pfx"), nhindCa.Export(X509ContentType.Pfx));
File.WriteAllBytes(Path.Combine(path, $"{nhindDomain}.cer"), nhindCa.Export(X509ContentType.Cert));
// Create valid address-bound certificate.
var testValidCertBuilder = new CertificateBuilder(nhindCa)
{
AuthorityInformationAccessUri = new Uri($"http://{rootDomain}/pki/{rootDomain}.cer"),
CrlDistributionPointUri = new Uri($"http://{rootDomain}/pki/{rootDomain}.crl"),
SubjectDN = new X509Name($"CN={testEmailAddress}")
};
testValidCertBuilder.SetSubjectAlternativeNameToEmail(testEmailAddress);
var testValidCert = testValidCertBuilder.Generate();
File.WriteAllBytes(Path.Combine(path, $"{testDomain}-valid.pfx"), testValidCert.Export(X509ContentType.Pfx));
File.WriteAllBytes(Path.Combine(path, $"{testDomain}-valid.cer"), testValidCert.Export(X509ContentType.Cert));
// Create revoked address-bound certificate.
var testRevokedCertBuilder = new CertificateBuilder(nhindCa)
{
AuthorityInformationAccessUri = new Uri($"http://{rootDomain}/pki/{rootDomain}.cer"),
CrlDistributionPointUri = new Uri($"http://{rootDomain}/pki/{rootDomain}.crl"),
SubjectDN = new X509Name($"CN={testEmailAddress}")
};
testRevokedCertBuilder.SetSubjectAlternativeNameToEmail(testEmailAddress);
var testRevokedCert = testRevokedCertBuilder.Generate();
File.WriteAllBytes(Path.Combine(path, $"{testDomain}-revoked.pfx"), testRevokedCert.Export(X509ContentType.Pfx));
File.WriteAllBytes(Path.Combine(path, $"{testDomain}-revoked.cer"), testRevokedCert.Export(X509ContentType.Cert));
// Create a certificate revocation list.
var nhindCrlBuilder = new CertificateRevocationListBuilder(nhindCa, 1)
{
AuthorityInformationAccessUri = new Uri($"http://{rootDomain}/pki/{nhindDomain}.cer")
};
nhindCrlBuilder.AddRevokedCertificate(redmondRevokedCert);
var nhindCrl = nhindCrlBuilder.Generate();
var nhindCrlBytes = nhindCrl.GetEncoded();
File.WriteAllBytes(Path.Combine(path, $"{nhindDomain}.crl"), nhindCrlBytes);
}