/// <summary> /// Create a root (self-signed) CA /// </summary> /// <param name="Config">CA Config structure containing the initialisation parameters</param> /// <returns>Full pathname for the configuration file</returns> public static string CreateRootCA(CAConfig Config) { if (Config.profile != CA_Profile.rootCA) { throw new ArgumentException("Invalid profile specified", Config.profile.ToString()); } // Start/end dates DateTime startDate = DateTime.UtcNow; DateTime expiryDate; switch (Config.units) { case "Years": expiryDate = startDate.AddYears(Config.life); break; case "Months": expiryDate = startDate.AddMonths(Config.life); break; case "Days": expiryDate = startDate.AddDays(Config.life); break; default: throw new ArgumentException("Invalid lifetime unit", Config.units); } // Serial number BigInteger serialNumber = new BigInteger(1, BitConverter.GetBytes(DateTime.Now.Ticks)); // Certificate ICertGen certGen; // The OLD method was to use the Config.pkAlgo field to select a hard-coded CSP // The new approach is to have the user select a CSP //OLD method if (Config.FIPS140) { switch (Config.caType) { case CA_Type.sysCA: case CA_Type.dhTA: privateKeyCapi = SysKeyManager.Create(Config.pkSize, Config.pkAlgo, Config.name); publicKey = SysKeyManager.getPublicKey(privateKeyCapi, Config.pkAlgo); if (Config.version == X509ver.V1) { certGen = new SysV1CertGen(); } else { certGen = new SysV3CertGen(); } break; case CA_Type.cngCA: privateKeyCng = CngKeyManager.Create(CngAlgorithm.ECDsaP256, Config.name); publicKey = CngKeyManager.getPublicKey(privateKeyCng); //if (Config.version == X509ver.V1) // certGen = new CngV1CertGen(); //else certGen = new CngV3CertGen(); break; default: throw new InvalidParameterException("CA Type not compatible with Fips140 flag: " + Config.caType.ToString()); } } else { keyPair = BcKeyManager.Create(Config.pkSize, Config.pkAlgo); // Create a system CspParameters entry for use by XmlSigner // Only for RSA and DSA currently until EC XML signing is sorted if (!Config.pkAlgo.Contains("EC")) { privateKeyCapi = SysKeyManager.LoadCsp(keyPair.Private); } else { privateKeyCapi = null; } publicKey = keyPair.Public; if (Config.version == X509ver.V1) { certGen = new BcV1CertGen(); } else { certGen = new BcV3CertGen(); } } //NEW method //if ((Config.FIPS140) && (Config.CSPNum > 0)) // System crypto //{ // cspParam = SysKeyManager.Create(Config.pkSize, Config.CSPName, Config.CSPNum, Config.name); //} // V1 and V3 fields certGen.SetSerialNumber(serialNumber); certGen.SetIssuerDN(Config.DN); certGen.SetNotBefore(startDate); certGen.SetNotAfter(expiryDate); certGen.SetSubjectDN(Config.DN); certGen.SetPublicKey(publicKey); certGen.SetSignatureAlgorithm(Config.sigAlgo); // V3 extensions if (Config.version == X509ver.V3) { ((V3CertGen)certGen).AddExtension(X509Extensions.AuthorityKeyIdentifier, false, new AuthorityKeyIdentifierStructure(publicKey)); ((V3CertGen)certGen).AddExtension(X509Extensions.SubjectKeyIdentifier, false, new SubjectKeyIdentifierStructure(publicKey)); ((V3CertGen)certGen).AddExtension(X509Extensions.BasicConstraints, true, new BasicConstraints(true)); ((V3CertGen)certGen).AddExtension(X509Extensions.KeyUsage, true, new X509KeyUsage(Config.keyUsage)); } X509Certificate caCert; if (Config.FIPS140) { switch (Config.caType) { case CA_Type.sysCA: case CA_Type.dhTA: caCert = ((IsysCertGen)certGen).Generate(privateKeyCapi); break; case CA_Type.cngCA: caCert = ((IcngCertGen)certGen).Generate(privateKeyCng); break; default: throw new InvalidParameterException("CA Type not compatible with Fips140 flag: " + Config.caType.ToString()); } } else { caCert = ((IbcCertGen)certGen).Generate(keyPair.Private); } caCert.Verify(caCert.GetPublicKey()); string configFile; if (Config.FIPS140) { // Create the CA Config file configFile = createFinalCAConfig(Config, serialNumber, caCert, null); LogEvent.WriteEvent(eventLog, LogEvent.EventType.CreateCA, "Root CA (FIPS) Created: " + configFile); } else { // Store key material in a PKCS#12 file MemoryStream stream = BcKeyManager.SaveP12(keyPair.Private, caCert, Config.password, Config.name); string caKey = Convert.ToBase64String(stream.ToArray()); // Create the CA Config file configFile = createFinalCAConfig(Config, serialNumber, caCert, caKey); LogEvent.WriteEvent(eventLog, LogEvent.EventType.CreateCA, "Root CA (BC) Created: " + configFile); } // Create CA database string dbFile = Database.CreateDB(Config, caCert, privateKeyCapi); // Insert Root CA certificate byte[] dummy = new byte[0]; Database.AddCertificate(caCert, dummy, "rootCA", dbFile, caCert, privateKeyCapi); return(configFile); }
/// <summary> /// Create a new Subordinate CA using the setup parameters from a CAConfig object /// The Issuing CA must be available to create and sign a certificate /// </summary> /// <param name="Config">CAConfig object</param> /// <param name="IssuingCA">Object reference for issuing CA</param> /// <returns>Full pathname of CA config file</returns> public static string CreateSubCA(CAConfig Config, ICA IssuingCA) { if (Config.profile != CA_Profile.SubCA) { throw new ArgumentException("Invalid profile specified", Config.profile.ToString()); } // Serial number BigInteger serialNumber = new BigInteger(1, BitConverter.GetBytes(DateTime.Now.Ticks)); // Key material Pkcs10CertificationRequest p10; if (Config.FIPS140) { privateKeyCapi = SysKeyManager.Create(Config.pkSize, Config.pkAlgo, Config.name); // PKCS#10 Request p10 = new Pkcs10CertificationRequestDelaySigned( Config.sigAlgo, Config.DN, SysKeyManager.getPublicKey(privateKeyCapi, Config.pkAlgo), null); // Signature byte[] buffer = ((Pkcs10CertificationRequestDelaySigned)p10).GetDataToSign(); byte[] signature = SysSigner.Sign(buffer, privateKeyCapi, Config.sigAlgo); ((Pkcs10CertificationRequestDelaySigned)p10).SignRequest(signature); } else { keyPair = BcKeyManager.Create(Config.pkSize, Config.pkAlgo); // Create a system CspParameters entry for use by XmlSigner privateKeyCapi = SysKeyManager.LoadCsp(keyPair.Private); // PKCS#10 Request p10 = new Pkcs10CertificationRequest( Config.sigAlgo, Config.DN, keyPair.Public, null, keyPair.Private); } // Test the signature if (!p10.Verify()) { throw new SignatureException("Cannot validate POP signature"); } // Request cert from issuing CA X509Certificate cert = IssuingCA.IssueCertificate(p10, new Profile.Profile(Config.profileFile)); string configFile; if (Config.FIPS140) { // Create the CA Config file configFile = createFinalCAConfig(Config, serialNumber, cert, null); LogEvent.WriteEvent(eventLog, LogEvent.EventType.CreateCA, "Subordinate CA (FIPS) Created: " + configFile); } else { // Store key material in a PKCS#12 file MemoryStream stream = BcKeyManager.SaveP12(keyPair.Private, cert, Config.password, Config.name); string caKey = Convert.ToBase64String(stream.ToArray()); // Create the CA Config file configFile = createFinalCAConfig(Config, serialNumber, null, caKey); LogEvent.WriteEvent(eventLog, LogEvent.EventType.CreateCA, "Root CA (BC) Created: " + configFile); } // Create CA database Database.CreateDB(Config, cert, privateKeyCapi); return(configFile); }