用.pfx证书封装、签名和创建pkcs# 7 DER消息

我的任务是创建以PKCS#7 version 1.5 (RFC 2315) DER (ITU-T Recommendation X.690)格式进行数字签名的数据-基本上是ANSI.1与X.509 signature ?

消息必须满足以下条件:

• 必须是类型signedData
• 必须包含签名数据
• 必须包含签名者证书
• 必须包含一个数字签名

我的代码如下

static void Main(string[] args)
{
    string pfx = @"C:'Users'marek'Downloads'mfcr'marek-pfx.pfx";
    string xml = @"C:'Users'marek'Downloads'mfcr'souhr20141.xml";
    X509Certificate2 cert = new X509Certificate2(pfx, "thepass");
    byte[] publicBytes = cert.RawData;
    //var f = new FileStream(xml, System.IO.FileMode.Open);
    var fileContent = System.IO.File.ReadAllBytes(xml);
    char[] cArray = System.Text.Encoding.ASCII.GetString(fileContent).ToCharArray();
    RSACryptoServiceProvider rsa = (RSACryptoServiceProvider)cert.PrivateKey;
    byte[] signedData = rsa.SignData(new System.Text.UTF8Encoding().GetBytes(cArray), new SHA1CryptoServiceProvider());
    RSACryptoServiceProvider rsa2 = (RSACryptoServiceProvider)new X509Certificate2(publicBytes).PublicKey.Key;
    var dataGenerator = new CmsEnvelopedDataStreamGenerator();
    bool verified = rsa2.VerifyData(new System.Text.UTF8Encoding().GetBytes(cArray), new SHA1CryptoServiceProvider(), signedData);
    File.WriteAllBytes(@"C:'Users'marek'Downloads'mfcr'Foo.p7b", signedData);
 }

我向Foo.p7b发送的WebService响应:文件不符合PKCS7(DER)的预期格式。

发送HttpWebRequest的代码:

static void Main(string[] args)
    {
        try
        {
            string fileName = (@"C:'Users'marek'Downloads'mfcr'Foo.p7b");
            WebResponse rsp = null;
            HttpWebRequest request = (HttpWebRequest)HttpWebRequest.Create("https://adisepo.mfcr.cz/adistc/epo_podani");
            request.ClientCertificates.Add(new X509Certificate(pfx,"thepass"));
            request.Method = "POST";
            request.ContentType = "application/pkcs7-signature";
            request.Credentials = CredentialCache.DefaultNetworkCredentials;
            var encoder = new UTF8Encoding();
            var reqStream = request.GetRequestStream();
            StreamWriter writer = new StreamWriter(request.GetRequestStream());
            // Write the XML text into the stream
            writer.WriteLine(GetTextFromXMLFile(fileName));
            writer.Close();
            reqStream.Close();
            rsp = request.GetResponse();
            StreamReader sr = new StreamReader(rsp.GetResponseStream());
            string result = sr.ReadToEnd();
            sr.Close();
            Console.Write("'n příkaz odeslán  'n");
            Console.Write(result);
            Console.ReadLine();
            Console.Read();
        }
        catch (Exception ex)
        { Console.WriteLine(ex.ToString());
        Console.ReadLine();
        }
    }
    private static string GetTextFromXMLFile(string file)
    {
        StreamReader reader = new StreamReader(file);
        string ret = reader.ReadToEnd();
        reader.Close();
        return ret;
    }
}

我在这个问题上挣扎了将近5天——我肯定不是数字签名或证书方面的专家。

从我学到的到目前为止-创建这样的消息我应该做:

1. 用我的private key签署xml
2. 与我的public key一起blob的信封

但是收件人如何检查我是否是真正的发件人呢?我应该添加到HttpWebRequest参数与我的证书?或者第二步——封上邮件就足以让他检查了?

感谢大家的时间和回复。