PowerShell从CER与KEY生成PFX时缺失私钥问题排查

我们持有证书颁发机构生成的私钥和证书，尝试编写PowerShell函数将两者合并生成PFX文件，但生成的PFX始终仅包含证书，不包含私钥。输入文件本身无问题，因为通过以下OpenSSL命令可成功生成包含证书和私钥的PFX：

openssl pkcs12 -export -out mycertificate.pfx -inkey private.key -in cert.cer

私钥为带-----BEGIN PRIVATE KEY-----头、每行64字符的Base64格式，证书为DER PKCS12格式。使用openssl.exe pkcs12 -in cert.pfx -info -nodes命令检查结果，发现PowerShell生成的PFX无私钥，而OpenSSL生成的则正常。试了ChatGPT和Gemini的建议均无效，求问问题原因及代码中的错误，附相关PowerShell代码：

$certContent = Get-Content -Path $CertPath -Raw

# Ensure certificate is in PEM format
if ($certContent -notmatch '-----BEGIN CERTIFICATE-----') {
    <#DebugLog "Certificate not in PEM format, attempting to convert..."
    $certBytes = [System.IO.File]::ReadAllBytes($CertPath)
    $cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($certBytes)
    $pemCert = "-----BEGIN CERTIFICATE-----`n"
    $pemCert += [Convert]::ToBase64String($cert.RawData, 'InsertLineBreaks')
    $pemCert += "`n-----END CERTIFICATE-----"
    $cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::CreateFromPem($pemCert)
    #the following line seems to work too and all the above lines can be replaced by just this one. Right?
    #$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($certPath)
}
else {
    # Certificate is already in PEM format
    DebugLog "Certificate is already in PEM format"
    $cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::CreateFromPem($certContent)
}

# Load private key
if (-not (Test-Path -Path $KeyPath)) {
    throw "Private key file not found at '$KeyPath'"
}
$keyPem = Get-Content -Path $KeyPath -Raw

# Detect private key type
$rsa = $null
if ($keyPem -match '-----BEGIN PRIVATE KEY-----') {
    $keyBase64 = ($keyPem -replace '-----BEGIN PRIVATE KEY-----', '') -replace '-----END PRIVATE KEY-----', ''
    $keyBase64 = $keyBase64 -replace '\s', '' # Remove any whitespace or newlines
    $keyBytes = [Convert]::FromBase64String($keyBase64)
    $rsa = [System.Security.Cryptography.RSA]::Create()
    $rsa.ImportPkcs8PrivateKey($keyBytes, [ref]0)
}
elif ($keyPem -match '-----BEGIN RSA PRIVATE KEY-----') {
    $keyBase64 = ($keyPem -replace '-----BEGIN RSA PRIVATE KEY-----', '') -replace '-----END RSA PRIVATE KEY-----', ''
    #$keyBase64 = $keyBase64 -replace '\s', '' # Remove any whitespace or newlines
    $keyBytes = [Convert]::FromBase64String($keyBase64)
    $rsa = [System.Security.Cryptography.RSA]::Create()
    $rsa.ImportRSAPrivateKey($keyBytes, [ref]0)
}
else {
    throw "Unsupported private key format in file '$KeyPath'"
}

# Ensure the private key is correctly bound to the certificate
try {
    $certWithKey = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new(
        $cert.RawData,
        $rsa,
        [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable
    )
    #$certWithKey = $cert.CopyWithPrivateKey($rsa)
    #$certWithKey = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::CopyWithPrivateKey($cert, $rsa)

}
catch {
    throw "Failed to associate the private key with the certificate: $_"
}

# Export to PFX with password (if given)
if ($PfxPassword) {
    $pfxBytes = $certWithKey.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Pfx, $PfxPassword)
}
else {
    $pfxBytes = $certWithKey.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Pfx)
}

# Save PFX to file
[System.IO.File]::WriteAllBytes($OutputPath, $pfxBytes)

核心错误集中在证书与私钥的绑定逻辑以及证书加载的冗余处理：

1. 错误使用构造函数：代码中使用X509Certificate2(byte[], RSA, X509KeyStorageFlags)构造函数的方式完全错误，这个重载并非用于关联已有证书和私钥，而是从原始证书数据和临时密钥对创建新证书，自然无法保留私钥关联。
2. 注释掉正确的绑定方法：你注释了CopyWithPrivateKey方法，这才是将已有X509证书与私钥关联的标准API。
3. DER证书的冗余转换：已知证书是DER格式，却尝试转成PEM再加载，虽然这步不致命，但增加了不必要的复杂度，直接加载DER字节更可靠。

# 直接加载DER格式证书，X509Certificate2构造函数可自动识别格式
$certBytes = [System.IO.File]::ReadAllBytes($CertPath)
$cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($certBytes)

# 加载私钥
if (-not (Test-Path -Path $KeyPath)) {
    throw "私钥文件未找到：'$KeyPath'"
}
$keyPem = Get-Content -Path $KeyPath -Raw

$rsa = $null
if ($keyPem -match '-----BEGIN PRIVATE KEY-----') {
    # 处理PKCS#8格式私钥
    $keyBase64 = ($keyPem -replace '-----BEGIN PRIVATE KEY-----', '') -replace '-----END PRIVATE KEY-----', '' -replace '\s', ''
    $keyBytes = [Convert]::FromBase64String($keyBase64)
    $rsa = [System.Security.Cryptography.RSA]::Create()
    $rsa.ImportPkcs8PrivateKey($keyBytes, [ref]0)
}
elif ($keyPem -match '-----BEGIN RSA PRIVATE KEY-----') {
    # 处理PKCS#1格式RSA私钥
    $keyBase64 = ($keyPem -replace '-----BEGIN RSA PRIVATE KEY-----', '') -replace '-----END RSA PRIVATE KEY-----', '' -replace '\s', ''
    $keyBytes = [Convert]::FromBase64String($keyBase64)
    $rsa = [System.Security.Cryptography.RSA]::Create()
    $rsa.ImportRSAPrivateKey($keyBytes, [ref]0)
}
else {
    throw "不支持的私钥格式：'$KeyPath'"
}

# 正确绑定证书与私钥
try {
    # 使用CopyWithPrivateKey创建带私钥的证书实例
    $certWithKey = $cert.CopyWithPrivateKey($rsa)
    # 重新构造证书，确保标记为可导出，否则无法导出带私钥的PFX
    $certWithKey = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new(
        $certWithKey.RawData,
        $null,
        [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable
    )
}
catch {
    throw "绑定私钥到证书失败：$_"
}

# 导出PFX文件
if ($PfxPassword) {
    $pfxBytes = $certWithKey.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Pfx, $PfxPassword)
}
else {
    $pfxBytes = $certWithKey.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Pfx)
}

# 写入文件
[System.IO.File]::WriteAllBytes($OutputPath, $pfxBytes)

• CopyWithPrivateKey的作用：该方法会创建一个新的X509Certificate2实例，将原证书与私钥绑定，是官方推荐的关联方式。
• 可导出标记的必要性：重新构造证书时添加Exportable标记，确保后续导出PFX时能包含私钥。
• 私钥预处理：必须去除私钥PEM中的所有空白字符（换行、空格等），否则会导致Base64解码失败。

内容的提问来源于stack exchange，提问作者McVitas