ASP.NET Core生成Ed25519自签X.509证书参数ANY NULL合规问题求助

开发者阿泽

2026-6-16

解决Ed25519自签证书AlgorithmIdentifier带NULL参数的问题

问题出在你使用了通用的Asn1SignatureFactory生成Ed25519签名，这个工厂类默认会为Ed25519的AlgorithmIdentifier添加NULL参数，不符合RFC8410的规范要求。

解决步骤

替换通用签名工厂为BouncyCastle提供的Ed25519专属签名工厂：Ed25519SignatureFactory。这个类是为Ed25519算法量身实现的，会自动遵循RFC8410要求，省略AlgorithmIdentifier中的parameters字段。

修改后的核心代码

private X509Certificate CreateSelfSignedCertificate(X509Name subjectName, Pkcs10CertificationRequest csr, Ed25519PrivateKeyParameters privateKey, DateTime notBefore, DateTime notAfter)
{
    var certGen = new X509V3CertificateGenerator();

    var serialNumber = new BigInteger("2651512");
    certGen.SetSerialNumber(serialNumber);

    certGen.SetIssuerDN(subjectName);
    certGen.SetSubjectDN(subjectName);
    certGen.SetNotBefore(notBefore);
    certGen.SetNotAfter(notAfter);
    certGen.SetPublicKey(csr.GetPublicKey());

    certGen.AddExtension(X509Extensions.SubjectKeyIdentifier, false, new SubjectKeyIdentifierStructure(csr.GetPublicKey()));
    var authorityKeyIdentifier = new AuthorityKeyIdentifierStructure(csr.GetPublicKey());

    certGen.AddExtension(X509Extensions.AuthorityKeyIdentifier, false, authorityKeyIdentifier);
    certGen.AddExtension(X509Extensions.BasicConstraints, false, CreateCustomExtensionValueRoot());

    // 替换为Ed25519专属签名工厂
    var signatureFactory = new Ed25519SignatureFactory(privateKey);

    return certGen.Generate(signatureFactory);
}