使用X509Certificate2加载PFX证书时遇System.FormatException错误求助

证书生成步骤 #

使用以下两条OpenSSL命令生成PFX证书：

req -x509 -sha256 -newkey rsa:2048 -keyout keyname.key -out certificatename.crt -days 365
pkcs12 -export -in C:\path\to\certificatename.crt -inkey C:\path\to\keyname.key -out C:\path\to\newpkcs12.pfx

C#加载代码 #

X509Store store = new X509Store("TestStore", StoreLocation.CurrentUser);
store.Open(OpenFlags.ReadWrite);
string certPath = "/Certificate/" + "mycertificate.pfx";

X509Certificate2 certificate = new X509Certificate2(certPath, "12345678");

抛出的错误信息 #

System.FormatException: Only integer can be converted
  at Mono.Security.ASN1Convert.ToInt32 (Mono.Security.ASN1 asn1) [0x00017] in <ca59a709f9e24fa0adef388a18d30264>:0 
  at Mono.Security.X509.PKCS12.Decrypt (Mono.Security.PKCS7+EncryptedData ed) [0x00033] in <ca59a709f9e24fa0adef388a18d30264>:0 
  at Mono.Security.X509.PKCS12.Decode (System.Byte[] data) [0x00271] in <ca59a709f9e24fa0adef388a18d30264>:0 
  at Mono.Security.X509.PKCS12..ctor (System.Byte[] data, System.String password) [0x0000d] in <ca59a709f9e24fa0adef388a18d30264>:0 
  at System.Security.Cryptography.X509Certificates.X509Certificate2ImplMono.ImportPkcs12 (System.Byte[] rawData, System.String password) [0x00023] in <d054a9182977441aa432503a474315ba>:0 
  at System.Security.Cryptography.X509Certificates.X509Certificate2ImplMono.ImportPkcs12 (System.Byte[] rawData, Microsoft.Win32.SafeHandles.SafePasswordHandle password) [0x0001b] in <d054a9182977441aa432503a474315ba>:0 
  at System.Security.Cryptography.X509Certificates.X509Certificate2ImplMono..ctor (System.Byte[] rawData, Microsoft.Win32.SafeHandles.SafePasswordHandle password, System.Security.Cryptography.X509Certificates.X509KeyStorageFlags keyStorageFlags) [0x0002f] in <d054a9182977441aa432503a474315ba>:0 
  at Mono.X509PalImpl.ImportFallback (System.Byte[] data, Microsoft.Win32.SafeHandles.SafePasswordHandle password, System.Security.Cryptography.X509Certificates.X509KeyStorageFlags keyStorageFlags) [0x00000] in <d054a9182977441aa432503a474315ba>:0 
  at Mono.X509PalImplMono.Import (System.Byte[] data, Microsoft.Win32.SafeHandles.SafePasswordHandle password, System.Security.Cryptography.X509Certificates.X509KeyStorageFlags keyStorageFlags) [0x00000] in <d054a9182977441aa432503a474315ba>:0 
  at Mono.SystemCertificateProvider.Import (System.Byte[] data, Microsoft.Win32.SafeHandles.SafePasswordHandle password, System.Security.Cryptography.X509Certificates.X509KeyStorageFlags keyStorageFlags, Mono.CertificateImportFlags importFlags) [0x00017] in <d054a9182977441aa432503a474315ba>:0 
  at Mono.SystemCertificateProvider.Mono.ISystemCertificateProvider.Import (System.Byte[] data, Microsoft.Win32.SafeHandles.SafePasswordHandle password, System.Security.Cryptography.X509Certificates.X509KeyStorageFlags keyStorageFlags, Mono.CertificateImportFlags importFlags) [0x00000] in <d054a9182977441aa432503a474315ba>:0 
  at System.Security.Cryptography.X509Certificates.X509Helper.Import (System.Byte[] rawData, Microsoft.Win32.SafeHandles.SafePasswordHandle password, System.Security.Cryptography.X509Certificates.X509KeyStorageFlags keyStorageFlags) [0x00005] in <787acc3c9a4c471ba7d971300105af24>:0 
  at System.Security.Cryptography.X509Certificates.X509Certificate..ctor (System.String fileName, System.String password, System.Security.Cryptography.X509Certificates.X509KeyStorageFlags keyStorageFlags) [0x0003e] in <787acc3c9a4c471ba7d971300105af24>:0 
  at System.Security.Cryptography.X509Certificates.X509Certificate..ctor (System.String fileName, System.String password) [0x00000] in <787acc3c9a4c471ba7d971300105af24>:0 
  at System.Security.Cryptography.X509Certificates.X509Certificate2..ctor (System.String fileName, System.String password) [0x00000] in <d054a9182977441aa432503a474315ba>:0 

已排查内容 #

• 通过Windows证书向导验证密码正确，证书文件路径无误
• 尝试过纯数字、包含非数字字符的密码，均无法解决
• 怀疑是Windows证书库或Mono处理PFX的兼容性问题

解决方案建议 #

1. 指定兼容加密算法生成PFX：在OpenSSL的pkcs12命令中添加参数，强制使用Mono兼容的加密算法，命令如下：

pkcs12 -export -in C:\path\to\certificatename.crt -inkey C:\path\to\keyname.key -out C:\path\to\newpkcs12.pfx -certpbe PBE-SHA1-3DES -keypbe PBE-SHA1-3DES -macalg SHA1

Mono的PKCS12解析对旧版加密算法支持更稳定，默认的SHA256相关算法可能触发解析bug。

2. 添加密钥存储标志参数：在C#构造函数中指定X509KeyStorageFlags参数，避免Mono在密钥存储上的兼容性问题：

X509Certificate2 certificate = new X509Certificate2(certPath, "12345678", X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.PersistKeySet | X509KeyStorageFlags.Exportable);

3. 升级Mono版本：该错误可能是旧版Mono的ASN.1解析bug，升级到最新稳定版Mono可解决部分兼容性问题。

内容的提问来源于stack exchange，提问作者Nick Hudson