.NET Standard 2.1中如何从客户端证书和密钥文件创建X509Certificate2对象

.NET Standard 2.1没有内置的X509Certificate2.CreateFromPem方法，你可以借助第三方密码学库BouncyCastle来实现，步骤如下：

1. 安装依赖包 #

通过NuGet安装适配.NET Standard的Org.BouncyCastle包：

Install-Package Org.BouncyCastle

2. 实现方法 #

根据证书和私钥的存储方式（同文件/分开文件），选择对应的实现：

情况1：证书和私钥在同一个PEM文件中 #

using System;
using System.IO;
using System.Security.Cryptography.X509Certificates;
using Org.BouncyCastle.Crypto;
using Org.BouncyCastle.OpenSsl;
using Org.BouncyCastle.X509;
using Org.BouncyCastle.Security;

public static X509Certificate2 CreateCertificateFromCombinedPem(string pemFilePath, string password = "")
{
    var pemContent = File.ReadAllText(pemFilePath);
    var reader = new PemReader(new StringReader(pemContent));

    object obj;
    X509Certificate bcCert = null;
    AsymmetricKeyParameter privateKey = null;

    while ((obj = reader.ReadObject()) != null)
    {
        if (obj is X509Certificate cert)
        {
            bcCert = cert;
        }
        else if (obj is AsymmetricKeyParameter key)
        {
            privateKey = key;
        }
    }

    if (bcCert == null || privateKey == null)
    {
        throw new InvalidOperationException("PEM文件中未找到有效的证书或私钥");
    }

    var pkcs12Store = new Pkcs12Store();
    var certEntry = new X509CertificateEntry(bcCert);
    pkcs12Store.SetCertificateEntry("cert", certEntry);
    pkcs12Store.SetKeyEntry("privateKey", new AsymmetricKeyEntry(privateKey), new[] { certEntry });

    using (var ms = new MemoryStream())
    {
        pkcs12Store.Save(ms, password.ToCharArray(), new SecureRandom());
        return new X509Certificate2(ms.ToArray(), password, X509KeyStorageFlags.Exportable);
    }
}

情况2：证书和私钥在分开的PEM文件中 #

public static X509Certificate2 CreateCertificateFromSeparatePems(string certPemPath, string keyPemPath, string password = "")
{
    // 读取证书PEM
    var certReader = new PemReader(new StringReader(File.ReadAllText(certPemPath)));
    var bcCert = (X509Certificate)certReader.ReadObject();

    // 读取私钥PEM
    var keyReader = new PemReader(new StringReader(File.ReadAllText(keyPemPath)));
    var privateKey = (AsymmetricKeyParameter)keyReader.ReadObject();

    if (bcCert == null || privateKey == null)
    {
        throw new InvalidOperationException("证书或私钥文件无效");
    }

    var pkcs12Store = new Pkcs12Store();
    var certEntry = new X509CertificateEntry(bcCert);
    pkcs12Store.SetCertificateEntry("cert", certEntry);
    pkcs12Store.SetKeyEntry("privateKey", new AsymmetricKeyEntry(privateKey), new[] { certEntry });

    using (var ms = new MemoryStream())
    {
        pkcs12Store.Save(ms, password.ToCharArray(), new SecureRandom());
        return new X509Certificate2(ms.ToArray(), password, X509KeyStorageFlags.Exportable);
    }
}

注意事项 #

• 若不需要导出证书，可将X509KeyStorageFlags.Exportable替换为X509KeyStorageFlags.PersistKeySet，提升安全性。
• 私钥PEM支持PKCS#8（-----BEGIN PRIVATE KEY-----）和传统RSA格式（-----BEGIN RSA PRIVATE KEY-----），BouncyCastle会自动识别处理。
• 生产环境避免使用空密码，建议设置强密码保护PKCS12容器。

内容的提问来源于stack exchange，提问作者jiten