.NET 6中如何从PFX文件遍历证书并识别根CA证书？

根CA证书的核心判定标准是自签名（Subject与Issuer完全一致）且具备CA属性，以下是针对两种遍历方式的实现方案：

方法一：通过X509Certificate2Collection遍历判断 #

直接遍历PFX导入的证书集合，通过自签名+CA扩展验证识别根CA：

var clientCertPfxFilePath = "xxx.pfx";
var certPw = "...";
X509Certificate2Collection certCollection = new X509Certificate2Collection();
certCollection.Import(clientCertPfxFilePath, certPw, X509KeyStorageFlags.PersistKeySet);

foreach (X509Certificate2 cert in certCollection)
{
    // 第一步：判断是否为自签名证书
    bool isRootCa = cert.SubjectName.Name.Equals(cert.IssuerName.Name, StringComparison.OrdinalIgnoreCase);
    
    if (isRootCa)
    {
        // 第二步：验证证书具备CA属性（避免误判非CA的自签名证书）
        var basicConstraints = cert.Extensions["2.5.29.19"] as X509BasicConstraintsExtension;
        isRootCa = basicConstraints != null && basicConstraints.CertificateAuthority;
    }

    if (isRootCa)
    {
        // 识别到根CA证书，执行后续逻辑
        Console.WriteLine("根CA证书主题：" + cert.SubjectName.Name);
    }
}

方法二：通过X509Chain遍历判断 #

通过构建证书链遍历证书，需调整链策略避免系统根CA干扰，判断逻辑与第一种方法一致：

var clientCertPfxFilePath = "xxx.pfx";
var certPw = "...";
var clientCertificate = new X509Certificate2(clientCertPfxFilePath, certPw);
X509Chain certChain = new X509Chain();

// 配置链策略：禁用吊销检查、允许未知CA（仅使用PFX内的证书）
certChain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
certChain.ChainPolicy.VerificationFlags = X509VerificationFlags.AllowUnknownCertificateAuthority;

if (certChain.Build(clientCertificate))
{
    foreach (var element in certChain.ChainElements)
    {
        X509Certificate2 cert = element.Certificate;
        bool isRootCa = cert.SubjectName.Name.Equals(cert.IssuerName.Name, StringComparison.OrdinalIgnoreCase);
        
        if (isRootCa)
        {
            var basicConstraints = cert.Extensions["2.5.29.19"] as X509BasicConstraintsExtension;
            isRootCa = basicConstraints != null && basicConstraints.CertificateAuthority;
        }

        if (isRootCa)
        {
            Console.WriteLine("根CA证书主题：" + cert.SubjectName.Name);
        }
    }
}

内容的提问来源于stack exchange，提问作者RickyTad