C#中如何使用X509证书与SHA256算法对SOAP请求进行签名

通过WSDL文件生成的类中使用的X509Certificate2类默认采用SHA1算法，不符合使用要求。

补充说明 #

原有代码如下：

mLegService.mLegServiceClient client = new mLegService.mLegServiceClient("mLegServicePort");


mLegService.CreateOrderRequest request = new mLegService.CreateOrderRequest()
{
     requestHeader = new myService.RequestHeader() { institutionId = 123, requestId = "aeacbff8-ba6d-4a01-8e76-0b4384c24721", system = "XYZ" }
};

            
var cert = new X509Certificate2(AppDomain.CurrentDomain.BaseDirectory + "//cert.p12", "Pass123");

client.ChannelFactory.Credentials.ClientCertificate.Certificate = cert;
client.ClientCredentials.ClientCertificate.Certificate = cert;

myService.CreateOrderResponse response = client.createOrder(request);


txtResult.Text = response.order.name;

当前绑定中配置的算法集为默认SHA1相关套件，预期切换为SHA2系列算法套件。

方式一：代码动态修改绑定算法 #

在初始化客户端实例后，新增修改绑定算法套件的逻辑即可，完整代码如下：

mLegService.mLegServiceClient client = new mLegService.mLegServiceClient("mLegServicePort");

// 新增部分：将默认算法套件替换为SHA256版本
CustomBinding customBinding = new CustomBinding(client.Endpoint.Binding);
SecurityBindingElement securityElement = customBinding.Elements.Find<SecurityBindingElement>();
if (securityElement != null)
{
    // 可根据实际需求替换为对应算法套件枚举值
    securityElement.DefaultAlgorithmSuite = System.ServiceModel.Security.SecurityAlgorithmSuite.Basic256Sha256;
}
client.Endpoint.Binding = customBinding;

// 原有逻辑保持不变
mLegService.CreateOrderRequest request = new mLegService.CreateOrderRequest()
{
     requestHeader = new myService.RequestHeader() { institutionId = 123, requestId = "aeacbff8-ba6d-4a01-8e76-0b4384c24721", system = "XYZ" }
};

var cert = new X509Certificate2(AppDomain.CurrentDomain.BaseDirectory + "//cert.p12", "Pass123");
client.ChannelFactory.Credentials.ClientCertificate.Certificate = cert;
client.ClientCredentials.ClientCertificate.Certificate = cert;

myService.CreateOrderResponse response = client.createOrder(request);
txtResult.Text = response.order.name;

方式二：配置文件静态修改 #

如果绑定配置定义在App.config/Web.config中，直接修改对应绑定节点的defaultAlgorithmSuite属性即可：

<system.serviceModel>
  <bindings>
    <customBinding>
      <binding name="mLegServicePort">
        <security defaultAlgorithmSuite="Basic256Sha256" />
        <!-- 其余原有绑定配置无需修改 -->
      </binding>
    </customBinding>
  </bindings>
</system.serviceModel>

• 可根据实际算法要求替换Basic256Sha256为对应枚举值，常见可选值包括Basic128Sha256Rsa15、Aes256Sha256Rsa15等。
• 修改完成后可通过调试查看SecurityBindingElement属性或抓包验证签名算法是否已切换为预期值。

内容的提问来源于stack exchange，提问作者ITMemberAHE