如何使用CertCreateCertificateContext加载DER编码X.509 *.CER文件（VBA+CryptoAPI）

我之前在VBA里用CryptoAPI加载DER证书时也碰到过一模一样的ASN.1错误，大概率是证书二进制数据读取不完整或者API参数传递错误导致的。下面是一步步的排查和解决方法：

1. 确保完整读取DER证书的二进制数据 #

DER格式证书是纯二进制文件，必须完整读取所有字节才能被CryptoAPI解析。很多人出错是因为读取时没有正确获取文件大小，或者数组下标处理不对。试试这个读取函数：

' 声明必要的Windows API（兼容32/64位Office）
Private Declare PtrSafe Function CreateFile Lib "kernel32" Alias "CreateFileA" ( _
    ByVal lpFileName As String, _
    ByVal dwDesiredAccess As Long, _
    ByVal dwShareMode As Long, _
    lpSecurityAttributes As Any, _
    ByVal dwCreationDisposition As Long, _
    ByVal dwFlagsAndAttributes As Long, _
    ByVal hTemplateFile As LongPtr _
) As LongPtr

Private Declare PtrSafe Function GetFileSize Lib "kernel32" ( _
    ByVal hFile As LongPtr, _
    lpFileSizeHigh As Long _
) As Long

Private Declare PtrSafe Function ReadFile Lib "kernel32" ( _
    ByVal hFile As LongPtr, _
    lpBuffer As Any, _
    ByVal nNumberOfBytesToRead As Long, _
    lpNumberOfBytesRead As Long, _
    lpOverlapped As Any _
) As Long

Private Declare PtrSafe Function CloseHandle Lib "kernel32" ( _
    ByVal hObject As LongPtr _
) As Long

Private Function ReadDERCertificateToByteArray(ByVal certPath As String) As Byte()
    Dim hFile As LongPtr
    Dim fileSize As Long
    Dim bytesRead As Long
    Dim certBytes() As Byte
    
    ' 以只读方式打开证书文件
    hFile = CreateFile(certPath, &H80000000, &H1, ByVal 0&, &H3, &H80, 0)
    If hFile = -1 Then
        Err.Raise vbObjectError + 1001, , "无法打开证书文件，请检查路径和权限"
    End If
    
    ' 获取文件总大小（DER证书是固定大小的二进制文件）
    fileSize = GetFileSize(hFile, ByVal 0&)
    If fileSize = 0 Then
        CloseHandle hFile
        Err.Raise vbObjectError + 1002, , "证书文件为空或损坏"
    End If
    
    ' 分配刚好容纳整个证书的字节数组（下标从0开始）
    ReDim certBytes(0 To fileSize - 1) As Byte
    
    ' 读取全部文件内容到数组
    If Not ReadFile(hFile, certBytes(0), fileSize, bytesRead, ByVal 0&) Then
        CloseHandle hFile
        Err.Raise vbObjectError + 1003, , "读取证书文件失败，系统错误码：" & Err.LastDllError
    End If
    
    ' 验证是否读取了完整的文件
    If bytesRead <> fileSize Then
        CloseHandle hFile
        Err.Raise vbObjectError + 1004, , "仅读取了部分证书数据，请检查文件是否被占用"
    End If
    
    CloseHandle hFile
    ReadDERCertificateToByteArray = certBytes
End Function

这个函数会严格校验文件大小和读取字节数，避免数据截断的问题。

2. 正确调用CertCreateCertificateContext #

接下来要确保API参数完全符合要求，尤其是编码类型和数据长度：

' 声明CryptoAPI函数和常量
Private Const X509_ASN_ENCODING As Long = &H1
Private Const PKCS_7_ASN_ENCODING As Long = &H10000

Private Declare PtrSafe Function CertCreateCertificateContext Lib "crypt32.dll" ( _
    ByVal dwCertEncodingType As Long, _
    pbCertEncoded As Byte, _
    ByVal cbCertEncoded As Long _
) As LongPtr

Private Declare PtrSafe Function CertFreeCertificateContext Lib "crypt32.dll" ( _
    ByVal pCertContext As LongPtr _
) As Long

Sub LoadDERCertificate()
    Dim certPath As String
    Dim certBytes() As Byte
    Dim hCertContext As LongPtr
    
    ' 替换成你的证书路径
    certPath = "C:\your\cert\path\custom-cert.cer"
    
    ' 读取证书到字节数组
    certBytes = ReadDERCertificateToByteArray(certPath)
    
    ' 创建证书上下文：编码类型用X509_ASN_ENCODING（或组合PKCS_7_ASN_ENCODING兼容更多场景）
    hCertContext = CertCreateCertificateContext( _
        X509_ASN_ENCODING Or PKCS_7_ASN_ENCODING, _
        certBytes(0), _
        UBound(certBytes) - LBound(certBytes) + 1 _
    )
    
    If hCertContext = 0 Then
        ' 获取详细错误码
        Dim errCode As Long
        errCode = Err.LastDllError
        Err.Raise vbObjectError + errCode, , "创建证书上下文失败，错误码：" & errCode
    Else
        MsgBox "证书上下文创建成功！句柄：" & hCertContext
        ' 用完记得释放上下文，避免内存泄漏
        CertFreeCertificateContext hCertContext
    End If
End Sub

这里要注意两个关键细节：

• 编码类型必须指定X509_ASN_ENCODING（DER格式X.509证书的标准编码），加上PKCS_7_ASN_ENCODING是为了兼容部分系统的配置。
• 第三个参数是证书数据的总长度，用UBound(certBytes) - LBound(certBytes) + 1计算可以适配任意下标起始的数组。

3. 排查证书文件本身的问题 #

如果上面两步还是报错，那可能是证书文件的问题：

• 确认证书确实是DER编码二进制X.509格式：右键证书文件→打开→查看“详细信息”标签页，在“编码方式”里应该显示“DER编码二进制X.509”。
• 用命令行验证证书有效性：打开CMD，执行openssl x509 -in "C:\your\cert\path\custom-cert.cer" -inform der -text -noout，如果能输出证书的详细信息，说明证书是有效的；如果报错，说明证书文件损坏或格式不对。

内容的提问来源于stack exchange，提问作者MonkeyPen