Scenario 12.3: PKCS#7 Chain Export

Questo scenario descrive l'export e import di catene di certificati in formato PKCS#7. PKCS#7 (anche CMS - Cryptographic Message Syntax) e ideale per la distribuzione di catene di certificati senza chiavi private.

Caratteristiche PKCS#7:

• Contenuto: Solo certificati (nessuna chiave privata!)
• Utilizzo: Distribuzione chain, S/MIME
• Estensioni: .p7b, .p7c
• Encoding: DER (Binary) o PEM (Base64)

using System.Security.Cryptography.Pkcs;
using System.Security.Cryptography.X509Certificates;
 
public class Pkcs7ChainExporter
{
    public byte[] ExportChain(X509Certificate2Collection certificates)
    {
        // SignedCms senza firma (solo certificati)
        var content = new ContentInfo(Array.Empty<byte>());
        var signedCms = new SignedCms(content, detached: true);
 
        // Aggiungere certificati
        foreach (var cert in certificates)
        {
            signedCms.Certificates.Add(cert);
        }
 
        // Esportare come PKCS#7 (DER)
        return signedCms.Encode();
    }
 
    public void ExportToFile(
        X509Certificate2Collection certificates,
        string outputPath,
        bool asPem = false)
    {
        var p7bBytes = ExportChain(certificates);
 
        if (asPem)
        {
            // Formato PEM
            var pem = new StringBuilder();
            pem.AppendLine("-----BEGIN PKCS7-----");
            pem.AppendLine(Convert.ToBase64String(p7bBytes, Base64FormattingOptions.InsertLineBreaks));
            pem.AppendLine("-----END PKCS7-----");
            File.WriteAllText(outputPath, pem.ToString());
        }
        else
        {
            // Binary (DER)
            File.WriteAllBytes(outputPath, p7bBytes);
        }
 
        Console.WriteLine($"PKCS#7 esportato: {outputPath} ({certificates.Count} certificati)");
    }
}

public class Pkcs7ChainImporter
{
    public X509Certificate2Collection ImportChain(byte[] p7bBytes)
    {
        var collection = new X509Certificate2Collection();
        collection.Import(p7bBytes);
 
        Console.WriteLine($"{collection.Count} certificati importati");
        return collection;
    }
 
    public X509Certificate2Collection ImportFromFile(string filePath)
    {
        byte[] data;
 
        var content = File.ReadAllText(filePath);
        if (content.Contains("-----BEGIN PKCS7-----"))
        {
            // Formato PEM
            var base64 = Regex.Match(
                content,
                @"-----BEGIN PKCS7-----(.*?)-----END PKCS7-----",
                RegexOptions.Singleline
            ).Groups[1].Value.Trim();
 
            data = Convert.FromBase64String(base64);
        }
        else
        {
            // Binary (DER)
            data = File.ReadAllBytes(filePath);
        }
 
        return ImportChain(data);
    }
}

# Creare PKCS#7 da piu certificati
openssl crl2pkcs7 -nocrl \
    -certfile root-ca.pem \
    -certfile intermediate-ca.pem \
    -certfile server.pem \
    -out chain.p7b \
    -outform DER
 
# PKCS#7 come PEM
openssl crl2pkcs7 -nocrl \
    -certfile chain.pem \
    -out chain.p7b \
    -outform PEM
 
# Ispezionare PKCS#7
openssl pkcs7 -in chain.p7b -print_certs -noout
 
# Estrarre certificati da PKCS#7
openssl pkcs7 -in chain.p7b -print_certs -out extracted.pem

« ← 12.2 PFX Export | ↑ Import/Export | 12.4 Interoperabilita → »

Wolfgang van der Stille @ EMSR DATA d.o.o. - Post-Quantum Cryptography Professional