我想以编程方式将我的所有软件证书分别导出到.pfx文件中，以签署 2 个新软件，这些新软件已经在另一台电脑上构建的最后一步。
为了做到这一点，我找到了一个 C++ 代码示例（在我翻译成 Delphi 之后）。
我的 Delphi 版本仍然没有经过测试，但即便如此我认为它工作正常。
program CertToPFX;
{$APPTYPE CONSOLE}
{$R *.res}
uses
Windows,
WinCrypt,
Classes,
SysUtils;
var
CertContext: PCCERT_CONTEXT;
CertPropId: DWORD;
Data: array [0 .. 511] of Char;
DataLen: DWORD;
procedure DisplayCertContext(Cert: PCertContext);
var
CertName: array [0 .. 255] of Char;
begin
if CertGetNameString(CertContext, CERT_NAME_EMAIL_TYPE, 0, nil, CertName,
256) = 0 then
RaiseLastOSError;
Writeln('Subject CERT_NAME_EMAIL_TYPE: ', CertName);
if CertGetNameString(CertContext, CERT_NAME_SIMPLE_DISPLAY_TYPE, 0, nil,
CertName, 256) = 0 then
RaiseLastOSError;
Writeln('Subject CERT_NAME_SIMPLE_DISPLAY_TYPE: ', CertName);
if CertGetNameString(CertContext, CERT_NAME_FRIENDLY_DISPLAY_TYPE, 0, nil,
CertName, 256) = 0 then
RaiseLastOSError;
Writeln('Subject CERT_NAME_FRIENDLY_DISPLAY_TYPE: ', CertName);
if CertGetNameString(CertContext, CERT_NAME_EMAIL_TYPE, CERT_NAME_ISSUER_FLAG,
nil, CertName, 256) = 0 then
RaiseLastOSError;
Writeln('Issuer CERT_NAME_EMAIL_TYPE: ', CertName);
if CertGetNameString(CertContext, CERT_NAME_SIMPLE_DISPLAY_TYPE,
CERT_NAME_ISSUER_FLAG, nil, CertName, 256) = 0 then
RaiseLastOSError;
Writeln('Issuer CERT_NAME_SIMPLE_DISPLAY_TYPE: ', CertName);
if CertGetNameString(CertContext, CERT_NAME_FRIENDLY_DISPLAY_TYPE,
CERT_NAME_ISSUER_FLAG, nil, CertName, 256) = 0 then
RaiseLastOSError;
Writeln('Issuer CERT_NAME_FRIENDLY_DISPLAY_TYPE: ', CertName);
end;
procedure ExportCertToPFX(NameStore, Password: string);
var
TmpPFX: CRYPT_DATA_BLOB;
hStore: HCERTSTORE;
Mem: TMemoryStream;
i, J: Integer;
begin
hStore := CertOpenSystemStore(0, PChar(NameStore));
if (hStore = nil) then
RaiseLastOSError;
Mem := TMemoryStream.Create;
J := 0;
try
try
CertContext := CertEnumCertificatesInStore(hStore, nil);
while (CertContext <> nil) do
begin
DisplayCertContext(CertContext);
CertPropId := CertEnumCertificateContextProperties(CertContext, 0);
while CertPropId <> 0 do
begin
DataLen := 512;
case CertPropId of
CERT_KEY_PROV_HANDLE_PROP_ID:
begin
CertGetCertificateContextProperty(CertContext, CertPropId,
@Data[0], DataLen);
Writeln(Format('KEY_PROV_HANDLE: $%.8x', [PDWORD(@Data[0])^]));
end;
CERT_KEY_PROV_INFO_PROP_ID:
begin
CertGetCertificateContextProperty(CertContext, CertPropId,
@Data[0], DataLen);
with PCryptKeyProvInfo(@Data[0])^ do
begin
Writeln(Format('pwszContainerName = %s',
[pwszContainerName]));
Writeln(Format('pwszProvName = %s', [pwszProvName]));
Writeln(Format('dwFlags = %d', [dwFlags]));
Writeln(Format('cProvParams = %d', [cProvParam]));
Writeln(Format('dwKeySpec = %d', [dwKeySpec]));
end;
Writeln(Format('KEY_PROV_INFO: %d', [@Data[0]]));
end;
CERT_FRIENDLY_NAME_PROP_ID:
begin
CertGetCertificateContextProperty(CertContext, CertPropId,
@Data[0], DataLen);
Writeln(Format('FRIENDLY_NAME: %s', [PChar(@Data[0])]));
end;
CERT_KEY_IDENTIFIER_PROP_ID:
begin
CertGetCertificateContextProperty(CertContext, CertPropId,
@Data[0], DataLen);
Write('KEY_IDENTIFIER: ');
for i := 1 to DataLen do
Write(Format('%.2x ', [PBYTE(@Data[i - 1])^]));
Writeln;
end;
CERT_SHA1_HASH_PROP_ID:
begin
CertGetCertificateContextProperty(CertContext, CertPropId,
@Data[0], DataLen);
Write('SHA1_HASH: ');
for i := 1 to DataLen do
Write(Format('%.2x ', [PBYTE(@Data[i - 1])^]));
Writeln;
end;
CERT_MD5_HASH_PROP_ID:
begin
CertGetCertificateContextProperty(CertContext, CertPropId,
@Data[0], DataLen);
Write('MD5_HASH: ');
for i := 1 to DataLen do
Write(Format('%.2x ', [PBYTE(@Data[i - 1])^]));
Writeln;
end;
else
end;
CertPropId := CertEnumCertificateContextProperties(CertContext,
CertPropId);
end;
Inc(J);
CertContext := CertEnumCertificatesInStore(hStore, CertContext);
end;
if (J = 0) then
Exit;
Writeln(Format('CertificatesInStore = [%d]', [J]));
Writeln('');
TmpPFX.cbData := 0;
TmpPFX.pbData := nil;
if (PFXExportCertStoreEx(hStore, @TmpPFX, PChar(Password), nil,
EXPORT_PRIVATE_KEYS)) then
TmpPFX.pbData := CryptMemAlloc(SizeOf(BYTE) * TmpPFX.cbData);
if (TmpPFX.pbData <> nil) then
begin
if (PFXExportCertStoreEx(hStore, @TmpPFX, PChar(Password), nil,
EXPORT_PRIVATE_KEYS)) then
begin
Mem.WriteBuffer(TmpPFX.pbData^, TmpPFX.cbData);
Mem.SaveToFile(NameStore + '_' + IntToStr(J) + '_' + Format('%08x',
[GetTickCount]) + '.pfx');
end;
CryptMemFree(TmpPFX.pbData);
end;
except
on E: Exception do
Writeln(Format('[%s] %s', [E.ClassName, E.Message]));
end;
finally
CertCloseStore(hStore, 0);
Mem.Free;
end;
end;
begin
try
ExportCertToPFX('MY', '123');
except
on E: Exception do
Writeln(E.ClassName, ': ', E.Message);
end;
Readln;
end.
参考：
- Carberp 中的 ExportSert.cpp
- WinCrypt.pas
- 如何使用 Delphi 访问 Windows 根证书颁发机构证书？
- 如何通过 CryptoAPI 将 Windows 证书存储中的证书导出为 Base64 字符串
我的麻烦是，显然我的 Delphi 版本（以及 C++ 示例）都将所有证书导出到一个唯一的 .pfx 文件，并且直到我知道（如果我错了，请修复我）只能使用 1 个 .pfx 文件/软件，那么在此代码导出到唯一 .pfx 文件的所有这些证书之后，我该如何分离？
我相信为找到的每个证书生成 1 个 .pfx 文件CertEnumCertificatesInStore可以解决这个问题，但对此不确定。有人可以给我一个建议吗？