问题标签 [makecert]

是否可以使用 makecert 或任何其他我可以用来生成我自己的测试证书的工具来设置密钥使用属性？

我感兴趣的原因是用于 BizTalk Server AS2 传输的证书需要使用数字签名的密钥进行签名和数据加密或密钥加密以进行加密/解密，我想尝试使用此功能。

我看到了如何使用 makecert 设置增强的密钥使用属性，而不是密钥使用。

我正在使用带有以下参数的 makecert 创建 x509 证书：

makecert -r -pe -n "CN=Client" -ss MyApp

我想使用此证书通过 RSA 算法加密和解密数据。我希望在 Windows 证书存储中生成证书，一切似乎都很好（它有一个私钥，公钥是一个 1024 位的 RSA 密钥等等..）

现在我使用这个 C# 代码来加密数据：

执行 Encrypt 方法时，我收到带有消息“Bad key”的 CryptographicException。

我认为代码很好。可能我没有正确创建证书。任何意见？谢谢

---------------- 编辑 --------------
如果有人知道如何使用 OpenSsl 创建证书，它对我来说也是一个有效的答案。

我想生成一个密钥对以在我的应用程序中使用，但是从 mmc 手动导出它们很痛苦。

如何使用命令行参数，或者以其他方式最终获得位于硬盘驱动器上的私有证书，适合以后分发？

亲爱的女士们先生们。观察这个简单的批处理文件：

但是，最后一个 makecert 失败并显示以下错误消息：

我该如何解决？有任何想法吗？顺便说一句，第一个 makecert 成功了。当然，我再次删除它，然后再次运行命令。

谢谢。

编辑1

我明白失败的原因。第二个命令期望文件 MyCA.pvk 存在，但我不想保留它。那么，我能做些什么呢？

I am trying to setup a WCF service to use a Certificate for Authenticating the client. I have read tons of posts on how to create the certificate, and I have been able to do so (finally).

I am installing the Cert Authority and the Cert on a server that runs Windows 2008 R2. When I open the MMC Certificates Snap-in, I choose Computer Account. Is this correct? I am doing this because my WCF service will run in a Windows Service, and will be running even when no user's are logged in. But admittedly, I don't know what the difference is between the three options:

1. My user account
2. Service account
3. Computer account

Once the snap-in loads, I import the Authority Cert into Trusted Root Certification Authorities. Then, I import the cert into Trusted Publishers. I don't encounter any errors when doing this. When I do the import, of both the Authority Cert and the Cert signed by that authority, I don't make any reference to the .pvk file. It is my understanding that the private key is embedded in either the cert or the authority cert. Here are the commands I use to create each cert:

Notice I used -ss root. I have seen many posts using -ss My. I don't really understand what the difference is or when it is appropriate to use each value.

My WCF service runs on this machine inside a Managed Service (Windows Service). When I start my windows service, which hosts the WCF service, it crashes immediately and a seemingly common error is reported in the event viewer:

System.ArgumentException: It is likely that certificate 'CN=TempCertName' may not have a private key that is capable of key exchange or the process may not have access rights for the private key

I have found posts that say I need to grant permissions to the user running the service to the key.

This one seems to be a popular answer here on stackoverflow: Grant access with All Tasks/Manage Private Keys

But I don't have the option of All Tasks/Manage Private Keys

But I'm not clear on how to do that. But also, the service is running under my domain account, which is an administrator and is also the same user that installed the cert.

Please Help :)

我正在使用 Windows 7。我没有makecert.exe，当我尝试运行命令来生成证书时我才知道

我得到错误：

请建议如何解决此问题。我是否需要再次安装 Windows SDK。

问候，普拉文。

我正在使用 Fiddler2（或尝试）为 Windows 桌面小工具捕获 SSL 流量，以访问 https Web 服务。它曾经可以工作，然后几天前就停止了，总是出现以下错误：

（我从 google 组中刷了 fiddler 的错误，尽管我刚刚发布了自己的错误，应该很快就会看到）。

有没有其他人遇到过这个问题并解决了？Fiddler刚刚坏了吗？

是否可以使用 makecert 来生成 ECRSA、Deffie-Helman、EC Deffie-Helman 不对称公钥和 DSA、ECDSA 用于私钥。

万分感谢。

Is it possible to create a X.509V3 certificate that contains deffie-Hellman public key and sign it using DSA or ECDSA algorithm ?

i hop doing this using makecert

Think you a lot

I need to programatically create the equivalant keys in a .NET application...

makecert -r -pe -a sha1 -n "CN=MyName" -ss my -sr CurrentUser -sky exchange

makecert -r -pe -a sha1 -n "CN=MyName" -ss my -sr CurrentUser -sky signature

The output will ultimately be used like this: