如何将我所有的软件证书分别导出到 .pfx 文件？答案

【问题标题】：How export all my certificates of software separately to a .pfx file?如何将我所有的软件证书分别导出到 .pfx 文件？
【发布时间】：2018-07-31 13:10:42
【问题描述】：

我想以编程方式将我所有的软件证书分别导出到 .pfx 文件中，以签署 2 个新软件，这些新软件已经在另一台电脑上构建的最后一步。

为了做到这一点，我找到了一个 C++ 代码示例（在我翻译成 Delphi 之后）。

我的 Delphi 版本仍未经过测试，但即便如此，我认为它运行良好。

program CertToPFX;

{$APPTYPE CONSOLE}
{$R *.res}

uses
  Windows,
  WinCrypt,
  Classes,
  SysUtils;

var
  CertContext: PCCERT_CONTEXT;
  CertPropId: DWORD;
  Data: array [0 .. 511] of Char;
  DataLen: DWORD;

procedure DisplayCertContext(Cert: PCertContext);
var
  CertName: array [0 .. 255] of Char;
begin
  if CertGetNameString(CertContext, CERT_NAME_EMAIL_TYPE, 0, nil, CertName,
    256) = 0 then
    RaiseLastOSError;
  Writeln('Subject CERT_NAME_EMAIL_TYPE: ', CertName);
  if CertGetNameString(CertContext, CERT_NAME_SIMPLE_DISPLAY_TYPE, 0, nil,
    CertName, 256) = 0 then
    RaiseLastOSError;
  Writeln('Subject CERT_NAME_SIMPLE_DISPLAY_TYPE: ', CertName);
  if CertGetNameString(CertContext, CERT_NAME_FRIENDLY_DISPLAY_TYPE, 0, nil,
    CertName, 256) = 0 then
    RaiseLastOSError;
  Writeln('Subject CERT_NAME_FRIENDLY_DISPLAY_TYPE: ', CertName);

  if CertGetNameString(CertContext, CERT_NAME_EMAIL_TYPE, CERT_NAME_ISSUER_FLAG,
    nil, CertName, 256) = 0 then
    RaiseLastOSError;
  Writeln('Issuer CERT_NAME_EMAIL_TYPE: ', CertName);
  if CertGetNameString(CertContext, CERT_NAME_SIMPLE_DISPLAY_TYPE,
    CERT_NAME_ISSUER_FLAG, nil, CertName, 256) = 0 then
    RaiseLastOSError;
  Writeln('Issuer CERT_NAME_SIMPLE_DISPLAY_TYPE: ', CertName);
  if CertGetNameString(CertContext, CERT_NAME_FRIENDLY_DISPLAY_TYPE,
    CERT_NAME_ISSUER_FLAG, nil, CertName, 256) = 0 then
    RaiseLastOSError;
  Writeln('Issuer CERT_NAME_FRIENDLY_DISPLAY_TYPE: ', CertName);
end;

procedure ExportCertToPFX(NameStore, Password: string);
var
  TmpPFX: CRYPT_DATA_BLOB;
  hStore: HCERTSTORE;
  Mem: TMemoryStream;
  i, J: Integer;
begin
  hStore := CertOpenSystemStore(0, PChar(NameStore));
  if (hStore = nil) then
    RaiseLastOSError;
  Mem := TMemoryStream.Create;
  J := 0;
  try
    try
      CertContext := CertEnumCertificatesInStore(hStore, nil);
      while (CertContext <> nil) do
      begin
        DisplayCertContext(CertContext);
        CertPropId := CertEnumCertificateContextProperties(CertContext, 0);
        while CertPropId <> 0 do
        begin
          DataLen := 512;
          case CertPropId of
            CERT_KEY_PROV_HANDLE_PROP_ID:
              begin
                CertGetCertificateContextProperty(CertContext, CertPropId,
                  @Data[0], DataLen);
                Writeln(Format('KEY_PROV_HANDLE: $%.8x', [PDWORD(@Data[0])^]));
              end;
            CERT_KEY_PROV_INFO_PROP_ID:
              begin
                CertGetCertificateContextProperty(CertContext, CertPropId,
                  @Data[0], DataLen);
                with PCryptKeyProvInfo(@Data[0])^ do
                begin
                  Writeln(Format('pwszContainerName = %s',
                    [pwszContainerName]));
                  Writeln(Format('pwszProvName = %s', [pwszProvName]));
                  Writeln(Format('dwFlags = %d', [dwFlags]));
                  Writeln(Format('cProvParams = %d', [cProvParam]));
                  Writeln(Format('dwKeySpec = %d', [dwKeySpec]));
                end;
                Writeln(Format('KEY_PROV_INFO: %d', [@Data[0]]));
              end;
            CERT_FRIENDLY_NAME_PROP_ID:
              begin
                CertGetCertificateContextProperty(CertContext, CertPropId,
                  @Data[0], DataLen);
                Writeln(Format('FRIENDLY_NAME: %s', [PChar(@Data[0])]));
              end;
            CERT_KEY_IDENTIFIER_PROP_ID:
              begin
                CertGetCertificateContextProperty(CertContext, CertPropId,
                  @Data[0], DataLen);
                Write('KEY_IDENTIFIER: ');
                for i := 1 to DataLen do
                  Write(Format('%.2x ', [PBYTE(@Data[i - 1])^]));
                Writeln;
              end;
            CERT_SHA1_HASH_PROP_ID:
              begin
                CertGetCertificateContextProperty(CertContext, CertPropId,
                  @Data[0], DataLen);
                Write('SHA1_HASH: ');
                for i := 1 to DataLen do
                  Write(Format('%.2x ', [PBYTE(@Data[i - 1])^]));
                Writeln;
              end;
            CERT_MD5_HASH_PROP_ID:
              begin
                CertGetCertificateContextProperty(CertContext, CertPropId,
                  @Data[0], DataLen);
                Write('MD5_HASH: ');
                for i := 1 to DataLen do
                  Write(Format('%.2x ', [PBYTE(@Data[i - 1])^]));
                Writeln;
              end;
          else
          end;
          CertPropId := CertEnumCertificateContextProperties(CertContext,
            CertPropId);
        end;
        Inc(J);
        CertContext := CertEnumCertificatesInStore(hStore, CertContext);
      end;

      if (J = 0) then
        Exit;

      Writeln(Format('CertificatesInStore = [%d]', [J]));
      Writeln('');

      TmpPFX.cbData := 0;
      TmpPFX.pbData := nil;

      if (PFXExportCertStoreEx(hStore, @TmpPFX, PChar(Password), nil,
        EXPORT_PRIVATE_KEYS)) then

        TmpPFX.pbData := CryptMemAlloc(SizeOf(BYTE) * TmpPFX.cbData);

      if (TmpPFX.pbData <> nil) then
      begin

        if (PFXExportCertStoreEx(hStore, @TmpPFX, PChar(Password), nil,
          EXPORT_PRIVATE_KEYS)) then
        begin

          Mem.WriteBuffer(TmpPFX.pbData^, TmpPFX.cbData);

          Mem.SaveToFile(NameStore + '_' + IntToStr(J) + '_' + Format('%08x',
            [GetTickCount]) + '.pfx');
        end;
        CryptMemFree(TmpPFX.pbData);
      end;
    except
      on E: Exception do
        Writeln(Format('[%s] %s', [E.ClassName, E.Message]));
    end;
  finally
    CertCloseStore(hStore, 0);
    Mem.Free;
  end;
end;

begin
  try
    ExportCertToPFX('MY', '123');
  except
    on E: Exception do
      Writeln(E.ClassName, ': ', E.Message);
  end;
  Readln;

end.

参考文献：

我的麻烦是，显然我的 Delphi 版本（以及 C++ 示例）都将所有证书导出到一个唯一的 .pfx 文件，直到我知道（如果我错了，请纠正我）只能使用 1 。 pfx 文件/软件，那么在此代码导出到唯一 .pfx 文件的所有这些证书之后，我该如何分离？

我相信为CertEnumCertificatesInStore 中的每个证书生成 1 个 .pfx 文件可以解决这个问题，但对此不确定。有人可以给我一个建议吗？

【问题讨论】：

为每个证书创建一个内存存储（CertStoreOpen）：CertAddCertificateLinkToStore，PFXExportCertStore 内存存储，保存它，CertDeleteCertificateFromStore，（迭代）。
@bartonjs，我有一个疑问：CertDeleteCertificateFromStore 有CertDuplicateCertificateContext 还是没有？

标签： delphi delphi-10-seattle digital-certificate pfx wincrypt

【解决方案1】：

嗯，这是一个基于 @bartonjs

建议的可能解决方案

var
  CertContext: PCCERT_CONTEXT;

procedure ExportCertToPFX(NameStore, Password: string);
var
  TmpPFX: CRYPT_DATA_BLOB;
  hTempStore: HCERTSTORE;
begin

  hTempStore := CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
    CERT_STORE_CREATE_NEW_FLAG, nil);
  if (hTempStore = nil) then
    RaiseLastOSError;

  try
    CertContext := CertEnumCertificatesInStore(hStore, nil);
    while (CertContext <> nil) do
    begin

      if not CertAddCertificateContextToStore(hTempStore, CertContext,
        CERT_STORE_ADD_NEW, nil) then
        Continue;

      TmpPFX.cbData := 0;
      TmpPFX.pbData := nil;

      if (PFXExportCertStoreEx(hTempStore, @TmpPFX, PChar(Password), nil,
        EXPORT_PRIVATE_KEYS)) then

        TmpPFX.pbData := CryptMemAlloc(SizeOf(BYTE) * TmpPFX.cbData);

      if (TmpPFX.pbData <> nil) then
      begin

        if (PFXExportCertStoreEx(hTempStore, @TmpPFX, PChar(Password), nil,
          EXPORT_PRIVATE_KEYS)) then
        begin

          // Save to .pfx file

        end;

        CryptMemFree(TmpPFX.pbData);
      end;

      if not CertDeleteCertificateFromStore
        (CertDuplicateCertificateContext(CertContext)) then
        if (GetLastError = Cardinal(E_ACCESSDENIED)) then
          Continue;

      CertContext := CertEnumCertificatesInStore(hStore, CertContext);
    end;
  except
    on E: Exception do
      Writeln(Format('[%s] %s', [E.ClassName, E.Message]));
  CertCloseStore(hTempStore, 0);
  end;
CertCloseStore(hTempStore, 0);
end;

【讨论】：