如何通过X509Certificate2Collection链验证X509Certificate2

X509Certificate2Collection

WSSecurityTokenSerializer

// get the base 64 encoded SAML
string samlAssertionRaw = GetFromHttpRequest();

// load a new XML document
var assertion = new XmlDocument { PreserveWhitespace = true };
assertion.LoadXml(samlAssertionRaw);

// use a namespace manager to avoid the worst of xpaths
var ns = new XmlNamespaceManager(assertion.NameTable);
ns.AddNamespace(\"samlp\", @\"urn:oasis:names:tc:SAML:2.0:protocol\");
ns.AddNamespace(\"saml\", @\"urn:oasis:names:tc:SAML:2.0:assertion\");
ns.AddNamespace(\"ds\", SignedXml.XmlDsigNamespaceUrl);

// get the signature XML node
var signNode = assertion.SelectSingleNode(
    \"/samlp:Response/saml:Assertion/ds:Signature\", ns);

// load the XML signature
var signedXml = new SignedXml(assertion.DocumentElement);
signedXml.LoadXml(signNode as XmlElement);

// get the certificate, basically:
// signedXml.KeyInfo.OfType<KeyInfoX509Data>().First().
//     Certificates.OfType<X509Certificate2>().First()
// but with added checks
var certificate = GetFirstX509Certificate(signedXml);

// check the key and signature match
if (!signedXml.CheckSignature(certificate, true))
{
    throw new SecurityException(\"Signature check failed.\");
}

// go on and read the SAML attributes from the XML doc

certificate.Verify()

signedXml.CheckSignature(certificate, false)

.p7b

X509Certificate2Collection

.p7b

CheckSignature