X509VerificationFlags 枚举

定义

指定应对 X509 链中证书进行验证的条件。

此枚举支持其成员值的按位组合。

public enum class X509VerificationFlags
[System.Flags]
public enum X509VerificationFlags
[<System.Flags>]
type X509VerificationFlags = 
Public Enum X509VerificationFlags
继承
X509VerificationFlags
属性

字段

AllFlags 4095

包含所有与验证相关的标志。

AllowUnknownCertificateAuthority 16

忽略由于 CA) 或部分链 (未知证书颁发机构而无法验证链。

IgnoreCertificateAuthorityRevocationUnknown 1024

确定证书验证时,忽略证书颁发机构吊销未知的情况。

IgnoreCtlNotTimeValid 2

确定证书验证时,忽略由于 CTL 已过期等原因导致证书信任列表 (CTL) 无效的情况。

IgnoreCtlSignerRevocationUnknown 512

确定证书验证时,忽略证书信任列表 (CTL) 签名者吊销未知的情况。

IgnoreEndRevocationUnknown 256

确定证书验证时,忽略最终证书(用户证书)吊销未知的情况。

IgnoreInvalidBasicConstraints 8

确定证书验证时,忽略基本约束无效的情况。

IgnoreInvalidName 64

确定证书验证时,忽略证书具有无效名称的情况。

IgnoreInvalidPolicy 128

确定证书验证时,忽略证书具有无效策略的情况。

IgnoreNotTimeNested 4

证书验证时,忽略 CA(证书颁发机构)证书和所颁发证书的有效期不重叠的情况。 例如,CA 证书的有效期可为 1 月 1 日至 12 月 1 日,而颁发证书的有效期为 1 月 2 日至 12 月 2 日,这就意味着有效期不嵌套。

IgnoreNotTimeValid 1

确定证书验证时,忽略链中因已过期或尚未生效而无效的证书。

IgnoreRootRevocationUnknown 2048

确定证书验证时,忽略根吊销未知的情况。

IgnoreWrongUsage 32

确定证书验证时,忽略证书不是为当前使用而颁发的情况。

NoFlag 0

不包含任何与验证相关的标志。

示例

以下示例打开当前用户的个人证书存储,允许用户选择证书,然后将证书和证书链信息写入控制台。 输出取决于所选的证书。

//Output chain information of the selected certificate.
X509Chain ^ ch = gcnew X509Chain;
ch->ChainPolicy->RevocationMode = X509RevocationMode::Online;
ch->Build( certificate );
Console::WriteLine( "Chain Information" );
Console::WriteLine( "Chain revocation flag: {0}", ch->ChainPolicy->RevocationFlag );
Console::WriteLine( "Chain revocation mode: {0}", ch->ChainPolicy->RevocationMode );
Console::WriteLine( "Chain verification flag: {0}", ch->ChainPolicy->VerificationFlags );
Console::WriteLine( "Chain verification time: {0}", ch->ChainPolicy->VerificationTime );
Console::WriteLine( "Chain status length: {0}", ch->ChainStatus->Length );
Console::WriteLine( "Chain application policy count: {0}", ch->ChainPolicy->ApplicationPolicy->Count );
Console::WriteLine( "Chain certificate policy count: {0} {1}", ch->ChainPolicy->CertificatePolicy->Count, Environment::NewLine );
//Output chain information of the selected certificate.
X509Chain ch = new X509Chain();
ch.ChainPolicy.RevocationMode = X509RevocationMode.Online;
ch.Build (certificate);
Console.WriteLine ("Chain Information");
Console.WriteLine ("Chain revocation flag: {0}", ch.ChainPolicy.RevocationFlag);
Console.WriteLine ("Chain revocation mode: {0}", ch.ChainPolicy.RevocationMode);
Console.WriteLine ("Chain verification flag: {0}", ch.ChainPolicy.VerificationFlags);
Console.WriteLine ("Chain verification time: {0}", ch.ChainPolicy.VerificationTime);
Console.WriteLine ("Chain status length: {0}", ch.ChainStatus.Length);
Console.WriteLine ("Chain application policy count: {0}", ch.ChainPolicy.ApplicationPolicy.Count);
Console.WriteLine ("Chain certificate policy count: {0} {1}", ch.ChainPolicy.CertificatePolicy.Count, Environment.NewLine);
'Output chain information of the selected certificate.
Dim ch As New X509Chain()
ch.ChainPolicy.RevocationMode = X509RevocationMode.Online
ch.Build(certificate)
Console.WriteLine("Chain Information")
Console.WriteLine("Chain revocation flag: {0}", ch.ChainPolicy.RevocationFlag)
Console.WriteLine("Chain revocation mode: {0}", ch.ChainPolicy.RevocationMode)
Console.WriteLine("Chain verification flag: {0}", ch.ChainPolicy.VerificationFlags)
Console.WriteLine("Chain verification time: {0}", ch.ChainPolicy.VerificationTime)
Console.WriteLine("Chain status length: {0}", ch.ChainStatus.Length)
Console.WriteLine("Chain application policy count: {0}", ch.ChainPolicy.ApplicationPolicy.Count)
Console.WriteLine("Chain certificate policy count: {0} {1}", ch.ChainPolicy.CertificatePolicy.Count, Environment.NewLine)

注解

这些标志指示应在哪些条件下进行链验证。 例如,如果应用程序不需要链中的证书时间值有效,则可以使用 IgnoreNotTimeValid 标志。

适用于