原文链接：http://support.microsoft.com/kb/925521/zh-cn
创建一个命令行程序集更新证书。若要执行此操作，请执行以下步骤。
Microsoft 提供的编程示例仅用于说明，没有任何明示或暗示的担保。这包括但不限于适销性或特定用途适用性的暗示保证。本文假定您熟悉所演示的编程语言和用于创建和调试过程的工具。Microsoft 的支持工程师可以帮助解释某个特定过程的功能。但是，他们不会修改这些示例以提供额外的功能或构建过程以满足您的特定要求。
- 在 Visual Studio 2005 中，在文件菜单上，单击新建，然后单击项目。
- 单击Visual C++ Win32 控制台应用程序中的名称框中，键入RenewCert和，然后单击确定。
- 在Win32 应用程序向导对话框中，单击完成。
- 在 RenewCert.cpp 文件中，将现有代码替换为以下代码：
#include "stdafx.h" void ReadPFXFile(LPCWSTR fileName, CRYPT_DATA_BLOB *pPFX) { HANDLE hCertFile = NULL; DWORD cbRead = 0; DWORD dwFileSize = 0, dwFileSizeHi = 0; hCertFile = CreateFile(fileName, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL); dwFileSize = GetFileSize(hCertFile, &dwFileSizeHi); pPFX->pbData = (BYTE *) CryptMemAlloc(dwFileSize*sizeof(BYTE)); pPFX->cbData = dwFileSize; ReadFile(hCertFile, pPFX->pbData, pPFX->cbData, &cbRead, NULL); CloseHandle(hCertFile); } void GetPrivateKey(CRYPT_DATA_BLOB pPFX, LPCWSTR szPassword, HCRYPTPROV *hCPContext) { HCERTSTORE hCertStore = NULL; PCCERT_CONTEXT hCertContext = NULL; DWORD dwKeySpec = AT_SIGNATURE; BOOL bFreeCertKey = TRUE; hCertStore = PFXImportCertStore(&pPFX, szPassword, CRYPT_EXPORTABLE); hCertContext = CertEnumCertificatesInStore(hCertStore, NULL); CryptAcquireCertificatePrivateKey(hCertContext, 0, NULL, hCPContext, &dwKeySpec, &bFreeCertKey); CertCloseStore(hCertStore, CERT_CLOSE_STORE_FORCE_FLAG); } void PrintContainerName(HCRYPTPROV hCPContext) { DWORD containerNameLen = 0; CHAR *szContainerName = NULL; CryptGetProvParam(hCPContext, PP_CONTAINER, NULL, &containerNameLen, 0); szContainerName = (CHAR *)CryptMemAlloc(sizeof(BYTE)*containerNameLen); CryptGetProvParam(hCPContext, PP_CONTAINER, (BYTE *)szContainerName, &containerNameLen, 0); printf("This certificate's container name is: %s", szContainerName); } void MakeNewCert(HCRYPTPROV hCPContext, LPCWSTR szCertName, LPCWSTR szPassword, CRYPT_DATA_BLOB *pPFX) { CERT_NAME_BLOB certNameBlob = {0,NULL}; PCCERT_CONTEXT hCertContext = NULL; SYSTEMTIME certExpireDate; HCERTSTORE hTempStore = NULL; CertStrToName(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, szCertName, CERT_OID_NAME_STR, NULL, NULL, &certNameBlob.cbData, NULL); certNameBlob.pbData = (BYTE *)CryptMemAlloc(sizeof(BYTE)*certNameBlob.cbData); CertStrToName(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, szCertName, CERT_OID_NAME_STR, NULL, certNameBlob.pbData, &certNameBlob.cbData, NULL); GetSystemTime(&certExpireDate); certExpireDate.wYear += 5; hCertContext = CertCreateSelfSignCertificate(hCPContext, &certNameBlob, 0, NULL, NULL, NULL, &certExpireDate, NULL); hTempStore = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, NULL, CERT_STORE_CREATE_NEW_FLAG, 0); CertAddCertificateContextToStore(hTempStore, hCertContext, CERT_STORE_ADD_NEW, NULL); PFXExportCertStoreEx(hTempStore, pPFX, szPassword, NULL, EXPORT_PRIVATE_KEYS); pPFX->pbData = (BYTE *)CryptMemAlloc(sizeof(BYTE)*pPFX->cbData); PFXExportCertStoreEx(hTempStore, pPFX, szPassword, NULL, EXPORT_PRIVATE_KEYS); CryptMemFree(certNameBlob.pbData); CertCloseStore(hTempStore, CERT_CLOSE_STORE_FORCE_FLAG); CertFreeCertificateContext(hCertContext); } void WritePFX(CRYPT_DATA_BLOB pPFX, LPCWSTR szOutputFile) { HANDLE hOutputFile = NULL; DWORD cbWritten = 0; hOutputFile = CreateFile(szOutputFile, GENERIC_READ | GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_FLAG_SEQUENTIAL_SCAN, NULL); WriteFile(hOutputFile, pPFX.pbData, pPFX.cbData, &cbWritten, NULL); CloseHandle(hOutputFile); } int _tmain(int argc, _TCHAR* argv[]) { LPCWSTR szCertFileName = NULL; CRYPT_DATA_BLOB pPFX; LPCWSTR szPassword = NULL; HCRYPTPROV hCPContext = NULL; LPCWSTR szCertName = L"CN=NewCert"; CRYPT_DATA_BLOB pPfxOutputBlob = {0,NULL}; LPCWSTR szOutFile = NULL; // Parse the command line. if(argc == 1) { printf("renewcert <PFX File> <new cert filename> <new cert friendly name> [optional]<password>\n"); printf("Example: renewcert oldcert.pfx newcert.pfx \"CN=MyNewCert\" MySuperSecretPassword"); return 0; } if(argc >= 2) szCertFileName = argv[1]; if(argc >= 5) szPassword = argv[4]; // Uncomment this block to add <new cert filename> and <new cert friendly name> as parameters // NOTE: <new cert friendly name> must be of format "CN=<name>" if(argc >= 3) szOutFile = argv[2]; if(argc >= 4) szCertName = argv[3]; ReadPFXFile(szCertFileName, &pPFX); GetPrivateKey(pPFX, szPassword, &hCPContext); //PrintContainerName(hCPContext); // Uncomment this section to make a new PFX rather than just printing the container name. // Make sure you also uncomment the command line parameter section above. MakeNewCert(hCPContext, szCertName, szPassword, &pPfxOutputBlob); WritePFX(pPfxOutputBlob, szOutFile); // Clean up. CryptReleaseContext(hCPContext, 0); CryptMemFree(pPfxOutputBlob.pbData); CryptMemFree(pPFX.pbData); return 0; } - 在 stdafx.h 文件中，将现有代码替换为以下代码：
// stdafx.h : include file for standard system include files, // or project specific include files that are used frequently, but // are changed infrequently. // #pragma once #define WIN32_LEAN_AND_MEAN // Exclude rarely used material from Windows headers. #include <stdio.h> #include <tchar.h> #include <windows.h> #include <wincrypt.h>
- 在项目菜单上，单击属性以打开属性页中的为此项目。
- 展开链接器节点，然后单击输入。
- 在空白窗口右侧的附加依赖项，请单击，然后单击省略号按钮 (...) 在附加依赖项对话框中打开。
- 在空白的窗口中，键入Crypt32.lib，然后单击确定。
- 单击应用，然后单击确定以关闭属性页。
- 在生成菜单中，单击生成解决方案。
- 生成解决方案后，执行以下命令，以更新证书，请：
注意 <OldCertificate> 为原来的证书的占位符 <NewCertificate> 为新的证书的占位符 <NewCertificateName> 为新的证书和<Password> 为密码的占位符。
renewcert <OldCertificate>.pfx <NewCertificate>.pfx \"CN=<NewCertificateName>\" <Password>