X509VerificationFlags 枚举

定义

命名空间:

System.Security.Cryptography.X509Certificates

程序集:

System.Security.Cryptography.dll

指定应对 X509 链中证书进行验证的条件。

此枚举支持其成员值的按位组合。

public enum class X509VerificationFlags

[System.Flags]
public enum X509VerificationFlags

[<System.Flags>]
type X509VerificationFlags = 

Public Enum X509VerificationFlags

继承

Object

ValueType

Enum

X509VerificationFlags

属性

FlagsAttribute

字段

AllFlags	4095	包含所有与验证相关的标志。
AllowUnknownCertificateAuthority	16	忽略由于 CA) 或部分链 (未知证书颁发机构而无法验证链。
IgnoreCertificateAuthorityRevocationUnknown	1024	确定证书验证时，忽略证书颁发机构吊销未知的情况。
IgnoreCtlNotTimeValid	2	确定证书验证时，忽略由于 CTL 已过期等原因导致证书信任列表 (CTL) 无效的情况。
IgnoreCtlSignerRevocationUnknown	512	确定证书验证时，忽略证书信任列表 (CTL) 签名者吊销未知的情况。
IgnoreEndRevocationUnknown	256	确定证书验证时，忽略最终证书（用户证书）吊销未知的情况。
IgnoreInvalidBasicConstraints	8	确定证书验证时，忽略基本约束无效的情况。
IgnoreInvalidName	64	确定证书验证时，忽略证书具有无效名称的情况。
IgnoreInvalidPolicy	128	确定证书验证时，忽略证书具有无效策略的情况。
IgnoreNotTimeNested	4	证书验证时，忽略 CA（证书颁发机构）证书和所颁发证书的有效期不重叠的情况。 例如，CA 证书的有效期可为 1 月 1 日至 12 月 1 日，而颁发证书的有效期为 1 月 2 日至 12 月 2 日，这就意味着有效期不嵌套。
IgnoreNotTimeValid	1	确定证书验证时，忽略链中因已过期或尚未生效而无效的证书。
IgnoreRootRevocationUnknown	2048	确定证书验证时，忽略根吊销未知的情况。
IgnoreWrongUsage	32	确定证书验证时，忽略证书不是为当前使用而颁发的情况。
NoFlag	0	不包含任何与验证相关的标志。

示例

以下示例打开当前用户的个人证书存储，允许用户选择证书，然后将证书和证书链信息写入控制台。 输出取决于所选的证书。

//Output chain information of the selected certificate.
X509Chain ^ ch = gcnew X509Chain;
ch->ChainPolicy->RevocationMode = X509RevocationMode::Online;
ch->Build( certificate );
Console::WriteLine( "Chain Information" );
Console::WriteLine( "Chain revocation flag: {0}", ch->ChainPolicy->RevocationFlag );
Console::WriteLine( "Chain revocation mode: {0}", ch->ChainPolicy->RevocationMode );
Console::WriteLine( "Chain verification flag: {0}", ch->ChainPolicy->VerificationFlags );
Console::WriteLine( "Chain verification time: {0}", ch->ChainPolicy->VerificationTime );
Console::WriteLine( "Chain status length: {0}", ch->ChainStatus->Length );
Console::WriteLine( "Chain application policy count: {0}", ch->ChainPolicy->ApplicationPolicy->Count );
Console::WriteLine( "Chain certificate policy count: {0} {1}", ch->ChainPolicy->CertificatePolicy->Count, Environment::NewLine );

//Output chain information of the selected certificate.
X509Chain ch = new X509Chain();
ch.ChainPolicy.RevocationMode = X509RevocationMode.Online;
ch.Build (certificate);
Console.WriteLine ("Chain Information");
Console.WriteLine ("Chain revocation flag: {0}", ch.ChainPolicy.RevocationFlag);
Console.WriteLine ("Chain revocation mode: {0}", ch.ChainPolicy.RevocationMode);
Console.WriteLine ("Chain verification flag: {0}", ch.ChainPolicy.VerificationFlags);
Console.WriteLine ("Chain verification time: {0}", ch.ChainPolicy.VerificationTime);
Console.WriteLine ("Chain status length: {0}", ch.ChainStatus.Length);
Console.WriteLine ("Chain application policy count: {0}", ch.ChainPolicy.ApplicationPolicy.Count);
Console.WriteLine ("Chain certificate policy count: {0} {1}", ch.ChainPolicy.CertificatePolicy.Count, Environment.NewLine);

'Output chain information of the selected certificate.
Dim ch As New X509Chain()
ch.ChainPolicy.RevocationMode = X509RevocationMode.Online
ch.Build(certificate)
Console.WriteLine("Chain Information")
Console.WriteLine("Chain revocation flag: {0}", ch.ChainPolicy.RevocationFlag)
Console.WriteLine("Chain revocation mode: {0}", ch.ChainPolicy.RevocationMode)
Console.WriteLine("Chain verification flag: {0}", ch.ChainPolicy.VerificationFlags)
Console.WriteLine("Chain verification time: {0}", ch.ChainPolicy.VerificationTime)
Console.WriteLine("Chain status length: {0}", ch.ChainStatus.Length)
Console.WriteLine("Chain application policy count: {0}", ch.ChainPolicy.ApplicationPolicy.Count)
Console.WriteLine("Chain certificate policy count: {0} {1}", ch.ChainPolicy.CertificatePolicy.Count, Environment.NewLine)

注解

这些标志指示应在哪些条件下进行链验证。 例如，如果应用程序不需要链中的证书时间值有效，则可以使用 IgnoreNotTimeValid 标志。