private static X509Certificate GetCertificate(SignerInformation signer, IX509Store cmsCertificates)
        {
            X509Certificate cert = null;

            // Create a selector with the information necessary to
            // find the signer certificate
            X509CertStoreSelector sel = new X509CertStoreSelector();
            sel.Issuer = signer.SignerID.Issuer;
            sel.SerialNumber = signer.SignerID.SerialNumber;

            // Try find a match
            IList certificatesFound = new ArrayList( cmsCertificates.GetMatches(sel) );

            if (certificatesFound.Count > 0) // Match found
            {
                // Load certificate from CMS

                Console.WriteLine("Loading signer's certificate from CMS...");

                cert = (X509Certificate)certificatesFound[0];
            }
            else
            {
                // Load certificate from file

                Console.WriteLine("Loading signer's certificate from file...");

                ReadCertificate("..\\..\\example.cer");
            }
            return cert;
        }

		public static IList GetCertificatesFromStore(
			IX509Store certStore)
		{
			try
			{
				IList certs = Platform.CreateArrayList();

				if (certStore != null)
				{
					foreach (X509Certificate c in certStore.GetMatches(null))
					{
						certs.Add(
							X509CertificateStructure.GetInstance(
								Asn1Object.FromByteArray(c.GetEncoded())));
					}
				}

				return certs;
			}
			catch (CertificateEncodingException e)
			{
				throw new CmsException("error encoding certs", e);
			}
			catch (Exception e)
			{
				throw new CmsException("error processing certs", e);
			}
		}

        public static IList GetCrlsFromStore(
			IX509Store crlStore)
        {
            try
            {
                IList crls = new ArrayList();

                if (crlStore != null)
                {
                    foreach (X509Crl c in crlStore.GetMatches(null))
                    {
                        crls.Add(
                            CertificateList.GetInstance(
                                Asn1Object.FromByteArray(c.GetEncoded())));
                    }
                }

                return crls;
            }
            catch (CrlException e)
            {
                throw new CmsException("error encoding crls", e);
            }
            catch (Exception e)
            {
                throw new CmsException("error processing crls", e);
            }
        }

        internal TripleUnwrapper(Level? level, ITimemarkProvider timemarkauthority, X509Certificate2Collection encCerts)
        {
            if (level == Level.L_Level || level == Level.A_level ) throw new ArgumentException("level", "Only null or levels B, T, LT and LTA are allowed");

            this.level = level;
            this.timemarkauthority = timemarkauthority;
            //Wrap it inside a IX509Store to (incorrectly) returns an windows x509Certificate2
            encCertStore = encCerts == null || encCerts.Count == 0 ? null : new WinX509CollectionStore(encCerts);
        }

        public static CertificateSecurityInformation VerifyAuth(Org.BouncyCastle.X509.X509Certificate cert, DateTime date, IX509Store certs, IList<CertificateList> crls, IList<BasicOcspResponse> ocsps, bool checkRevocation, bool checkTime)
        {
            CertificateSecurityInformation result = Verify(cert, date, certs, crls, ocsps, checkRevocation, checkTime);

            if (!cert.GetKeyUsage()[0])
            {
                result.securityViolations.Add(CertSecurityViolation.NotValidForUsage);
                trace.TraceEvent(TraceEventType.Warning, 0, "The key usage did not have the correct usage flag set");
            }

            return result;
        }

 public void AddCrls(IX509Store crlStore)
 {
     CollectionUtilities.AddRange(_crls, CmsUtilities.GetCrlsFromStore(crlStore));
 }

 public void AddCertificates(IX509Store certStore)
 {
     CollectionUtilities.AddRange(_certs, CmsUtilities.GetCertificatesFromStore(certStore));
 }

        private static CertificateSecurityInformation Verify(Org.BouncyCastle.X509.X509Certificate cert, DateTime date, IX509Store certs, IList<CertificateList> crls, IList<BasicOcspResponse> ocsps, bool checkRevocation, bool checkTime)
        {
            CertificateSecurityInformation result = new CertificateSecurityInformation();

            AsymmetricKeyParameter key = cert.GetPublicKey();

            //check key type
            if (!(key is RsaKeyParameters))
            {
                result.securityViolations.Add(CertSecurityViolation.NotValidKeyType);
                trace.TraceEvent(TraceEventType.Warning, 0, "The key should be RSA but was {0}", key.GetType());
            }

            //check key size
            if (!VerifyKeySize(key, EteeActiveConfig.Unseal.MinimumSignatureKeySize))
            {
                result.securityViolations.Add(CertSecurityViolation.NotValidKeySize);
                trace.TraceEvent(TraceEventType.Warning, 0, "The key was smaller then {0}", EteeActiveConfig.Unseal.MinimumSignatureKeySize);
            }

            X509Certificate2Collection extraStore = new X509Certificate2Collection();
            foreach (Org.BouncyCastle.X509.X509Certificate obj in certs.GetMatches(null))
            {
                extraStore.Add(new X509Certificate2(obj.GetEncoded()));
            }
            Chain chain;
            if (checkRevocation)
                chain = new X509Certificate2(cert.GetEncoded()).BuildChain(date, extraStore, ref crls, ref ocsps, checkTime ? DateTime.UtcNow : date);
            else
                chain = new X509Certificate2(cert.GetEncoded()).BuildBasicChain(date, extraStore);

            CertificateSecurityInformation dest = null;
            foreach (ChainElement ce in chain.ChainElements)
            {
                if (dest == null) {
                    dest = result;
                }
                else
                {
                    dest.IssuerInfo = new CertificateSecurityInformation();
                    dest = dest.IssuerInfo;
                }

                dest.Certificate = ce.Certificate;
                foreach (X509ChainStatus status in ce.ChainElementStatus.Where(x => x.Status != X509ChainStatusFlags.NoError))
                {
                    dest.securityViolations.Add((CertSecurityViolation)Enum.Parse(typeof(CertSecurityViolation), Enum.GetName(typeof(X509ChainStatusFlags), status.Status)));
                }
            }
            if (chain.ChainStatus.Count(x => x.Status == X509ChainStatusFlags.PartialChain) > 0)
            {
                result.securityViolations.Add(CertSecurityViolation.IssuerTrustUnknown);
            }

            trace.TraceEvent(TraceEventType.Verbose, 0, "Verified certificate {0} for date {1}", cert.SubjectDN.ToString(), date);
            return result;
        }

		/**
		* Replace the certificate and CRL information associated with this
		* CmsSignedData object with the new one passed in.
		*
		* @param signedData the signed data object to be used as a base.
		* @param x509Certs the new certificates to be used.
		* @param x509Crls the new CRLs to be used.
		* @return a new signed data object.
		* @exception CmsException if there is an error processing the stores
		*/
		public static CmsSignedData ReplaceCertificatesAndCrls(
			CmsSignedData	signedData,
			IX509Store		x509Certs,
			IX509Store		x509Crls,
			IX509Store		x509AttrCerts)
		{
			if (x509AttrCerts != null)
				throw Platform.CreateNotImplementedException("Currently can't replace attribute certificates");

			//
			// copy
			//
			CmsSignedData cms = new CmsSignedData(signedData);

			//
			// replace the certs and crls in the SignedData object
			//
			Asn1Set certs = null;
			try
			{
				Asn1Set asn1Set = CmsUtilities.CreateBerSetFromList(
					CmsUtilities.GetCertificatesFromStore(x509Certs));

				if (asn1Set.Count != 0)
				{
					certs = asn1Set;
				}
			}
			catch (X509StoreException e)
			{
				throw new CmsException("error getting certificates from store", e);
			}

			Asn1Set crls = null;
			try
			{
				Asn1Set asn1Set = CmsUtilities.CreateBerSetFromList(
					CmsUtilities.GetCrlsFromStore(x509Crls));

				if (asn1Set.Count != 0)
				{
					crls = asn1Set;
				}
			}
			catch (X509StoreException e)
			{
				throw new CmsException("error getting CRLs from store", e);
			}

			//
			// replace the CMS structure.
			//
			SignedData old = signedData.signedData;
			cms.signedData = new SignedData(
				old.DigestAlgorithms,
				old.EncapContentInfo,
				certs,
				crls,
				old.SignerInfos);

			//
			// replace the contentInfo with the new one
			//
			cms.contentInfo = new ContentInfo(cms.contentInfo.ContentType, cms.signedData);

			return cms;
		}

        /**
         * Replace the certificate and CRL information associated with this
         * CMSSignedData object with the new one passed in.
         * <p>
         * The output stream is returned unclosed.
         * </p>
         * @param original the signed data stream to be used as a base.
         * @param certsAndCrls the new certificates and CRLs to be used.
         * @param out the stream to Write the new signed data object to.
         * @return out.
         * @exception CmsException if there is an error processing the CertStore
         */
        public static Stream ReplaceCertificatesAndCrls(
			Stream			original,
			IX509Store		x509Certs,
			IX509Store		x509Crls,
			IX509Store		x509AttrCerts,
			Stream			outStr)
        {
            if (x509AttrCerts != null)
                throw new NotImplementedException("Currently can't replace attribute certificates");

            Asn1StreamParser inStr = new Asn1StreamParser(original, CmsUtilities.MaximumMemory);
            ContentInfoParser contentInfo = new ContentInfoParser((Asn1SequenceParser)inStr.ReadObject());
            SignedDataParser signedData = SignedDataParser.GetInstance(contentInfo.GetContent(Asn1Tags.Sequence));

            BerSequenceGenerator sGen = new BerSequenceGenerator(outStr);

            sGen.AddObject(CmsObjectIdentifiers.SignedData);

            BerSequenceGenerator sigGen = new BerSequenceGenerator(sGen.GetRawOutputStream(), 0, true);

            // version number
            sigGen.AddObject(signedData.Version);

            // digests
            WriteToGenerator(sigGen, signedData.GetDigestAlgorithms().ToAsn1Object());

            // encap content info
            ContentInfoParser encapContentInfo = signedData.GetEncapContentInfo();

            BerSequenceGenerator eiGen = new BerSequenceGenerator(sigGen.GetRawOutputStream());

            eiGen.AddObject(encapContentInfo.ContentType);

            Asn1OctetStringParser octs = (Asn1OctetStringParser)encapContentInfo.GetContent(Asn1Tags.OctetString);

            if (octs != null)
            {
                BerOctetStringGenerator octGen = new BerOctetStringGenerator(eiGen.GetRawOutputStream(), 0, true);
                byte[] inBuffer = new byte[4096];
                byte[] outBuffer = new byte[4096];
                Stream inOctets = octs.GetOctetStream();
                Stream outOctets = octGen.GetOctetOutputStream(outBuffer);

                int len;
                while ((len = inOctets.Read(inBuffer, 0, inBuffer.Length)) > 0)
                {
                    outOctets.Write(inBuffer, 0, len);
                }

                outOctets.Close();
            }

            eiGen.Close();

            //
            // skip existing certs and CRLs
            //
            GetAsn1Set(signedData.GetCertificates());
            GetAsn1Set(signedData.GetCrls());

            //
            // replace the certs and crls in the SignedData object
            //
            Asn1Set certs;
            try
            {
                certs = CmsUtilities.CreateDerSetFromList(
                    CmsUtilities.GetCertificatesFromStore(x509Certs));
            }
            catch (X509StoreException e)
            {
                throw new CmsException("error getting certs from certStore", e);
            }

            if (certs.Count > 0)
            {
                WriteToGenerator(sigGen, new DerTaggedObject(false, 0, certs));
            }

            Asn1Set crls;
            try
            {
                crls = CmsUtilities.CreateDerSetFromList(
                    CmsUtilities.GetCrlsFromStore(x509Crls));
            }
            catch (X509StoreException e)
            {
                throw new CmsException("error getting crls from certStore", e);
//.........这里部分代码省略.........

 public OriginatorInfoGenerator(IX509Store origCerts)
     : this(origCerts, null)
 {
 }

		public void AddCertificates(
			IX509Store certStore)
		{
			_certs.AddRange(CmsUtilities.GetCertificatesFromStore(certStore));
		}

		public void SetCertificates(
			IX509Store certificates)
		{
			this.x509Certs = certificates;
		}

		public void SetCrls(
			IX509Store crls)
		{
			this.x509Crls = crls;
		}

		/**
		* Adds an additional Bouncy Castle {@link Store} to find CRLs, certificates,
		* attribute certificates or cross certificates.
		* <p>
		* You should not use this method. This method is used for adding additional
		* X.509 stores, which are used to add (remote) locations, e.g. LDAP, found
		* during X.509 object processing, e.g. in certificates or CRLs. This method
		* is used in PKIX certification path processing.
		* </p><p>
		* If <code>store</code> is <code>null</code> it is ignored.
		* </p>
		*
		* @param store The store to add.
		* @see #getStores()
		*/
		public virtual void AddAdditionalStore(
			IX509Store store)
		{
			if (store != null)
			{
				additionalStores.Add(store);
			}
		}

		/**
		* Adds a Bouncy Castle {@link Store} to find CRLs, certificates, attribute
		* certificates or cross certificates.
		* <p>
		* This method should be used to add local stores, like collection based
		* X.509 stores, if available. Local stores should be considered first,
		* before trying to use additional (remote) locations, because they do not
		* need possible additional network traffic.
		* </p><p>
		* If <code>store</code> is <code>null</code> it is ignored.
		* </p>
		*
		* @param store The store to add.
		* @see #getStores
		*/
		public virtual void AddStore(
			IX509Store store)
		{
			if (store != null)
			{
				stores.Add(store);
			}
		}

		private void MakeCertStore(string[] _strs, out IX509Store certStore, out IX509Store crlStore)
		{
			ArrayList certs = new ArrayList();
			ArrayList crls = new ArrayList();
			crls.Add(trustedCRL);

			for (int i = 0; i < _strs.Length; i++)
			{
				if (_strs[i].StartsWith("MIIC"))
				{
					certs.Add(certParser.ReadCertificate(Base64.Decode(_strs[i])));
				}
				else if (_strs[i].StartsWith("MIIB"))
				{
					crls.Add(crlParser.ReadCrl(Base64.Decode(_strs[i])));
				}
				else
				{
					throw new ArgumentException("Invalid certificate or crl");
				}
			}

			// Insert elements backwards to muck up forward ordering dependency
//            IList _vec2 = new ArrayList();
//            for (int i = _vec.Count - 1; i >= 0; i--)
//            {
//                _vec2.Add(_vec[i]);
//            }
			certs.Reverse();
			crls.Reverse();

			certStore = X509StoreFactory.Create("Certificate/Collection",
				new X509CollectionStoreParameters(certs));
			crlStore = X509StoreFactory.Create("CRL/Collection",
				new X509CollectionStoreParameters(crls));
		}

        PkixCertPath BuildCertPath(HashSet anchors, IX509Store certificates, IX509Store crls, X509Certificate certificate, DateTime? signingTime)
        {
            var intermediate = new X509CertificateStore ();
            foreach (X509Certificate cert in certificates.GetMatches (null))
                intermediate.Add (cert);

            var selector = new X509CertStoreSelector ();
            selector.Certificate = certificate;

            var parameters = new PkixBuilderParameters (anchors, selector);
            parameters.AddStore (GetIntermediateCertificates ());
            parameters.AddStore (intermediate);

            var localCrls = GetCertificateRevocationLists ();
            parameters.AddStore (localCrls);
            parameters.AddStore (crls);

            // Note: we disable revocation unless we actually have non-empty revocation lists
            parameters.IsRevocationEnabled = localCrls.GetMatches (null).Count > 0;
            parameters.ValidityModel = PkixParameters.ChainValidityModel;

            if (signingTime.HasValue)
                parameters.Date = new DateTimeObject (signingTime.Value);

            var result = new PkixCertPathBuilder ().Build (parameters);

            return result.CertPath;
        }

		/**
		* Add the attribute certificates contained in the passed in store to the
		* generator.
		*
		* @param store a store of Version 2 attribute certificates
		* @throws CmsException if an error occurse processing the store.
		*/
		public void AddAttributeCertificates(
			IX509Store store)
		{
			try
			{
				foreach (IX509AttributeCertificate attrCert in store.GetMatches(null))
				{
					_certs.Add(new DerTaggedObject(false, 2,
						AttributeCertificate.GetInstance(Asn1Object.FromByteArray(attrCert.GetEncoded()))));
				}
			}
			catch (Exception e)
			{
				throw new CmsException("error processing attribute certs", e);
			}
		}

        X509Certificate GetCertificate(IX509Store store, SignerID signer)
        {
            var matches = store.GetMatches (signer);

            foreach (X509Certificate certificate in matches) {
                return certificate;
            }

            return GetCertificate (signer);
        }