Побег из Крипто Про. Режиссерская версия, СМЭВ-edition

using Org.BouncyCastle.Asn1.X509;
using Org.BouncyCastle.Crypto;
using Org.BouncyCastle.Math;
using Org.BouncyCastle.X509;
using Org.BouncyCastle.X509.Extension;
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Globalization;
using System.IO;

...

X509Crl GetCrl()
{
    DateTime thisUpdate = DateTime.UtcNow;
    DateTime nextUpdate = thisUpdate.AddMinutes(Settings.CrlLifeTimeInMunutes);

    Org.BouncyCastle.Asn1.DerObjectIdentifier crlNextPublish = new Org.BouncyCastle.Asn1.DerObjectIdentifier("1.3.6.1.4.1.311.21.4");
    Org.BouncyCastle.Asn1.DerObjectIdentifier crlNumberOid = new Org.BouncyCastle.Asn1.DerObjectIdentifier("2.5.29.20");

    if (System.IO.File.Exists(Settings.CrlFilePath))
    {
        FileInfo crlFileInfo = new FileInfo(Settings.CrlFilePath);
        X509CrlParser crlParser = new X509CrlParser();
        X509Crl prevCrl = crlParser.ReadCrl(System.IO.File.ReadAllBytes(Settings.CrlFilePath));
        if (DateTime.UtcNow >= prevCrl.NextUpdate.Value)
        {

            X509V2CrlGenerator generator = new X509V2CrlGenerator();
            generator.AddCrl(prevCrl);
            generator.SetThisUpdate(thisUpdate);
            generator.SetNextUpdate(nextUpdate);
            generator.SetSignatureAlgorithm(Settings.SigningAlgorithm);
            generator.SetIssuerDN(Certificate.SubjectDN);
            generator.AddExtension(X509Extensions.AuthorityKeyIdentifier, false, new AuthorityKeyIdentifierStructure(Settings.CACertificate));
            //Установка даты следующего обновления (crlNextPublish)
            generator.AddExtension(crlNextPublish, false, new Org.BouncyCastle.Asn1.DerUtcTime(nextUpdate));
            //Получение текущего номера CRL (crlNumber)
            if (prevCrl.GetExtensionValue(crlNumberOid) != null)
            {
                Org.BouncyCastle.Asn1.DerInteger crlNumber = (Org.BouncyCastle.Asn1.DerInteger)Org.BouncyCastle.Asn1.DerInteger
                    .FromByteArray(prevCrl.GetExtensionValue(crlNumberOid).GetOctets());
                //Увеличение номера на 1
                crlNumber = new Org.BouncyCastle.Asn1.DerInteger(crlNumber.Value.IntValue + 1);
                //Установка нового номера CRL (crlNumber)
                generator.AddExtension(crlNumberOid, false, crlNumber);
            }
            else
            {
                generator.AddExtension(crlNumberOid, false, new Org.BouncyCastle.Asn1.DerInteger(0));
            }

            //Получение списка уже отозванных сертификатов
            List<BigInteger> revokedSerialNumbers = GetSerialNumbers(prevCrl);
            //Settings.LoadGoodAndRevoked();
            //Список отозванных сертификатов, которые нужно отозвать сейчас
            IEnumerable<BigInteger> newRevoked = Settings.RevokedCertificateNumbers
                .Except(revokedSerialNumbers);
            //Добавление недавно отозванных сертификатов, в список отзыва
            foreach (BigInteger serialNumber in newRevoked)
            {
                //Причина отзыва не указывается
                generator.AddCrlEntry(serialNumber, DateTime.UtcNow, CrlReason.Unspecified);
            }
            //Формирование CRL
            var crl = generator.Generate(PrivateKey);

            TryWriteFile(Settings.CrlFilePath, crl.GetEncoded(), 100);

            logger.Debug(string.Format(CultureInfo.InvariantCulture, "CRL responce: {0}", Convert.ToBase64String(crl.GetEncoded())));
            return crl;
        }
        else
        {
            return prevCrl;
        }
    }
    else
    {
        X509V2CrlGenerator generator = new X509V2CrlGenerator();
        generator.SetThisUpdate(thisUpdate);
        generator.SetNextUpdate(nextUpdate);
        generator.SetSignatureAlgorithm(Settings.SigningAlgorithm);
        generator.SetIssuerDN(Certificate.SubjectDN);
        generator.AddExtension(X509Extensions.AuthorityKeyIdentifier, false, new AuthorityKeyIdentifierStructure(Settings.CACertificate));
        generator.AddExtension(crlNextPublish, false, new Org.BouncyCastle.Asn1.DerUtcTime(nextUpdate));
        generator.AddExtension(crlNumberOid, false, new Org.BouncyCastle.Asn1.DerInteger(0));

        DirectoryInfo revokedCertificateFolder = new DirectoryInfo(Settings.RevokedCertificateFolder);
        IEnumerable<FileInfo> revokedCertificateFiles = revokedCertificateFolder.GetFiles("*.crt");

        foreach (FileInfo revokedCertificateFileInfo in revokedCertificateFiles)
        {
            string name = revokedCertificateFileInfo.Name;
            name = name.Substring(0, name.IndexOf('.'));
            BigInteger serialNumber = new BigInteger(name);
            //Причина отзыва не указывается
            generator.AddCrlEntry(serialNumber, DateTime.UtcNow, CrlReason.Unspecified);
        }

        var crl = generator.Generate(PrivateKey);

        TryWriteFile(Settings.CrlFilePath, crl.GetEncoded(), 100);

        return crl;
    }
}

static List<BigInteger> GetSerialNumbers(X509Crl crl)
{
    List<BigInteger> listNumber = new List<BigInteger>();
    Org.BouncyCastle.Utilities.Collections.ISet revokedCerts = crl.GetRevokedCertificates();
    if (revokedCerts != null)
    {
        foreach (X509CrlEntry crlEntry in revokedCerts)
        {
            listNumber.Add(crlEntry.SerialNumber);
        }
    }
    return listNumber;
}