GPKI中所使用的憑證序號是一個長度為16 bytes的正整數，
但根據DER編碼對正數所使用2補數規則，
所以若遇到憑證序號開頭是a_或b_或c_或d_或e_或f_，
則會在最開頭補上0(16進位顯示為00)，因此憑證序號長度就變成17 bytes(例:MOEACA憑證序號)；
若遇到憑證序號開頭是0~9，則憑證序號長度為16 bytes(例: GRCA自簽憑證)。
結論是：憑證序號長度有16 bytes和17 bytes兩種。

建議可以到MOEACA網站下載"GRCA自簽憑證"和"MOEACA憑證"來比較一下會更清楚。

GRCA自簽憑證

1f 9d 59 5a d7 2f c2 06 44 a5 80 08 69 e3 5e f6

MOEACA憑證
00 fd b3 f5 36 49 99 e6 4e 8c cb 36 62 12 90 e3 2b

另外一點就是回到我最原始的問題,之前我說我會有一個
-603912959的err code, 當時是用vb.net寫的
後來把您的code翻成vb.net也會有同樣error
我對照了一下我原始的code跟您的,發覺差異的地方就在於
一些宣告的部份,現在我還沒有找到原因,如果您熟悉vb.net的話
是否也能指教一下呢? 我試著把vb的code貼一下

_
Private Shared Function BuildTobesignedOCSPRequest(ByRef OCSp As OCSstruct, ByVal num As Integer, _
ByVal Nounce As String, ByVal iNounceLength As Integer, _
ByRef RequestIssueCertificate As Byte(), ByRef ucppTobesignedOCSPReq As Byte(), _
ByRef iTobesignedOCSPReqLength As Integer) As Integer
End Function

_
Public Structure OCSstruct
_
Public SerialNumber As Byte() '憑證序號
Public ResponseStatus As Integer 'OCS之Response狀態
Public CertStatus As Integer '憑證狀態
Public RevokeReason As Integer '廢止理由代碼
_
Public RequestTime As Byte() 'Request時間
End Structure

Public Shared Function VerifyCertViaOCSP(ByVal certCA As X509Certificate2, ByVal certOCSP As X509Certificate2, ByVal certUser As X509Certificate2) As OCSstruct
Dim ocs As New OCSstruct()

Dim strSN As String = certUser.SerialNumber
ocs.SerialNumber = New Byte(19) {}
For i As Integer = 0 To 19
If i <= strSN.Length \ 2 - 1 Then
ocs.SerialNumber(i) = Convert.ToByte(strSN.Substring(i * 2, 2), 16)
Else
ocs.SerialNumber(i) = Convert.ToByte("0", 16)
End If
Next

ocs.CertStatus = 0
ocs.ResponseStatus = 0
ocs.RevokeReason = 0
ocs.RequestTime = New Byte(31) {}
For i As Integer = 0 To 31
ocs.RequestTime(i) = Convert.ToByte("0", 16)
Next

Dim TBSReq As Byte() = New Byte(0) {}
Dim iTBSReqLength As Integer = 0
Dim iReturn As Integer = BuildTobesignedOCSPRequest(ocs, 1, "1234567890", 10, certCA.Export(X509ContentType.Cert), TBSReq, _
iTBSReqLength)
TBSReq = New Byte(iTBSReqLength - 1) {}
iReturn = BuildTobesignedOCSPRequest(ocs, 1, "1234567890", 10, certCA.Export(X509ContentType.Cert), TBSReq, _
iTBSReqLength)

Return ocs
End Function

在第一次呼叫BuildTobesignedOCSPRequest就會彈那個錯了
而且iTBSReqLength也沒法正常拿到值
至於結構的宣告,試過改用VBFixedArray 也沒有用
目前對於這點感到相當苦惱中

2. 建立Entry Points:
[DllImport("CHTHiSECURE5_NetFuncva.dll")]
private static extern int BuildTobesignedOCSPRequest(
ref OCSstruct ocs,
int num, // OCS個數，填1即可
string Nounce, // OCSPRequest的Nounce欄位資料(填1~0)
int NounceLength, // Nounce的長度
byte[] RequestIssueCertificate, // MOICA憑證
byte[] ToBeSignedRequest, // 用來簽章的資料
ref int ToBeSignedRequestLength
);

[DllImport("CHTHiSECURE5_NetFuncva.dll")]
private static extern int QueryOCSfromOCSPRequest(
ref OCSstruct ocs,
int num,
byte[] ToBeSignedOCSPReq,
int ToBeSingedOCSPReqLength,
byte[] RequstSignature,
int RequestSignatureLength,
byte[] RequestIssueCertificate, // MOICA憑證
byte[] SenderCertificate, // 要檢查的憑證
byte[] OCSPServerCertificate, // OCSP憑證
string ServerURL, // OCSP網址
string ProxyName,
int ProxyPort);

3. 下面這個方法，用來呼叫API，請API幫我們檢驗指定的憑證是否有問題：
unsafe public static OCSstruct VerifyCertViaOCSP(X509Certificate2 certCA, X509Certificate2 certOCSP, X509Certificate2 certUser)
{
OCSstruct ocs = new OCSstruct();

string strSN = certUser.SerialNumber;
for (int i = 0; i < strSN.Length / 2; i++)
ocs.SerialNumber[i] = Convert.ToByte(strSN.Substring(i * 2, 2), 16);

byte[] TBSReq = new byte[0];
int iTBSReqLength = 0;
int iReturn = BuildTobesignedOCSPRequest(
ref ocs,
1,
"1234567890",
10,
certCA.Export(X509ContentType.Cert),
TBSReq,
ref iTBSReqLength);
TBSReq = new byte[iTBSReqLength];
iReturn = BuildTobesignedOCSPRequest(
ref ocs,
1,
"1234567890",
10,
certCA.Export(X509ContentType.Cert),
TBSReq,
ref iTBSReqLength);

iReturn = QueryOCSfromOCSPRequest(
ref ocs,
1,
TBSReq,
iTBSReqLength,
null,
0,
certCA.Export(X509ContentType.Cert),
certUser.Export(X509ContentType.Cert),
certOCSP.Export(X509ContentType.Cert),
"moica.nat.gov.tw",
null,
0);
return ocs;
}

4. 在專案屬性中，將「容許Unsafe程式碼」打勾

屆時出版，還請大家多多支持~