$ openssl x509 -in 1900009191_20180326_cert.pem -noout -serial
serial=1DDE55AD98ED71D6EDD4A4A16996DE7B47773A8C

/**
 * 獲取證書。
 *
 * @param filename 證書文件路徑  (required)
 * @return X509證書
 */
public static X509Certificate getCertificate(String filename) throws IOException {
	InputStream fis = new FileInputStream(filename);
	BufferedInputStream bis = new BufferedInputStream(fis);

	try {
		CertificateFactory cf = CertificateFactory.getInstance("X509");
		X509Certificate cert = (X509Certificate) cf.generateCertificate(bis);
		cert.checkValidity();
		return cert;
	} catch (CertificateExpiredException e) {
		throw new RuntimeException("證書已過期", e);
	} catch (CertificateNotYetValidException e) {
		throw new RuntimeException("證書尚未生效", e);
	} catch (CertificateException e) {
		throw new RuntimeException("無效的證書文件", e);
	} finally {
		bis.close();
	}
}

 /**
* Read certificate from file
*
* @param string    $filepath     PEM encoded X.509 certificate file path
* 
* @return resource|bool  X.509 certificate resource identifier on success or FALSE on failure
*/
public static function getCertificate($filepath) {
    return openssl_x509_read(file_get_contents($filepath));}

using System;
using System.IO;
using System.Net.Http;
using System.Security.Cryptography;
using System.Threading;
using System.Threading.Tasks;

namespace HttpHandlerDemo
{
    // 使用方法
    // HttpClient client = new HttpClient(new HttpHandler("{商戶號}", "{商戶證書序列號}"));
    // ...
    // var response = client.GetAsync("https://apihk.mch.weixin.qq.com/v3/global/certificates");
    public class HttpHandler : DelegatingHandler
    {
        private readonly string merchantId;
        private readonly string serialNo;

        public HttpHandler(string merchantId, string merchantSerialNo)
        {
            InnerHandler = new HttpClientHandler();

            this.merchantId = merchantId;
            this.serialNo = merchantSerialNo;
        }

        protected async override Task<HttpResponseMessage> SendAsync(
            HttpRequestMessage request,
            CancellationToken cancellationToken)
        {
            var auth = await BuildAuthAsync(request);
            string value = $"WECHATPAY2-SHA256-RSA2048 {auth}";
            request.Headers.Add("Authorization", value);

            return await base.SendAsync(request, cancellationToken);
        }

        protected async Task<string> BuildAuthAsync(HttpRequestMessage request)
        {
            string method = request.Method.ToString();
            string body = "";
            if (method == "POST" || method == "PUT" || method == "PATCH")
            {
                var content = request.Content;
                body = await content.ReadAsStringAsync();
            }

            string uri = request.RequestUri.PathAndQuery;
            var timestamp = DateTimeOffset.Now.ToUnixTimeSeconds();
            string nonce = Path.GetRandomFileName();

            string message = $"{method}\n{uri}\n{timestamp}\n{nonce}\n{body}\n";
            string signature = Sign(message);
            return $"mchid=\"{merchantId}\",nonce_str=\"{nonce}\",timestamp=\"{timestamp}\",serial_no=\"{serialNo}\",signature=\"{signature}\"";
        }

        protected string Sign(string message)
        {
            // NOTE： 私鑰不包括私鑰文件起始的-----BEGIN PRIVATE KEY-----
            //        亦不包括結(jié)尾的-----END PRIVATE KEY-----
            string privateKey = "{你的私鑰}";
            byte[] keyData = Convert.FromBase64String(privateKey);
            
            var rsa = RSA.Create();
            rsa.ImportPkcs8PrivateKey(keyData, out _);
            byte[] data = System.Text.Encoding.UTF8.GetBytes(message);
            return Convert.ToBase64String(rsa.SignData(data, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1));
        }
    }
}

openssl pkcs7 -print_certs -in CertTrustChain.p7b -inform der -out CertTrustChain.pem

openssl verify -verbose -CAfile ./CertTrustChain.pem ./WeChatPayPlatform.pem