Is it possible to programmatically generate an X509 certificate using only C#?

by

Just to clarify, an X.509 certificate does not contain the private key. The word certificate is sometimes misused to represent the combination of the certificate and the private key, but they are two distinct entities. The whole point of using certificates is to send them more or less openly, without sending the private key, which must be kept secret. An X509Certificate2 object may have a private key associated with it (via its PrivateKey property), but that’s only a convenience as part of the design of this class.

In your first BouncyCastle code example, newCert is really just the certificate and DotNetUtilities.ToX509Certificate(newCert) is built from the certificate only.

Considering that the PKCS#12 format requires the presence of a private key, I’m quite surprised that the following part even works (considering you’re calling it on a certificate which can’t possibly know the private key):

.Export(System.Security.Cryptography.X509Certificates.X509ContentType.Pkcs12,
    "password");

(gen.Generate(kp.Private) signs the certificate using the private key, but doesn’t put the private key in the certificate, which wouldn’t make sense.)

If you want your method to return both the certificate and the private key you could either:

  • Return an X509Certificate2 object in which you’ve initialized the PrivateKey property
  • Build a PKCS#12 store and returns its byte[] content (as if it was a file). Step 3 in the link you’ve sent (mirror) explains how to build a PKCS#12 store.

Returning the byte[] (DER) structure for the X.509 certificate itself will not contain the private key.

If your main concern (according to your test case) is to check that the certificate was built from an RSA key-pair, you can check the type of its public key instead.

More Related Contents:

  1. Generate a self-signed certificate on the fly
  2. Inserting Certificate (with privatekey) in Root, LocalMachine certificate store fails in .NET 4
  3. How can I sign a file using RSA and SHA256 with .NET?
  4. Generate and Sign Certificate Request using pure .net Framework
  5. What exactly happens when I set LoadUserProfile of IIS pool?
  6. X509Certificate Constructor Exception
  7. “An internal error occurred.” when loading pfx file with X509Certificate2
  8. Associate a private key with the X509Certificate2 class in .net
  9. How to find certificate by its thumbprint in C#
  10. Get list of certificates from the certificate store in C#
  11. Force HttpWebRequest to send client certificate
  12. CryptographicException was unhandled: System cannot find the specified file
  13. Add certificate on request with RestSharp
  14. Accessing uploaded certificates in azure web sites
  15. How to get the X509Certificate from a client request
  16. Debugging failing HTTPS WebRequest
  17. Is it safe to test the X509Certificate.Thumbprint property when you know an invalid certificate is safe?
  18. Signing SOAP messages using X.509 certificate from WCF service to Java webservice
  19. Import a Public key from somewhere else to CngKey?
  20. Open X509 Certificates Selection Using USB Token in C# Hosted on IIS
  21. C# SQL DELETE RETURN ONLY TRUE
  22. Make ListView.ScrollIntoView Scroll the Item into the Center of the ListView (C#)
  23. Retrieve credentials from Windows Credentials Store using C#
  24. C# – R interface
  25. How to define generic type limit to primitive types?
  26. What quality level does Image.Save() use for jpeg files?
  27. How do C# classes deal with dollar signs in JSON?
  28. Convert class to dynamic and add properties
  29. EPPlus – LoadFromCollection – Text converted to number
  30. How to use Application.Exit Event in WPF?

Leave a Comment