Develop Reference

Create a X509Certificate2 object using PEM with password in .NET Framework

I really don't understand how certificates work and can't find much information on how to create a X509Certificate2 object in .NET Framework. I need the certificate object so that I can add it to an Http handler. I have three items: a cert.pem file, a key.pem file and a password that I provided when I created the files. The files where generated from running this command:
> "C:\Program Files\Git\usr\bin\openssl.exe" req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 365
The console then asked me to provide a "PEM pass phrase" and I entered it. Now I was able to create a X509Certificate2 object in .NET 6, but cannot find a way to do the same in .NET Framework.
This code works in .NET 6, but I have no idea how to do the same thing in .NET Framework 4.6.1.
public static X509Certificate2 CreateCertificate(string publicCert, string privateCert, string password = #"P#ssw0rd1")
{
byte[] publicPemBytes = Encoding.UTF8.GetBytes(publicCert);
using var publicX509 = new X509Certificate2(publicPemBytes);
var privateKeyBlocks = privateCert.Split("-", StringSplitOptions.RemoveEmptyEntries);
var privateKeyBytes = Convert.FromBase64String(privateKeyBlocks[1]);
RSA rsa = RSA.Create();
if (privateKeyBlocks[0] == "BEGIN ENCRYPTED PRIVATE KEY")
{
rsa.ImportFromEncryptedPem(privateCert, password);
}
X509Certificate2 keyPair = publicX509.CopyWithPrivateKey(rsa);
return keyPair;
}
The variable publicCert has the raw value of the cert.pem file (the one that start with -----BEGIN CERTIFICATE-----. The variable privateCert has the raw value of the key.pem file (the one that start with -----BEGIN ENCRYPTED PRIVATE KEY-----.

C# BouncyCastle PKCS#8

I want load the PEM using .net framework (not .netcore)
-----BEGIN ENCRYPTED PRIVATE KEY-----
MIHs........................................................CAAw
DAYI........................................................gZAf
Y/Iu........................................................X7DZ
ZKoE........................................................OYQQ
3ZST........................................................A2E=
-----END ENCRYPTED PRIVATE KEY-----
I tried to use the following code using BouncyCastle, but it throw PemException:
"problem creating ENCRYPTED private key: Org.BouncyCastle.Crypto.InvalidCipherTextException: pad block corrupted"
class Passowrd : IPasswordFinder
{
private string v;
public Passowrd(string v)
{
this.v = v;
}
public char[] GetPassword()
{
return v.ToCharArray();
}
}
var pemReader = new PemReader(new StringReader(privateKeyText), new Passowrd("PASSWORD"));
var pemObj = pemReader.ReadObject(); // this line throw PemException
However, I load the exact same PEM file using .netcore3.1 by the following code:
var ecdsa = ECDsa.Create();
ecdsa.ImportEncryptedPkcs8PrivateKey(passSpan, privateKeyBytes, out _);

You can read the PEM either using
var pemReader = new Org.BouncyCastle.OpenSsl.PemReader(new StringReader(privateKeyText), new Passowrd("PASSWORD"));
or
var pemReader = new Org.BouncyCastle.Utilities.IO.Pem.PemReader(new StringReader(privateKeyText));
then read content like
var pemObject = pemReader.ReadPemObject();

The problem seems to be related to the encryption of the key: The key cannot be read with the PemReader if the option -v2prf hmacWithSHA1 is not set when the key is encrypted.
The option -v2prf exists since V1.1.0 and specifies the PRF (pseudo-random function) algorithm used with PKCS#5 v2.0 or the key derivation function PBKDF2.
Case 1: Creating a new key
The following two statements create and encrypt the key:
openssl ecparam -name secp256r1 -genkey -noout -out <out-path>
openssl pkcs8 -topk8 -v2 aes256 -v2prf hmacWithSHA1 -in <in-path> -out <out-path> // aes256 as of OpenSSL 1.1.0 inclusive
A key generated in this way can be successfully read with the PemReader. However, if the option -v2prf hmacWithSHA1 is missing, the exception is thrown.
Case 2: Fixing an already generated key
The following statement decrypts an already encrypted key:
openssl pkcs8 -topk8 -nocrypt -in <in-path> -out <out-path>
If the key is subsequently encrypted with the -v2prf hmacWithSHA1 option set (see above), the key can be read successfully with the PemReader. This way I was able to fix the posted key so that it could be read with the PemReader!
A possible (unfortunately only superficial) explanation can be found in the documentation of openssl pkcs8. There it can be read about the -v2prf option:
Some implementations may not support custom PRF algorithms and may require the hmacWithSHA1 option to work.
Interestingly, the critical keys can be read without problems using ECDsa#ImportEncryptedPkcs8PrivateKey from .NET Core 3.x. For a complete explanation a look into the source code would probably be necessary.

SSH RSA public key in PKCS1 format issue

I've created private & public key using GIT bash. I got id_rsa as private & id_rsa.pub as public key from ssh-keygen -t rsa -b 4096 command. The problem is when i am using c# code for abenity api, it gives error that "Not an RSA key". My private key is as follows-
-----BEGIN RSA PRIVATE KEY-----
MIIJKAIBAAKCAgEAvg5KIzv59e9l9OKhRorkGQloGH60jMRCdiyxVPZtHDGfbr+N
I5RIpvuv5rhE2ADm+LsaF7HkInEslTVwjjg2piznkc99yAm7y2PsBJQDvhbvdXtM
eJV1JzFEKzBcbuPvVZ/wmcdSENmUXgz
ZltPdTX9WPYPQqmMb6iS+NRqowvYV7zzJTsuL6rDmRGhReH0R27yDihEFx8hC6mQ
x+r..............................Ir2NLnc=
-----END RSA PRIVATE KEY-----
And my public key as follows -
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC................G+KssB6SPx+WbGpmW
I think my public key should be in PEM Format:
-----BEGIN RSA PUBLIC KEY-----
MIIBCgKCAQEA05ulw0FHaD3yCw8zPhav2lVdasl5waVSyl
MKvJ+YJuE9hifO3R8XslKWYW2cOTg0QPQIDAQAB
-----END RSA PUBLIC KEY-----
However, i do not know how to convert it into above format. Need help!
Thanks in advance.

Export the key:
ssh-keygen -e -f ~/.ssh/id_rsa.pub -m pem >ssh-pub.pem

Certificate's private key is exported as a different value?

I have created a self-signed-certificate (pfx) for testing purposes.
I'm able to export ist public key via :
X509Certificate2 cer = new X509Certificate2();
X509Store store = new X509Store(StoreLocation.LocalMachine);
store.Open(OpenFlags.ReadOnly);
var certificateCollection = store.Certificates.Find(...);
var cert = certificateCollection[0] ;
Console.WriteLine(Convert.ToBase64String(cert.Export( X509ContentType.Cert ), Base64FormattingOptions.InsertLineBreaks));
Result :
MIIDFTCCAf2gAw...........eFUpBB9C0/UNRmD7EAg==
This is consistent with openssl command :
$ openssl pkcs12 -in domain.name.pfx -clcerts -nokeys -out domain.name.crt
Result :
-----BEGIN CERTIFICATE-----
MIIDFTCCAf2gAw........9C0/UNRmD7EAg==
-----END CERTIFICATE-----
However , when I export the private key via C# :
Convert.ToBase64String(cert.Export( X509ContentType.Pfx ), Base64FormattingOptions.InsertLineBreaks)
I get :
MIIDFTCCAf2gAw............OVeFUpBB9C0/UNRmD7EAg==
While with openssl command :
$ openssl pkcs12 -in domain.name.pfx -nocerts -nodes -out domain.name.key
I get :
-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w.........6HNjF2h7uuFdvbH2VAVg=
-----END PRIVATE KEY-----
Question:
Why do I get different results in the private keys ? And how can I fix my C# code to yield the same result as openssl's result ?
(NB - I'm not talking about -----begin/end keys----- boundries , but the actual value.
Additional info , the PFX file

The X509ContentType.Cert representation is the same because the certificate is a static structure. If you export it in a loop you'll always get the same answer.
The X509ContentType.Pfx representation is different because there are random salts in the PFX structure. One for each certificate, one for each private key, and one final one. If you export the same public+private pair as a PFX in a loop it will be different every time (288 bits of random data).
The end of the base64 data is different because it contains the last salt and the MAC over the rest of the data (including the encrypted cert salt and the encrypted key salt). It also contains an integer work factor, which Windows chooses as 2000 and OpenSSL chooses as 2048; further differentiating the OpenSSL and Windows exports.
So what you are seeing is by design. If you need a stable export you'll have to do something else. If you were just concerned that they're different, it's almost certainly fine.

Why do I get different results in the private keys ?
You are trying to do two separate things. With openssl you are using pfx file that contains private key and certificate(s). In c# you are using some representation of certificate with private key and you are doing export to a pfx file!
And how can I fix my C# code to yield the same result as openssl's result ?
C# has no friendly function that could export only private key (in openssl-like way) from X509Certificate2. As #darksquirell42 mentioned in comments you could use X509Certificate2.PrivateKey property, then cast it to RSACryptoServiceProvider and do ToXmlString(true). But this will give you private key parameters in a xml structure. Then you would have to take each parameter and construct an ASN.1 structure PKCS#1 or (IMHO better) PKCS#8. But C# has by default no friendly methods to work with ASN.1 objects.
OR you could use some crypto library to do it for you like BouncyCastle. This method from BouncyCastle could be helpful.

Converting PGP public keys to RSA Public key XML Format

I am faced with a problem on converting PGP Public keys to RSA Public Key format. Following public key in PGP format that need to be converted to XML format.
Please help me, if any of you had encountered such scenarios.
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.1 (MingW32)
mQELBE2kxxwBCADjWSW/F/h9VkV9JizFwKXPzg1YlXyEmN/dGKTVBidOI3ZcrhQd
v3qhcWtNmBXz1BpO+YLy41AfJzysKNHrs23sMh8nKWlMSmKZZqVpimXCcCrKQ8Hi
uNNxcRN/hBdy5R4MN/N62hbFTgoZpGmrQjOXDSPozDeckQE7DjkGYvQAT63dT3jC
F99im/KC2GfHDxVh70+881ot+vUxKC6GRZAz6wth90M/5FzbKQt0GmFrq/XapqxK
ZQI5LLMzahdGzJTGEbfs8SlH6OAqZsgjgEKYaW3EooQVbrvGrdqna6PBkLbroCOl
EH/h6W9h42dFLb2OSV9OES7oidQATqzNC+oXAAYptE9CdWNrIENvbnN1bHRhbnRz
IC0gTXkgTWVkaWNhcmUgQWR2b2NhdGUgKE1NQSkgPHByb2RzdXBwb3J0QGJ1Y2tj
b25zdWx0YW50cy5jb20+iQE0BBMBAgAeBQJNpMccAhsDBgsJCAcDAgMVAgMDFgIB
Ah4BAheAAAoJEJrpFtACLTdGtKEH/3G4pB4UeiEsMwDYDO1YF4jkz2lqbItmCGek
WuVg7G1LGHgZm2cJVH0xSuTKY4WpaX1RX5iWhVgz0dSrDNkjOi3hlZJ49VzXZi8T
abQ+Uiqfu7QIWvSOmjhxdrl8FuC2ZpZLRWB93VFNGKM1qYrjphTW1uMCnU4WtkD0
e8d9M3VCC/uL72a0+0R2El80W55yZxvHD6JHlp82Gdn+sqsAEnUcg5c+USLcehgc
v931SE4VfcxW4PELcOp0gKb00Q4bWp09Is/NVR+kVUax5EaT2Wo5oe7cx8OgrzMs
5daypwibGoFCloFE4LH59hbahoM5s8Ya59YAYEBWA1u68DCBYqS5AQsETaTH1gEI
AMCvsxsZcm5kIdbXATuPJQ1PKDejeeF0t4f27vDqR9SOZKas2ExpWbmjSeF9EdJ5
e1QKm88/WSXeUuE4Sn2xBfZXfRvhWndQIs6pOi8licuht1WiuYWBlvPefMO1e15G
fHrghhQ4RcTLIG8SWDcVFbsnr92RDy8NV7qZd/N08dZ+IS7z2JV8hp8Ts0a9T01q
p1h6lCbr9CAABQmlihMQ+hM4LO9DjqDeR85I1NWNpODeoks8zx86S9xOlEBxmWg2
G90ahBxm3IsYW9KtDd+oro6s6GQroo+5C0bcHyVL6Dylmhkn4CYQ99WAzMtw3gQ8
IDFrLO7Vw1kMc+vR4LGMPpkABimJAR8EGAECAAkFAk2kx9YCGwwACgkQmukW0AIt
N0ZBxggAqLFdkvVHgsK8wx6WyZalRpimirVQxStPT8WWlGyg8zJIGxbAzC6f4Fml
IuXGQYse+D8LfL7leWCyGu71+IZb22XCQ7ZO2ogWl6txUO5jWgPkoPBi0XMK/tLu
pT1WP8/lzrh1XQgwvLME+dcTMeuqgV5uDUmhn2OX9j8N3iyZeOV84cFrYmgrNfHn
lHlGx2kyXhgUwfK6noIUljprImIjlntGL0sh6lxTiu5bWMpXJVeJdRjNXuf4G+2/
mLU7BfsNP5jDr3+isTTLcOlZR0PHiAywIFPA2VOMTscB6nNEHiu8FLNFnY+QgboT
uC4E2095FYSXRMXc/rif7+d5+NApAg==
=+Q6Q
-----END PGP PUBLIC KEY BLOCK-----
This need to be converted to RSAKeyValue XML format like the one below.
<RSAKeyValue>
<Modulus>151Vw6Kq51bpblahblahblahWCkPmD345ncclzFrmeb9fjpE+B6VsIAqP3kahu00p33BmFpDpXOcgi uRC2En0HoGqyZB9ifvNlPhT7flZ1uVuC9JtywG3FmYRsqbpJuT7VTIAHYExU6T/FyRuyIbhdUVwhue7ARaObsEWszE1IoM7+XcYYs=</Modulus>
<Exponent>AQAB</Exponent>
<P>+7OU6YErvfk84O/2bX5s2753xE+pdiyJl3j8gy4zMh4UKeKVhyxgSJJCvNTl9XVIya6xnCWPkHVy8ylNqyLiHQ==</P>
<Q>20v7/nODe/jKcbsiYEwzGXp0ZyiG17JqzOBKrDFu6bwPiAEHzZln0CYfUn0E hJdCmetaq9WFXk27mbK3Z6aBxw==</Q>
<DP>RpoN6B26dlRGFlZZCkePI2he0esCfsppYdqnAejgpWs4 frM2/C6fZ1vXan5RbrOSUjg1S7ZhecToFHr+dUWYpQ== </DP>
<DQ>ayaHbF7YwfxgPo3nUBIrbamNstH0gPQmhxCYq+ZDgWV oWVXXkDgCp4vZBh8b1AVsf3SmCwv7bIaiwYi3YKfVBQ==</DQ
<InverseQ>YjvieMYPEDdUHqSZRWAsFlEESd3NczFCrbBaS HzbsbOZeDrccvUfoOP2jeIhuMt0qQwMqXY/NJau9Ldwdx7xNw==</InverseQ>
<D>wEg6bM5LVSWoQgWpoldz5dQWfQjqQVc8WzKpDA HQ8ejsm0ug4ZwRcRRnKZs3o7OTsiAJCfjqT9ij1gKMoeLrXIM1 RDOcAYBxI0qwWdRrr3sbar7ntMYmy4tlTTf8/G+ypw+CJi1gz2umswcx4MHhNTUGTUHSmjEjDTFfh3sW64k= </D>
</RSAKeyValue>

While generally it is possible to extract key material from an OpenPGP RSA key (note that OpenPGP also gets use of DSS/Elgamal keys), your example is somewhat inconsistent, as it states public OpenPGP key and private RSA/XML key. So I think it makes sense to sort these things out before you continue (as it is impossible to get private RSA key from a public RSA key).

Finally got what I was looking for from this SO post.
BouncyCastle RSAPrivateKey to .NET RSAPrivateKey