MS CA certificate generation with individual keys, C#

1

At the moment I am developing an Web application that will serve as a MS CA interface for certification enrollment. The error comes out after the app have generated the csr and send it to CA. Certificate should have the following structure:

Serialnumber = UserId, CN = FirstName SecondName, O = Organization, P = PhoneNumber

Here is a real example:

Serialnumber = 200554041000, CN = John Farel, O = SRL Insign, P = 60182209, C = MD

Error shown is:

CertEnroll::CX500DistinguishedName::Encode: The string contains an invalid X500 name attribute key, oid, value or delimiter. 0x80092023 (-2146885597)

If I remove P or change it on Phone everything goes well and certificate is being generated.

And second!! :) After certificate have been generated subjects DN contains everything bun not Serialnumber and Phone.

I am using MS CA on MS Windows Server 2008, CA Cryptography Service Provider: Microsoft Software Storage Provider, Hash Algorithm: SHA1.

For more information leave a comment. Thank you anticipated!

c#
ssl
cryptography
x509certificate
ca
asked on Stack Overflow Apr 8, 2015 by coceban.vlad • edited Apr 8, 2015 by coceban.vlad

1 Answer

2

Few things to know:

1) "PhoneNumber" attribute is named "Phone", not "P" or whatever else.

EDIT:

2) I checked SDK and, unfortunately, it appears that it is not possible to include Phone RDN attribute in the subject. From header file only these attributes can be added:

//+--------------------------------------------------------------------------
// Name properties:

#define wszPROPDISTINGUISHEDNAME   TEXT("DistinguishedName")
#define wszPROPRAWNAME             TEXT("RawName")

#define wszPROPCOUNTRY             TEXT("Country")
#define wszPROPORGANIZATION        TEXT("Organization")
#define wszPROPORGUNIT             TEXT("OrgUnit")
#define wszPROPCOMMONNAME          TEXT("CommonName")
#define wszPROPLOCALITY            TEXT("Locality")
#define wszPROPSTATE               TEXT("State")
#define wszPROPTITLE               TEXT("Title")
#define wszPROPGIVENNAME           TEXT("GivenName")
#define wszPROPINITIALS            TEXT("Initials")
#define wszPROPSURNAME             TEXT("SurName")
#define wszPROPDOMAINCOMPONENT     TEXT("DomainComponent")
#define wszPROPEMAIL               TEXT("EMail")
#define wszPROPSTREETADDRESS       TEXT("StreetAddress")
#define wszPROPUNSTRUCTUREDNAME    TEXT("UnstructuredName")
#define wszPROPUNSTRUCTUREDADDRESS TEXT("UnstructuredAddress")
#define wszPROPDEVICESERIALNUMBER  TEXT("DeviceSerialNumber")

3) avoid "Microsoft Software Key Storage Provider" provider use in your .NET application, because it is CNG provider and X509Certificate2 do not support CNG (shame on .NET). Though, it is recommended to use KSP for CA keys (when there is no HSM).

answered on Stack Overflow Apr 9, 2015 by Crypt32 • edited Apr 9, 2015 by Crypt32

User contributions licensed under CC BY-SA 3.0