I am trying to sign a a CSR with my Certificate Agent Certificate. however when I get the certificate from currentUser's store and I try to use the key to sign it I get this error "CertEnroll::CSignerCertificate::Initialize: Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)" however if I get it from the LocalMachine Store I do not have that problem and it works. I cannot use the local machine to store the cert because Certificate Agent Certs have their private key as not exportable.
this is my code to get the certificate from the cert sotre:
const string ekuOid = "2.5.29.37";
const string enrollmentAgentOid = "1.3.6.1.4.1.311.20.2.1";
var store = new X509Store("MY", StoreLocation.CurrentUser);
store.Open(OpenFlags.ReadOnly);
X509Certificate2 certificate = null;
foreach (var cert in store.Certificates)
{
if (!cert.HasPrivateKey || cert.NotBefore > DateTime.UtcNow || DateTime.UtcNow > cert.NotAfter) { continue; }
foreach (var eku in cert.Extensions.Cast<X509Extension>().Where(ext => ext.Oid.Value == ekuOid).Cast<X509EnhancedKeyUsageExtension>())
{
if (eku.EnhancedKeyUsages.Cast<Oid>().Any(usage => usage.Value == enrollmentAgentOid))
{
certificate = cert;
}
}
}
return certificate;
but when I call the CERTENROLLLib initializer (Initialize(bool MachineContext, X509PrivateKeyVerify VerifyType, EncodingType Encoding, string strCertificate)) I get the exception mentioned above.looking at the debugger the variable look the same when it is coming from the LocalMachine than when it is coming from Current User.
the problem was in the initialze, I was setting machine context to true instead of false making it fail. the certificate was correcly retrieved as it was being shown by the debugger tools.
User contributions licensed under CC BY-SA 3.0