Error trying to use the Private Key of cert retrieved from CurrentUser Store

-1

I am trying to sign a a CSR with my Certificate Agent Certificate. however when I get the certificate from currentUser's store and I try to use the key to sign it I get this error "CertEnroll::CSignerCertificate::Initialize: Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)" however if I get it from the LocalMachine Store I do not have that problem and it works. I cannot use the local machine to store the cert because Certificate Agent Certs have their private key as not exportable.

this is my code to get the certificate from the cert sotre:

        const string ekuOid = "2.5.29.37";
        const string enrollmentAgentOid = "1.3.6.1.4.1.311.20.2.1";
        var store = new X509Store("MY", StoreLocation.CurrentUser);
        store.Open(OpenFlags.ReadOnly);
        X509Certificate2 certificate = null;
        foreach (var cert in store.Certificates)
        {
            if (!cert.HasPrivateKey || cert.NotBefore > DateTime.UtcNow || DateTime.UtcNow > cert.NotAfter) { continue; }
            foreach (var eku in cert.Extensions.Cast<X509Extension>().Where(ext => ext.Oid.Value == ekuOid).Cast<X509EnhancedKeyUsageExtension>())
            {
                if (eku.EnhancedKeyUsages.Cast<Oid>().Any(usage => usage.Value == enrollmentAgentOid))
                {
                    certificate = cert;
                }
            }
        }
        return certificate;

but when I call the CERTENROLLLib initializer (Initialize(bool MachineContext, X509PrivateKeyVerify VerifyType, EncodingType Encoding, string strCertificate)) I get the exception mentioned above.looking at the debugger the variable look the same when it is coming from the LocalMachine than when it is coming from Current User.

c#
.net
x509certificate
certificate-store
certenroll
asked on Stack Overflow Apr 10, 2019 by pudm

1 Answer

0

the problem was in the initialze, I was setting machine context to true instead of false making it fail. the certificate was correcly retrieved as it was being shown by the debugger tools.

answered on Stack Overflow Apr 16, 2019 by pudm

User contributions licensed under CC BY-SA 3.0