Runtime: CryptographicException decoding TLS cert in 5.0.0 preview, linux only (Fine in 3.1.2)
Hi.
Here's a let's-encrypt certificate that decrypted just fine in 3.1.2, but after upgrading to 5.0.0 preview 1, started exploding in linux only.
(It's valid - but it's a dev cert in a dev environment, so no big deal).
var certraw = new byte[] { 48, 128, 2, 1, 3, 48, 128, 6, 9, 42, 134, 72, 134, 247, 13, 1, 7, 1, 160, 128, 36, 128, 4, 130, 3, 232, 48, 128, 48, 128, 6, 9, 42, 134, 72, 134, 247, 13, 1, 7, 1, 160, 128, 36, 128, 4, 129, 241, 48, 129, 238, 48, 129, 235, 6, 11, 42, 134, 72, 134, 247, 13, 1, 12, 10, 1, 2, 160, 126, 48, 124, 48, 40, 6, 10, 42, 134, 72, 134, 247, 13, 1, 12, 1, 3, 48, 26, 4, 20, 134, 214, 18, 255, 79, 105, 5, 182, 86, 4, 230, 209, 59, 12, 113, 121, 42, 161, 220, 10, 2, 2, 4, 0, 4, 80, 9, 185, 106, 204, 50, 152, 203, 101, 127, 148, 106, 231, 154, 11, 48, 211, 6, 30, 4, 35, 188, 213, 167, 215, 72, 202, 35, 170, 240, 190, 201, 123, 218, 25, 150, 187, 235, 10, 165, 16, 151, 154, 82, 174, 218, 7, 128, 133, 159, 11, 9, 17, 232, 73, 146, 254, 248, 159, 67, 124, 215, 254, 97, 149, 155, 174, 154, 136, 166, 101, 15, 103, 90, 220, 0, 3, 205, 40, 132, 104, 49, 92, 48, 35, 6, 9, 42, 134, 72, 134, 247, 13, 1, 9, 21, 49, 22, 4, 20, 203, 132, 68, 40, 26, 51, 35, 157, 202, 106, 233, 155, 100, 142, 177, 121, 163, 79, 187, 101, 48, 53, 6, 9, 42, 134, 72, 134, 247, 13, 1, 9, 20, 49, 40, 30, 38, 0, 97, 0, 112, 0, 112, 0, 46, 0, 100, 0, 101, 0, 118, 0, 46, 0, 115, 0, 121, 0, 109, 0, 101, 0, 116, 0, 114, 0, 105, 0, 97, 0, 46, 0, 105, 0, 111, 0, 0, 0, 0, 0, 0, 48, 128, 6, 9, 42, 134, 72, 134, 247, 13, 1, 7, 6, 160, 128, 48, 128, 2, 1, 0, 48, 128, 6, 9, 42, 134, 72, 134, 247, 13, 1, 7, 1, 48, 40, 6, 10, 42, 134, 72, 134, 247, 13, 1, 12, 1, 6, 48, 26, 4, 20, 228, 201, 157, 17, 238, 55, 46, 230, 158, 73, 10, 226, 69, 84, 209, 207, 36, 92, 92, 133, 2, 2, 4, 0, 160, 128, 4, 130, 3, 232, 173, 163, 210, 157, 171, 152, 166, 41, 89, 181, 136, 82, 249, 175, 170, 92, 136, 103, 45, 33, 134, 146, 251, 139, 34, 166, 165, 209, 151, 90, 205, 188, 219, 62, 183, 178, 236, 23, 142, 188, 209, 116, 38, 214, 181, 11, 69, 248, 182, 173, 3, 207, 230, 244, 13, 184, 150, 49, 61, 213, 198, 20, 41, 124, 247, 19, 163, 144, 99, 221, 219, 249, 36, 17, 137, 64, 121, 195, 122, 220, 225, 240, 36, 150, 156, 121, 85, 212, 203, 169, 179, 116, 77, 159, 65, 245, 200, 86, 29, 212, 219, 21, 219, 156, 207, 50, 132, 254, 137, 8, 39, 234, 191, 50, 43, 212, 158, 125, 232, 150, 133, 252, 224, 84, 130, 69, 89, 4, 129, 152, 150, 144, 84, 84, 92, 229, 209, 241, 17, 125, 221, 70, 241, 150, 62, 235, 214, 192, 190, 69, 218, 103, 139, 10, 171, 8, 231, 218, 12, 8, 112, 173, 6, 99, 48, 230, 113, 82, 97, 189, 73, 51, 173, 113, 177, 134, 179, 120, 156, 62, 179, 128, 34, 96, 188, 241, 115, 20, 204, 211, 0, 180, 179, 191, 124, 109, 104, 62, 129, 27, 121, 190, 26, 198, 126, 254, 111, 13, 90, 64, 120, 149, 113, 125, 163, 96, 173, 2, 20, 101, 183, 52, 55, 99, 68, 254, 150, 0, 153, 217, 149, 12, 124, 84, 191, 240, 154, 52, 235, 159, 248, 35, 236, 7, 5, 76, 73, 228, 125, 179, 121, 218, 60, 243, 241, 13, 229, 251, 64, 83, 125, 204, 187, 224, 126, 165, 137, 245, 93, 191, 157, 114, 12, 203, 78, 40, 81, 119, 93, 102, 139, 22, 165, 94, 194, 149, 172, 40, 128, 23, 6, 98, 210, 60, 62, 181, 128, 189, 184, 130, 224, 7, 149, 219, 210, 2, 75, 160, 88, 13, 27, 140, 242, 44, 64, 32, 89, 158, 120, 94, 80, 108, 37, 251, 108, 96, 207, 244, 156, 26, 31, 137, 173, 127, 179, 229, 97, 233, 234, 203, 238, 106, 130, 46, 225, 149, 94, 200, 105, 67, 217, 80, 101, 233, 30, 154, 111, 38, 86, 118, 134, 78, 246, 33, 156, 214, 38, 85, 131, 169, 147, 165, 200, 236, 129, 233, 143, 146, 105, 134, 231, 205, 209, 174, 211, 184, 25, 96, 74, 205, 0, 51, 188, 135, 213, 103, 9, 203, 68, 179, 114, 232, 14, 37, 229, 6, 44, 12, 49, 223, 242, 204, 192, 149, 163, 173, 122, 227, 146, 29, 190, 34, 200, 69, 235, 195, 95, 15, 197, 205, 244, 171, 17, 193, 82, 108, 233, 2, 243, 52, 136, 135, 215, 62, 23, 116, 42, 33, 238, 58, 103, 146, 203, 80, 26, 73, 59, 16, 29, 234, 128, 79, 161, 34, 4, 219, 8, 147, 116, 0, 80, 8, 30, 115, 101, 12, 138, 215, 122, 146, 26, 62, 15, 179, 15, 71, 173, 200, 152, 87, 173, 65, 57, 206, 224, 92, 32, 216, 136, 225, 72, 67, 76, 230, 10, 28, 191, 209, 20, 22, 172, 254, 172, 32, 168, 132, 239, 21, 111, 18, 215, 160, 165, 70, 134, 39, 62, 77, 10, 81, 190, 79, 18, 248, 234, 196, 96, 57, 118, 102, 115, 94, 140, 255, 182, 198, 225, 116, 101, 246, 1, 69, 216, 148, 205, 182, 55, 22, 171, 180, 194, 209, 24, 236, 30, 26, 136, 32, 82, 74, 197, 105, 8, 76, 155, 215, 170, 64, 206, 246, 45, 12, 71, 180, 133, 36, 98, 39, 147, 111, 94, 210, 219, 16, 224, 28, 26, 60, 181, 252, 120, 193, 67, 99, 195, 235, 225, 102, 99, 161, 37, 78, 65, 64, 231, 176, 244, 61, 105, 252, 207, 10, 91, 136, 41, 188, 100, 247, 144, 74, 103, 176, 233, 132, 168, 85, 249, 12, 6, 12, 199, 189, 101, 166, 196, 18, 86, 10, 187, 233, 4, 130, 3, 232, 4, 49, 125, 132, 179, 118, 218, 230, 163, 74, 159, 81, 153, 153, 13, 165, 246, 205, 32, 248, 93, 146, 52, 71, 252, 170, 49, 161, 233, 250, 131, 216, 73, 67, 147, 114, 254, 21, 171, 245, 194, 11, 152, 17, 226, 111, 124, 8, 65, 80, 240, 32, 129, 120, 244, 184, 79, 5, 232, 248, 1, 238, 3, 101, 214, 110, 57, 211, 29, 6, 172, 249, 125, 75, 5, 137, 235, 209, 82, 136, 86, 57, 77, 219, 11, 226, 236, 53, 110, 100, 217, 221, 247, 24, 146, 216, 4, 106, 64, 238, 202, 66, 246, 185, 100, 12, 147, 247, 11, 38, 158, 246, 221, 45, 102, 88, 251, 74, 189, 242, 178, 20, 153, 164, 23, 159, 48, 204, 165, 27, 74, 173, 175, 140, 118, 136, 19, 238, 230, 147, 90, 230, 203, 38, 134, 88, 3, 202, 219, 224, 85, 158, 195, 95, 15, 141, 87, 90, 23, 5, 142, 188, 56, 52, 59, 124, 180, 196, 64, 99, 198, 78, 97, 139, 3, 123, 134, 54, 89, 138, 185, 91, 66, 225, 229, 58, 55, 188, 99, 55, 121, 214, 124, 78, 84, 114, 238, 192, 87, 71, 75, 124, 234, 150, 234, 23, 241, 150, 248, 125, 236, 109, 192, 163, 109, 135, 170, 131, 36, 44, 108, 118, 106, 155, 75, 8, 136, 246, 9, 235, 60, 233, 253, 35, 13, 164, 145, 249, 121, 118, 218, 189, 211, 97, 46, 245, 74, 167, 213, 194, 100, 220, 189, 28, 188, 200, 49, 195, 136, 219, 112, 137, 104, 188, 41, 79, 226, 34, 38, 130, 225, 99, 116, 20, 119, 223, 141, 161, 85, 108, 179, 154, 175, 86, 181, 25, 83, 126, 245, 24, 32, 54, 165, 158, 14, 105, 50, 17, 59, 45, 42, 184, 209, 110, 112, 196, 52, 233, 254, 200, 58, 106, 93, 191, 179, 99, 59, 69, 189, 30, 94, 132, 38, 219, 207, 21, 187, 43, 78, 184, 237, 85, 20, 250, 247, 252, 76, 17, 33, 161, 80, 253, 238, 210, 27, 114, 15, 199, 134, 244, 4, 130, 3, 232, 38, 8, 230, 117, 52, 250, 201, 37, 105, 191, 66, 36, 157, 123, 73, 109, 228, 145, 135, 62, 223, 207, 27, 176, 163, 60, 91, 173, 78, 49, 190, 83, 241, 153, 124, 170, 72, 184, 80, 184, 234, 15, 118, 72, 255, 119, 97, 60, 87, 91, 161, 187, 21, 202, 72, 216, 117, 166, 124, 46, 6, 34, 219, 110, 211, 124, 6, 225, 225, 83, 68, 216, 72, 14, 205, 120, 89, 126, 89, 131, 220, 104, 242, 202, 31, 7, 42, 151, 10, 231, 93, 155, 244, 76, 156, 37, 32, 86, 126, 238, 5, 254, 130, 181, 179, 246, 29, 47, 7, 145, 99, 30, 27, 90, 6, 53, 145, 197, 93, 71, 135, 60, 247, 33, 156, 210, 169, 51, 157, 30, 83, 120, 102, 187, 185, 207, 11, 172, 9, 84, 129, 42, 129, 197, 215, 252, 191, 127, 29, 160, 1, 167, 23, 29, 209, 59, 27, 194, 103, 89, 245, 154, 49, 251, 111, 251, 47, 63, 216, 233, 35, 197, 127, 157, 246, 197, 57, 18, 137, 53, 50, 77, 7, 118, 111, 50, 26, 90, 21, 93, 242, 183, 82, 138, 112, 187, 142, 118, 153, 101, 197, 124, 221, 227, 184, 195, 239, 143, 132, 211, 156, 125, 62, 120, 78, 142, 4, 74, 178, 7, 195, 71, 242, 201, 21, 127, 242, 161, 124, 193, 231, 41, 157, 11, 48, 204, 113, 43, 190, 159, 145, 244, 246, 228, 129, 207, 135, 86, 116, 216, 118, 253, 184, 205, 124, 42, 31, 176, 216, 42, 150, 179, 9, 153, 102, 2, 255, 200, 22, 149, 82, 205, 203, 185, 178, 116, 54, 6, 203, 74, 80, 17, 36, 4, 145, 29, 52, 97, 1, 132, 239, 59, 29, 30, 12, 27, 233, 78, 194, 175, 80, 207, 210, 44, 178, 229, 61, 3, 105, 141, 173, 10, 103, 185, 190, 120, 44, 18, 139, 33, 127, 152, 197, 226, 61, 28, 134, 252, 196, 132, 220, 81, 116, 17, 164, 94, 211, 2, 175, 121, 214, 92, 144, 77, 138, 55, 6, 18, 124, 124, 31, 143, 126, 232, 242, 255, 96, 191, 197, 83, 221, 82, 203, 127, 189, 212, 50, 132, 3, 114, 106, 168, 119, 172, 164, 104, 101, 3, 101, 73, 137, 74, 50, 201, 243, 254, 234, 209, 231, 217, 69, 238, 62, 61, 176, 194, 129, 235, 70, 90, 40, 79, 93, 84, 222, 160, 30, 199, 0, 67, 9, 52, 131, 229, 38, 8, 215, 211, 141, 123, 33, 170, 51, 194, 95, 187, 25, 152, 3, 1, 19, 122, 155, 90, 223, 151, 58, 77, 252, 119, 208, 172, 242, 19, 123, 239, 199, 6, 94, 15, 79, 122, 95, 229, 220, 112, 220, 109, 0, 178, 243, 167, 14, 171, 143, 35, 158, 209, 138, 68, 28, 177, 96, 87, 194, 0, 155, 100, 139, 208, 92, 170, 246, 18, 230, 211, 51, 194, 17, 78, 100, 7, 42, 146, 160, 221, 210, 60, 144, 52, 73, 23, 79, 188, 14, 49, 19, 175, 238, 173, 171, 244, 129, 114, 110, 21, 15, 76, 64, 22, 153, 42, 235, 244, 150, 4, 175, 58, 21, 36, 254, 251, 42, 204, 206, 177, 163, 34, 214, 65, 164, 33, 21, 74, 89, 135, 38, 173, 59, 27, 203, 118, 215, 178, 234, 86, 228, 78, 117, 219, 2, 181, 207, 163, 175, 6, 6, 68, 148, 151, 29, 213, 105, 247, 84, 179, 198, 144, 146, 173, 43, 210, 33, 128, 7, 76, 2, 99, 67, 54, 149, 85, 130, 19, 5, 183, 76, 188, 72, 65, 27, 160, 228, 216, 101, 78, 192, 59, 62, 245, 169, 231, 176, 235, 7, 107, 227, 222, 131, 192, 184, 10, 244, 109, 243, 170, 193, 212, 103, 96, 194, 188, 133, 14, 184, 194, 180, 212, 75, 235, 253, 224, 3, 54, 60, 23, 4, 130, 3, 170, 111, 58, 168, 127, 136, 222, 76, 213, 74, 145, 61, 101, 121, 74, 13, 137, 246, 110, 131, 225, 49, 204, 97, 65, 152, 1, 79, 116, 206, 243, 8, 111, 232, 181, 112, 225, 5, 65, 88, 232, 47, 197, 92, 119, 125, 123, 244, 56, 14, 196, 79, 214, 63, 70, 196, 188, 216, 243, 196, 93, 229, 44, 58, 53, 158, 95, 209, 115, 199, 231, 167, 162, 103, 89, 67, 108, 149, 34, 4, 128, 32, 165, 57, 135, 158, 195, 144, 8, 144, 166, 55, 87, 153, 44, 129, 77, 244, 103, 172, 43, 153, 207, 222, 252, 142, 142, 161, 200, 139, 65, 229, 172, 241, 126, 152, 74, 89, 172, 106, 9, 185, 125, 118, 135, 182, 215, 197, 73, 154, 105, 54, 16, 175, 89, 196, 178, 236, 30, 23, 45, 104, 160, 93, 32, 51, 113, 117, 248, 160, 50, 134, 97, 125, 44, 197, 55, 69, 150, 37, 29, 157, 123, 137, 164, 90, 141, 16, 137, 48, 16, 164, 99, 209, 210, 10, 237, 182, 29, 141, 106, 189, 48, 202, 239, 15, 58, 230, 173, 113, 253, 38, 121, 129, 194, 162, 122, 155, 191, 140, 64, 165, 65, 153, 148, 129, 185, 194, 107, 239, 55, 76, 191, 249, 31, 254, 164, 6, 140, 252, 231, 156, 227, 35, 52, 0, 233, 206, 132, 140, 169, 200, 235, 91, 109, 98, 98, 210, 186, 108, 25, 4, 60, 116, 78, 39, 67, 93, 245, 145, 11, 88, 182, 182, 49, 161, 174, 107, 197, 159, 11, 145, 26, 42, 93, 54, 249, 246, 120, 166, 220, 126, 245, 152, 132, 255, 201, 253, 142, 103, 162, 156, 199, 133, 53, 116, 58, 201, 176, 1, 159, 128, 41, 229, 227, 16, 225, 167, 247, 61, 144, 140, 233, 254, 99, 179, 200, 119, 149, 101, 70, 150, 134, 36, 41, 216, 126, 86, 152, 99, 138, 18, 172, 247, 240, 243, 209, 229, 121, 63, 55, 93, 246, 172, 157, 225, 196, 40, 108, 190, 212, 81, 2, 115, 46, 97, 74, 200, 215, 226, 202, 171, 42, 189, 156, 4, 130, 2, 56, 46, 49, 145, 173, 195, 210, 43, 222, 239, 121, 69, 210, 205, 50, 121, 185, 204, 200, 226, 255, 203, 243, 139, 192, 65, 19, 198, 41, 188, 211, 245, 170, 172, 122, 132, 247, 251, 188, 18, 195, 148, 229, 24, 247, 7, 255, 64, 144, 249, 232, 120, 195, 15, 59, 134, 225, 107, 164, 199, 16, 105, 137, 255, 249, 101, 237, 90, 13, 151, 207, 111, 26, 2, 76, 40, 119, 93, 184, 91, 8, 180, 157, 247, 56, 9, 13, 238, 88, 14, 234, 211, 12, 36, 68, 205, 172, 17, 137, 209, 8, 1, 188, 12, 23, 159, 126, 9, 223, 23, 50, 177, 40, 101, 117, 220, 250, 243, 171, 189, 247, 108, 6, 242, 173, 217, 17, 187, 178, 22, 137, 220, 255, 237, 253, 128, 145, 39, 185, 5, 54, 70, 152, 143, 80, 31, 211, 248, 51, 2, 86, 20, 0, 172, 21, 234, 177, 0, 157, 237, 92, 85, 154, 78, 37, 228, 210, 136, 99, 176, 213, 135, 167, 159, 204, 180, 88, 98, 186, 90, 124, 228, 18, 173, 197, 157, 154, 47, 173, 109, 117, 212, 86, 106, 204, 214, 178, 73, 144, 86, 227, 2, 18, 213, 36, 69, 124, 77, 195, 201, 165, 111, 207, 127, 30, 198, 27, 97, 120, 229, 165, 38, 40, 131, 147, 157, 104, 160, 192, 104, 145, 0, 199, 156, 133, 139, 40, 50, 172, 100, 138, 24, 182, 237, 90, 143, 94, 248, 79, 129, 156, 152, 127, 119, 11, 37, 103, 66, 210, 65, 147, 100, 64, 34, 117, 153, 243, 89, 176, 248, 47, 207, 114, 149, 148, 226, 106, 196, 197, 23, 243, 150, 80, 131, 134, 174, 21, 18, 53, 90, 63, 218, 182, 184, 223, 54, 64, 61, 60, 32, 163, 136, 0, 58, 87, 39, 24, 65, 190, 181, 203, 4, 8, 110, 156, 136, 216, 204, 31, 239, 242, 53, 152, 163, 12, 209, 204, 8, 61, 145, 157, 191, 139, 139, 126, 77, 86, 76, 156, 241, 102, 51, 26, 32, 83, 228, 70, 128, 139, 246, 118, 206, 196, 58, 6, 53, 148, 6, 123, 192, 136, 189, 158, 155, 73, 53, 131, 248, 204, 125, 226, 93, 212, 187, 232, 42, 196, 0, 81, 161, 158, 154, 134, 191, 15, 208, 103, 138, 247, 121, 189, 91, 55, 133, 13, 234, 138, 135, 162, 25, 168, 1, 136, 213, 208, 13, 23, 141, 238, 121, 64, 199, 163, 179, 235, 230, 149, 146, 129, 192, 109, 241, 225, 234, 90, 250, 57, 143, 124, 158, 173, 202, 70, 33, 129, 191, 193, 90, 254, 56, 85, 83, 117, 147, 3, 82, 122, 154, 79, 83, 151, 113, 22, 178, 236, 234, 187, 242, 87, 143, 32, 160, 239, 139, 179, 225, 144, 192, 140, 32, 63, 54, 58, 231, 233, 65, 201, 16, 233, 198, 34, 192, 3, 192, 231, 165, 69, 246, 138, 164, 195, 64, 119, 70, 147, 46, 11, 248, 88, 178, 228, 18, 124, 58, 142, 167, 214, 4, 103, 176, 87, 232, 244, 234, 33, 78, 232, 209, 39, 199, 44, 69, 84, 145, 40, 226, 28, 119, 139, 35, 188, 72, 230, 29, 42, 167, 241, 165, 102, 27, 145, 110, 243, 45, 107, 149, 228, 29, 221, 105, 157, 4, 250, 77, 65, 125, 32, 133, 185, 231, 48, 143, 156, 2, 210, 252, 216, 48, 120, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 48, 61, 48, 33, 48, 9, 6, 5, 43, 14, 3, 2, 26, 5, 0, 4, 20, 180, 216, 120, 155, 0, 112, 93, 199, 9, 124, 85, 225, 145, 167, 242, 210, 67, 232, 47, 64, 4, 20, 118, 64, 12, 165, 214, 213, 187, 145, 17, 163, 12, 112, 66, 189, 245, 214, 240, 52, 36, 141, 2, 2, 4, 0, 0, 0 };
var cert = new X509Certificate2(certraw, "symetria");
In linux-only, I get System.Security.Cryptography.CryptographicException: 'The certificate data cannot be read with the provided password, the password may be incorrect.'
My docker-file is default from Right-click -> Add docker support in visual studio. The docker image is runtime/sdk :5.0-buster
joshlang
All 23 comments
@bartonjs regression apparently?
danmosemsft
on 19 Mar 2020
I'll have a look.
vcsjones
on 19 Mar 2020
Full stack for reference.
Unhandled exception. System.Security.Cryptography.CryptographicException: The certificate data cannot be read with the provided password, the password may be incorrect.
---> System.Security.Cryptography.CryptographicException: A certificate referenced a private key which was already referenced, or could not be loaded. at Internal.Cryptography.Pal.UnixPkcs12Reader.BuildCertsWithKeys(CertBagAsn[] certBags, AttributeAsn[][] certBagAttrs, CertAndKey[] certs, Int32 certBagIdx, SafeBagAsn[] keyBags, RentedSubjectPublicKeyInfo[] publicKeyInfos, AsymmetricAlgorithm[] keys, Int32 keyBagIdx) at Internal.Cryptography.Pal.UnixPkcs12Reader.Decrypt(ReadOnlySpan`1 password, ReadOnlyMemory`1 authSafeContents) at Internal.Cryptography.Pal.UnixPkcs12Reader.VerifyAndDecrypt(ReadOnlySpan`1 password, ReadOnlyMemory`1 authSafeContents) at Internal.Cryptography.Pal.UnixPkcs12Reader.Decrypt(SafePasswordHandle password) --- End of inner exception stack trace --- at Internal.Cryptography.Pal.UnixPkcs12Reader.Decrypt(SafePasswordHandle password) at Internal.Cryptography.Pal.PkcsFormatReader.TryReadPkcs12(OpenSslPkcs12Reader pfx, SafePasswordHandle password, Boolean single, ICertificatePal& readPal, List`1& readCerts) at Internal.Cryptography.Pal.PkcsFormatReader.TryReadPkcs12(Byte[] rawData, SafePasswordHandle password, Boolean single, ICertificatePal& readPal, List`1& readCerts, Exception& openSslException) at Internal.Cryptography.Pal.OpenSslX509CertificateReader.FromBlob(Byte[] rawData, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags) at System.Security.Cryptography.X509Certificates.X509Certificate..ctor(Byte[] rawData, String password, X509KeyStorageFlags keyStorageFlags) at System.Security.Cryptography.X509Certificates.X509Certificate2..ctor(Byte[] rawData, String password) at Program.Main() in /code/personal/scratch/Program.cs:line 10
vcsjones
on 19 Mar 2020
Reduced test case, this fails in Linux but works on Windows.
using System;
using System.Security.Cryptography;
public class Program {
static void Main() {
string keyStr = "ME0CAQAwEwYHKoZIzj0CAQYIKoZIzj0DAQcEMzAxAgEBBCDaB5vgkVIrCMAOrzS5QzWy4DZ1Jrp7xZDaND0HOOweHaAKBggqhkjOPQMBBw==";
var key = Convert.FromBase64String(keyStr);
using var ecdsa = ECDsa.Create();
ecdsa.ImportPkcs8PrivateKey(key, out _);
Console.WriteLine(ecdsa.KeySize);
}
}
@vcsjones ... I feel the need to inform you that you are a genius. Just sayin'.
joshlang
on 19 Mar 2020
😄3
@joshlang @bartonjs gist of the issue is that the ECPrivateKey is missing the public key. As defined in https://www.secg.org/sec1-v2.pdf part C.4, the public key is optional.
Basically, we're running in to this condition:
The private key does carry the private key, so it seems that Windows is re-deriving the public key from the private key. The PKCS8 helpers require the pre-calculated public key. The comment there makes me think this is a known limitation. The behavior difference is that on Windows, CNG handles all of the PKCS8 key import. On Linux, it is decoded and the parameters are imported manually.
It regressed in .NET Core 5.0 because the PKCS12 reader is going from a "implemented mostly with OpenSSL" to a more managed implementation. The no-public-key limitation exists in 3.1, however PKCS12 reading didn't use it until 5.0. I would assume that OpenSSL's PKCS12 reader is also re-deriving the public key when needed.
As a work around, if you round-trip your certifcate / p12 through openssl, the re-exported contents will work in .NET Core 5.0.
openssl pkcs12 -in key.p12 -out re-exported.p12
Where key.p12 is a file containing the bytes of certraw, and and then re-exported.12 contains the bytes with it fixed up.
vcsjones
on 19 Mar 2020
So I guess we need to look into whether we can get an import to work when we have D but not Q.
My gut says that something (probably macOS) was too picky about something with PKCS#8, which is why I didn't send it to the native layers on Unix systems. (Windows CNG respects some attributes to limit key usage, and we ignore attributes, so we had to ask Windows to do the import for us on Windows)
bartonjs
on 19 Mar 2020
we need to look into whether we can get an import to work when we have D but not Q.
@bartonjs
I don't know about macOS, but for openssl we can re-calculate it with EC_KEY_set_private_key EC_POINT_mul, and finally EC_POINT_point2bn since we have the curve. I don't know where to begin to look at this for macOS.
Is it worth fixing for the openssl code path at least?
vcsjones
on 19 Mar 2020
I've run into this D but not Q limitation several times before, whether for this, or stuff like deriving bitcoin addresses from private keys, etc.
I must admit... I've always wondered - why not just do the calculation? I'm only familiar with a couple curves - so maybe it's not so easy as an EC multiplication for all cases?
joshlang
on 19 Mar 2020
I've always wondered - why not just do the calculation?
We don't have an ECC calculator in the .NET layer; we work with the underlying system libraries opaquely through key objects... so then we're subject to limitations they have at the import/export/create boundary.
Is it worth fixing for the openssl code path at least?
Absent the PFX regression I'd say it's a nice-to-have enhancement. Given the context of this report, I'd say we should do it, to prevent the regression.
for openssl we can re-calculate it with ...
Looks like it might be
EC_GROUP* group = EC_KEY_get0_group(key);
EC_POINT* pubkey = EC_POINT_new(group);
EC_POINT_mul(group, pubkey, d, NULL, NULL, NULL);
with proper error checking, of course. We could do that in https://github.com/dotnet/runtime/blob/master/src/libraries/Native/Unix/System.Security.Cryptography.Native/pal_ecc_import_export.c#L374 as an else if (d != NULL).
If we can make Q.X == null && Q.Y == null work for Windows (worst case? make a PKCS#8 :smile:) and macOS, we can just soften the constraints in ImportParameters to require ((Y == null) == (X == null)) && (X != null || D != null). I'd rather not soften them in only one OS family.
bartonjs
on 19 Mar 2020
Absent the PFX regression I'd say it's a nice-to-have enhancement. Given the context of this report, I'd say we should do it, to prevent the regression.
Fixing it has my vote too (even though there's a workaround).
We generate certificates using the popular Certes library to generate TLS certificates from Let's Encrypt. I imagine that it's a common enough scenario that it's worth fixing.
We don't have an ECC calculator in the .NET layer;
^-- easy fix. Just import BouncyCastle into .net core runtime. ............lol
joshlang
on 19 Mar 2020
As a work around, if you round-trip your certifcate / p12 through openssl, the re-exported contents will work in .NET Core 5.0.
openssl pkcs12 -in key.p12 -out re-exported.p12Where
key.p12is a file containing the bytes ofcertraw, and and thenre-exported.12contains the bytes with it fixed up.
Unfortunately, this doesn't work (or I'm doing it wrong).
The command used to transform: openssl pkcs12 -in cert.pfx -out out.pfx -passin pass:symetria -passout pass:symetria
Test code - the raw byte array is the out.pfx outputted above:
var rawCert = new byte[] { 66, 97, 103, 32, 65, 116, 116, 114, 105, 98, 117, 116, 101, 115, 10, 32, 32, 32, 32, 108, 111, 99, 97, 108, 75, 101, 121, 73, 68, 58, 32, 67, 66, 32, 56, 52, 32, 52, 52, 32, 50, 56, 32, 49, 65, 32, 51, 51, 32, 50, 51, 32, 57, 68, 32, 67, 65, 32, 54, 65, 32, 69, 57, 32, 57, 66, 32, 54, 52, 32, 56, 69, 32, 66, 49, 32, 55, 57, 32, 65, 51, 32, 52, 70, 32, 66, 66, 32, 54, 53, 32, 10, 32, 32, 32, 32, 102, 114, 105, 101, 110, 100, 108, 121, 78, 97, 109, 101, 58, 32, 97, 112, 112, 46, 100, 101, 118, 46, 115, 121, 109, 101, 116, 114, 105, 97, 46, 105, 111, 10, 75, 101, 121, 32, 65, 116, 116, 114, 105, 98, 117, 116, 101, 115, 58, 32, 60, 78, 111, 32, 65, 116, 116, 114, 105, 98, 117, 116, 101, 115, 62, 10, 45, 45, 45, 45, 45, 66, 69, 71, 73, 78, 32, 69, 78, 67, 82, 89, 80, 84, 69, 68, 32, 80, 82, 73, 86, 65, 84, 69, 32, 75, 69, 89, 45, 45, 45, 45, 45, 10, 77, 73, 71, 97, 77, 69, 52, 71, 67, 83, 113, 71, 83, 73, 98, 51, 68, 81, 69, 70, 68, 84, 66, 66, 77, 67, 107, 71, 67, 83, 113, 71, 83, 73, 98, 51, 68, 81, 69, 70, 68, 68, 65, 99, 66, 65, 106, 77, 108, 55, 112, 54, 65, 111, 78, 49, 115, 119, 73, 67, 67, 65, 65, 119, 10, 68, 65, 89, 73, 75, 111, 90, 73, 104, 118, 99, 78, 65, 103, 107, 70, 65, 68, 65, 85, 66, 103, 103, 113, 104, 107, 105, 71, 57, 119, 48, 68, 66, 119, 81, 73, 98, 82, 76, 72, 73, 79, 113, 50, 90, 108, 115, 69, 83, 75, 80, 54, 115, 74, 48, 119, 74, 54, 121, 53, 80, 97, 87, 82, 10, 119, 79, 50, 81, 110, 53, 50, 112, 116, 57, 103, 118, 122, 53, 67, 121, 83, 84, 116, 70, 70, 47, 50, 109, 109, 113, 86, 109, 89, 115, 111, 113, 112, 109, 99, 49, 110, 86, 98, 83, 86, 79, 76, 50, 49, 82, 121, 76, 72, 100, 67, 48, 113, 49, 107, 109, 49, 104, 52, 69, 77, 72, 100, 104, 10, 78, 78, 88, 89, 119, 68, 70, 115, 117, 119, 99, 100, 119, 110, 81, 53, 71, 65, 61, 61, 10, 45, 45, 45, 45, 45, 69, 78, 68, 32, 69, 78, 67, 82, 89, 80, 84, 69, 68, 32, 80, 82, 73, 86, 65, 84, 69, 32, 75, 69, 89, 45, 45, 45, 45, 45, 10, 66, 97, 103, 32, 65, 116, 116, 114, 105, 98, 117, 116, 101, 115, 10, 32, 32, 32, 32, 108, 111, 99, 97, 108, 75, 101, 121, 73, 68, 58, 32, 67, 66, 32, 56, 52, 32, 52, 52, 32, 50, 56, 32, 49, 65, 32, 51, 51, 32, 50, 51, 32, 57, 68, 32, 67, 65, 32, 54, 65, 32, 69, 57, 32, 57, 66, 32, 54, 52, 32, 56, 69, 32, 66, 49, 32, 55, 57, 32, 65, 51, 32, 52, 70, 32, 66, 66, 32, 54, 53, 32, 10, 32, 32, 32, 32, 102, 114, 105, 101, 110, 100, 108, 121, 78, 97, 109, 101, 58, 32, 97, 112, 112, 46, 100, 101, 118, 46, 115, 121, 109, 101, 116, 114, 105, 97, 46, 105, 111, 10, 115, 117, 98, 106, 101, 99, 116, 61, 67, 78, 32, 61, 32, 97, 112, 112, 46, 100, 101, 118, 46, 115, 121, 109, 101, 116, 114, 105, 97, 46, 105, 111, 10, 10, 105, 115, 115, 117, 101, 114, 61, 67, 32, 61, 32, 85, 83, 44, 32, 79, 32, 61, 32, 76, 101, 116, 39, 115, 32, 69, 110, 99, 114, 121, 112, 116, 44, 32, 67, 78, 32, 61, 32, 76, 101, 116, 39, 115, 32, 69, 110, 99, 114, 121, 112, 116, 32, 65, 117, 116, 104, 111, 114, 105, 116, 121, 32, 88, 51, 10, 10, 45, 45, 45, 45, 45, 66, 69, 71, 73, 78, 32, 67, 69, 82, 84, 73, 70, 73, 67, 65, 84, 69, 45, 45, 45, 45, 45, 10, 77, 73, 73, 69, 114, 84, 67, 67, 65, 53, 87, 103, 65, 119, 73, 66, 65, 103, 73, 83, 66, 77, 69, 85, 71, 67, 109, 79, 67, 54, 99, 119, 103, 109, 55, 90, 104, 79, 56, 82, 77, 43, 54, 57, 77, 65, 48, 71, 67, 83, 113, 71, 83, 73, 98, 51, 68, 81, 69, 66, 67, 119, 85, 65, 10, 77, 69, 111, 120, 67, 122, 65, 74, 66, 103, 78, 86, 66, 65, 89, 84, 65, 108, 86, 84, 77, 82, 89, 119, 70, 65, 89, 68, 86, 81, 81, 75, 69, 119, 49, 77, 90, 88, 81, 110, 99, 121, 66, 70, 98, 109, 78, 121, 101, 88, 66, 48, 77, 83, 77, 119, 73, 81, 89, 68, 86, 81, 81, 68, 10, 69, 120, 112, 77, 90, 88, 81, 110, 99, 121, 66, 70, 98, 109, 78, 121, 101, 88, 66, 48, 73, 69, 70, 49, 100, 71, 104, 118, 99, 109, 108, 48, 101, 83, 66, 89, 77, 122, 65, 101, 70, 119, 48, 121, 77, 68, 65, 122, 77, 84, 107, 119, 77, 68, 69, 49, 78, 68, 70, 97, 70, 119, 48, 121, 10, 77, 68, 65, 50, 77, 84, 99, 119, 77, 68, 69, 49, 78, 68, 70, 97, 77, 66, 52, 120, 72, 68, 65, 97, 66, 103, 78, 86, 66, 65, 77, 84, 69, 50, 70, 119, 99, 67, 53, 107, 90, 88, 89, 117, 99, 51, 108, 116, 90, 88, 82, 121, 97, 87, 69, 117, 97, 87, 56, 119, 87, 84, 65, 84, 10, 66, 103, 99, 113, 104, 107, 106, 79, 80, 81, 73, 66, 66, 103, 103, 113, 104, 107, 106, 79, 80, 81, 77, 66, 66, 119, 78, 67, 65, 65, 83, 50, 108, 54, 117, 90, 49, 106, 100, 54, 77, 110, 55, 51, 120, 109, 57, 87, 76, 112, 81, 90, 113, 69, 112, 74, 80, 110, 115, 84, 99, 99, 55, 104, 10, 87, 86, 105, 54, 106, 68, 76, 112, 101, 107, 112, 120, 89, 118, 115, 103, 84, 98, 105, 66, 100, 47, 69, 98, 105, 117, 101, 119, 106, 73, 71, 118, 56, 68, 81, 53, 66, 98, 75, 53, 66, 56, 78, 52, 47, 89, 85, 75, 86, 86, 78, 107, 111, 52, 73, 67, 103, 106, 67, 67, 65, 110, 52, 119, 10, 68, 103, 89, 68, 86, 82, 48, 80, 65, 81, 72, 47, 66, 65, 81, 68, 65, 103, 101, 65, 77, 66, 48, 71, 65, 49, 85, 100, 74, 81, 81, 87, 77, 66, 81, 71, 67, 67, 115, 71, 65, 81, 85, 70, 66, 119, 77, 66, 66, 103, 103, 114, 66, 103, 69, 70, 66, 81, 99, 68, 65, 106, 65, 77, 10, 66, 103, 78, 86, 72, 82, 77, 66, 65, 102, 56, 69, 65, 106, 65, 65, 77, 66, 48, 71, 65, 49, 85, 100, 68, 103, 81, 87, 66, 66, 84, 76, 104, 69, 81, 111, 71, 106, 77, 106, 110, 99, 112, 113, 54, 90, 116, 107, 106, 114, 70, 53, 111, 48, 43, 55, 90, 84, 65, 102, 66, 103, 78, 86, 10, 72, 83, 77, 69, 71, 68, 65, 87, 103, 66, 83, 111, 83, 109, 112, 106, 66, 72, 51, 100, 117, 117, 98, 82, 79, 98, 101, 109, 82, 87, 88, 118, 56, 54, 106, 115, 111, 84, 66, 118, 66, 103, 103, 114, 66, 103, 69, 70, 66, 81, 99, 66, 65, 81, 82, 106, 77, 71, 69, 119, 76, 103, 89, 73, 10, 75, 119, 89, 66, 66, 81, 85, 72, 77, 65, 71, 71, 73, 109, 104, 48, 100, 72, 65, 54, 76, 121, 57, 118, 89, 51, 78, 119, 76, 109, 108, 117, 100, 67, 49, 52, 77, 121, 53, 115, 90, 88, 82, 122, 90, 87, 53, 106, 99, 110, 108, 119, 100, 67, 53, 118, 99, 109, 99, 119, 76, 119, 89, 73, 10, 75, 119, 89, 66, 66, 81, 85, 72, 77, 65, 75, 71, 73, 50, 104, 48, 100, 72, 65, 54, 76, 121, 57, 106, 90, 88, 74, 48, 76, 109, 108, 117, 100, 67, 49, 52, 77, 121, 53, 115, 90, 88, 82, 122, 90, 87, 53, 106, 99, 110, 108, 119, 100, 67, 53, 118, 99, 109, 99, 118, 77, 68, 99, 71, 10, 65, 49, 85, 100, 69, 81, 81, 119, 77, 67, 54, 67, 69, 50, 70, 119, 99, 67, 53, 107, 90, 88, 89, 117, 99, 51, 108, 116, 90, 88, 82, 121, 97, 87, 69, 117, 97, 87, 43, 67, 70, 51, 100, 51, 100, 121, 53, 104, 99, 72, 65, 117, 90, 71, 86, 50, 76, 110, 78, 53, 98, 87, 86, 48, 10, 99, 109, 108, 104, 76, 109, 108, 118, 77, 69, 119, 71, 65, 49, 85, 100, 73, 65, 82, 70, 77, 69, 77, 119, 67, 65, 89, 71, 90, 52, 69, 77, 65, 81, 73, 66, 77, 68, 99, 71, 67, 121, 115, 71, 65, 81, 81, 66, 103, 116, 56, 84, 65, 81, 69, 66, 77, 67, 103, 119, 74, 103, 89, 73, 10, 75, 119, 89, 66, 66, 81, 85, 72, 65, 103, 69, 87, 71, 109, 104, 48, 100, 72, 65, 54, 76, 121, 57, 106, 99, 72, 77, 117, 98, 71, 86, 48, 99, 50, 86, 117, 89, 51, 74, 53, 99, 72, 81, 117, 98, 51, 74, 110, 77, 73, 73, 66, 66, 81, 89, 75, 75, 119, 89, 66, 66, 65, 72, 87, 10, 101, 81, 73, 69, 65, 103, 83, 66, 57, 103, 83, 66, 56, 119, 68, 120, 65, 72, 89, 65, 66, 55, 100, 99, 71, 43, 86, 57, 97, 80, 47, 120, 115, 77, 89, 100, 73, 120, 88, 72, 117, 117, 90, 88, 102, 70, 101, 85, 116, 50, 114, 117, 118, 71, 69, 54, 71, 109, 110, 84, 111, 104, 119, 65, 10, 65, 65, 70, 119, 56, 70, 119, 55, 120, 119, 65, 65, 66, 65, 77, 65, 82, 122, 66, 70, 65, 105, 66, 65, 80, 114, 98, 54, 67, 116, 116, 50, 114, 106, 88, 72, 111, 99, 120, 100, 65, 65, 71, 67, 105, 86, 112, 109, 97, 101, 86, 83, 47, 65, 73, 89, 67, 50, 114, 109, 47, 87, 56, 90, 10, 111, 119, 73, 104, 65, 77, 87, 75, 55, 73, 105, 119, 79, 114, 112, 86, 78, 110, 118, 67, 68, 68, 69, 66, 120, 53, 117, 81, 89, 86, 119, 116, 57, 112, 105, 65, 107, 87, 43, 51, 52, 50, 66, 83, 47, 70, 90, 117, 65, 72, 99, 65, 98, 49, 78, 50, 114, 68, 72, 119, 77, 82, 110, 89, 10, 109, 81, 67, 107, 85, 82, 88, 47, 100, 120, 85, 99, 69, 100, 107, 67, 119, 81, 65, 112, 66, 111, 50, 121, 67, 74, 111, 51, 50, 82, 77, 65, 65, 65, 70, 119, 56, 70, 119, 55, 43, 119, 65, 65, 66, 65, 77, 65, 83, 68, 66, 71, 65, 105, 69, 65, 110, 66, 87, 115, 89, 115, 74, 79, 10, 54, 78, 117, 49, 78, 97, 87, 56, 119, 70, 66, 110, 118, 110, 120, 97, 88, 108, 55, 49, 50, 104, 47, 79, 75, 103, 56, 65, 114, 69, 53, 120, 65, 108, 81, 67, 73, 81, 68, 53, 66, 97, 117, 52, 83, 71, 111, 100, 83, 86, 102, 105, 67, 114, 85, 100, 67, 86, 122, 81, 69, 113, 43, 109, 10, 65, 87, 74, 108, 120, 68, 87, 74, 116, 49, 78, 88, 102, 49, 105, 53, 116, 68, 65, 78, 66, 103, 107, 113, 104, 107, 105, 71, 57, 119, 48, 66, 65, 81, 115, 70, 65, 65, 79, 67, 65, 81, 69, 65, 102, 104, 98, 111, 102, 49, 115, 83, 72, 68, 113, 112, 88, 115, 109, 66, 106, 68, 116, 87, 10, 71, 101, 87, 117, 87, 54, 78, 117, 77, 80, 57, 100, 85, 87, 118, 104, 121, 108, 113, 118, 102, 90, 122, 80, 112, 73, 118, 52, 82, 74, 113, 112, 52, 121, 76, 80, 88, 119, 75, 115, 105, 53, 116, 83, 79, 86, 81, 48, 89, 69, 83, 98, 82, 54, 69, 119, 83, 122, 56, 57, 86, 43, 108, 85, 10, 101, 113, 56, 74, 47, 66, 43, 76, 118, 117, 65, 78, 49, 117, 88, 86, 102, 120, 65, 79, 105, 72, 90, 115, 116, 74, 51, 114, 89, 118, 82, 55, 53, 65, 77, 65, 112, 43, 111, 89, 73, 43, 52, 97, 118, 82, 99, 50, 121, 65, 107, 74, 83, 68, 114, 122, 69, 104, 120, 98, 106, 113, 68, 77, 10, 108, 79, 81, 108, 69, 103, 48, 85, 68, 120, 121, 74, 53, 114, 43, 88, 73, 103, 116, 100, 67, 75, 71, 86, 101, 104, 83, 65, 111, 110, 114, 110, 106, 43, 81, 55, 99, 113, 54, 68, 76, 104, 108, 77, 51, 117, 56, 90, 50, 119, 101, 83, 84, 109, 51, 86, 82, 120, 76, 103, 53, 54, 52, 85, 10, 120, 75, 48, 67, 84, 88, 116, 78, 86, 47, 78, 76, 89, 118, 69, 101, 83, 52, 109, 121, 78, 57, 114, 78, 102, 83, 74, 55, 109, 98, 109, 102, 100, 84, 85, 120, 105, 97, 120, 119, 89, 119, 74, 53, 111, 69, 122, 114, 113, 82, 87, 112, 80, 72, 54, 79, 55, 82, 104, 120, 90, 115, 54, 76, 10, 100, 117, 105, 122, 67, 98, 115, 90, 122, 122, 100, 97, 76, 76, 105, 114, 122, 99, 74, 84, 98, 97, 86, 70, 69, 89, 110, 89, 112, 82, 107, 78, 51, 86, 101, 84, 108, 87, 43, 81, 74, 66, 117, 120, 104, 89, 88, 85, 90, 57, 117, 52, 79, 87, 68, 89, 81, 53, 43, 52, 51, 78, 106, 69, 10, 83, 119, 61, 61, 10, 45, 45, 45, 45, 45, 69, 78, 68, 32, 67, 69, 82, 84, 73, 70, 73, 67, 65, 84, 69, 45, 45, 45, 45, 45, 10, 66, 97, 103, 32, 65, 116, 116, 114, 105, 98, 117, 116, 101, 115, 58, 32, 60, 69, 109, 112, 116, 121, 32, 65, 116, 116, 114, 105, 98, 117, 116, 101, 115, 62, 10, 115, 117, 98, 106, 101, 99, 116, 61, 67, 32, 61, 32, 85, 83, 44, 32, 79, 32, 61, 32, 76, 101, 116, 39, 115, 32, 69, 110, 99, 114, 121, 112, 116, 44, 32, 67, 78, 32, 61, 32, 76, 101, 116, 39, 115, 32, 69, 110, 99, 114, 121, 112, 116, 32, 65, 117, 116, 104, 111, 114, 105, 116, 121, 32, 88, 51, 10, 10, 105, 115, 115, 117, 101, 114, 61, 79, 32, 61, 32, 68, 105, 103, 105, 116, 97, 108, 32, 83, 105, 103, 110, 97, 116, 117, 114, 101, 32, 84, 114, 117, 115, 116, 32, 67, 111, 46, 44, 32, 67, 78, 32, 61, 32, 68, 83, 84, 32, 82, 111, 111, 116, 32, 67, 65, 32, 88, 51, 10, 10, 45, 45, 45, 45, 45, 66, 69, 71, 73, 78, 32, 67, 69, 82, 84, 73, 70, 73, 67, 65, 84, 69, 45, 45, 45, 45, 45, 10, 77, 73, 73, 69, 107, 106, 67, 67, 65, 51, 113, 103, 65, 119, 73, 66, 65, 103, 73, 81, 67, 103, 70, 66, 81, 103, 65, 65, 65, 86, 79, 70, 99, 50, 111, 76, 104, 101, 121, 110, 67, 68, 65, 78, 66, 103, 107, 113, 104, 107, 105, 71, 57, 119, 48, 66, 65, 81, 115, 70, 65, 68, 65, 47, 10, 77, 83, 81, 119, 73, 103, 89, 68, 86, 81, 81, 75, 69, 120, 116, 69, 97, 87, 100, 112, 100, 71, 70, 115, 73, 70, 78, 112, 90, 50, 53, 104, 100, 72, 86, 121, 90, 83, 66, 85, 99, 110, 86, 122, 100, 67, 66, 68, 98, 121, 52, 120, 70, 122, 65, 86, 66, 103, 78, 86, 66, 65, 77, 84, 10, 68, 107, 82, 84, 86, 67, 66, 83, 98, 50, 57, 48, 73, 69, 78, 66, 73, 70, 103, 122, 77, 66, 52, 88, 68, 84, 69, 50, 77, 68, 77, 120, 78, 122, 69, 50, 78, 68, 65, 48, 78, 108, 111, 88, 68, 84, 73, 120, 77, 68, 77, 120, 78, 122, 69, 50, 78, 68, 65, 48, 78, 108, 111, 119, 10, 83, 106, 69, 76, 77, 65, 107, 71, 65, 49, 85, 69, 66, 104, 77, 67, 86, 86, 77, 120, 70, 106, 65, 85, 66, 103, 78, 86, 66, 65, 111, 84, 68, 85, 120, 108, 100, 67, 100, 122, 73, 69, 86, 117, 89, 51, 74, 53, 99, 72, 81, 120, 73, 122, 65, 104, 66, 103, 78, 86, 66, 65, 77, 84, 10, 71, 107, 120, 108, 100, 67, 100, 122, 73, 69, 86, 117, 89, 51, 74, 53, 99, 72, 81, 103, 81, 88, 86, 48, 97, 71, 57, 121, 97, 88, 82, 53, 73, 70, 103, 122, 77, 73, 73, 66, 73, 106, 65, 78, 66, 103, 107, 113, 104, 107, 105, 71, 57, 119, 48, 66, 65, 81, 69, 70, 65, 65, 79, 67, 10, 65, 81, 56, 65, 77, 73, 73, 66, 67, 103, 75, 67, 65, 81, 69, 65, 110, 78, 77, 77, 56, 70, 114, 108, 76, 107, 101, 51, 99, 108, 48, 51, 103, 55, 78, 111, 89, 122, 68, 113, 49, 122, 85, 109, 71, 83, 88, 104, 118, 98, 52, 49, 56, 88, 67, 83, 76, 55, 101, 52, 83, 48, 69, 70, 10, 113, 54, 109, 101, 78, 81, 104, 89, 55, 76, 69, 113, 120, 71, 105, 72, 67, 54, 80, 106, 100, 101, 84, 109, 56, 54, 100, 105, 99, 98, 112, 53, 103, 87, 65, 102, 49, 53, 71, 97, 110, 47, 80, 81, 101, 71, 100, 120, 121, 71, 107, 79, 108, 90, 72, 80, 47, 117, 97, 90, 54, 87, 65, 56, 10, 83, 77, 120, 43, 121, 107, 49, 51, 69, 105, 83, 100, 82, 120, 116, 97, 54, 55, 110, 115, 72, 106, 99, 65, 72, 74, 121, 115, 101, 54, 99, 70, 54, 115, 53, 75, 54, 55, 49, 66, 53, 84, 97, 89, 117, 99, 118, 57, 98, 84, 121, 87, 97, 78, 56, 106, 75, 107, 75, 81, 68, 73, 90, 48, 10, 90, 56, 104, 47, 112, 90, 113, 52, 85, 109, 69, 85, 69, 122, 57, 108, 54, 89, 75, 72, 121, 57, 118, 54, 68, 108, 98, 50, 104, 111, 110, 122, 104, 84, 43, 88, 104, 113, 43, 119, 51, 66, 114, 118, 97, 119, 50, 86, 70, 110, 51, 69, 75, 54, 66, 108, 115, 112, 107, 69, 78, 110, 87, 65, 10, 97, 54, 120, 75, 56, 120, 117, 81, 83, 88, 103, 118, 111, 112, 90, 80, 75, 105, 65, 108, 75, 81, 84, 71, 100, 77, 68, 81, 77, 99, 50, 80, 77, 84, 105, 86, 70, 114, 113, 111, 77, 55, 104, 68, 56, 98, 69, 102, 119, 122, 66, 47, 111, 110, 107, 120, 69, 122, 48, 116, 78, 118, 106, 106, 10, 47, 80, 73, 122, 97, 114, 107, 53, 77, 99, 87, 118, 120, 73, 48, 78, 72, 87, 81, 87, 77, 54, 114, 54, 104, 67, 109, 50, 49, 65, 118, 65, 50, 72, 51, 68, 107, 119, 73, 68, 65, 81, 65, 66, 111, 52, 73, 66, 102, 84, 67, 67, 65, 88, 107, 119, 69, 103, 89, 68, 86, 82, 48, 84, 10, 65, 81, 72, 47, 66, 65, 103, 119, 66, 103, 69, 66, 47, 119, 73, 66, 65, 68, 65, 79, 66, 103, 78, 86, 72, 81, 56, 66, 65, 102, 56, 69, 66, 65, 77, 67, 65, 89, 89, 119, 102, 119, 89, 73, 75, 119, 89, 66, 66, 81, 85, 72, 65, 81, 69, 69, 99, 122, 66, 120, 77, 68, 73, 71, 10, 67, 67, 115, 71, 65, 81, 85, 70, 66, 122, 65, 66, 104, 105, 90, 111, 100, 72, 82, 119, 79, 105, 56, 118, 97, 88, 78, 121, 90, 121, 53, 48, 99, 110, 86, 122, 100, 71, 108, 107, 76, 109, 57, 106, 99, 51, 65, 117, 97, 87, 82, 108, 98, 110, 82, 121, 100, 88, 78, 48, 76, 109, 78, 118, 10, 98, 84, 65, 55, 66, 103, 103, 114, 66, 103, 69, 70, 66, 81, 99, 119, 65, 111, 89, 118, 97, 72, 82, 48, 99, 68, 111, 118, 76, 50, 70, 119, 99, 72, 77, 117, 97, 87, 82, 108, 98, 110, 82, 121, 100, 88, 78, 48, 76, 109, 78, 118, 98, 83, 57, 121, 98, 50, 57, 48, 99, 121, 57, 107, 10, 99, 51, 82, 121, 98, 50, 57, 48, 89, 50, 70, 52, 77, 121, 53, 119, 78, 50, 77, 119, 72, 119, 89, 68, 86, 82, 48, 106, 66, 66, 103, 119, 70, 111, 65, 85, 120, 75, 101, 120, 112, 72, 115, 115, 99, 102, 114, 98, 52, 85, 117, 81, 100, 102, 47, 69, 70, 87, 67, 70, 105, 82, 65, 119, 10, 86, 65, 89, 68, 86, 82, 48, 103, 66, 69, 48, 119, 83, 122, 65, 73, 66, 103, 90, 110, 103, 81, 119, 66, 65, 103, 69, 119, 80, 119, 89, 76, 75, 119, 89, 66, 66, 65, 71, 67, 51, 120, 77, 66, 65, 81, 69, 119, 77, 68, 65, 117, 66, 103, 103, 114, 66, 103, 69, 70, 66, 81, 99, 67, 10, 65, 82, 89, 105, 97, 72, 82, 48, 99, 68, 111, 118, 76, 50, 78, 119, 99, 121, 53, 121, 98, 50, 57, 48, 76, 88, 103, 120, 76, 109, 120, 108, 100, 72, 78, 108, 98, 109, 78, 121, 101, 88, 66, 48, 76, 109, 57, 121, 90, 122, 65, 56, 66, 103, 78, 86, 72, 82, 56, 69, 78, 84, 65, 122, 10, 77, 68, 71, 103, 76, 54, 65, 116, 104, 105, 116, 111, 100, 72, 82, 119, 79, 105, 56, 118, 89, 51, 74, 115, 76, 109, 108, 107, 90, 87, 53, 48, 99, 110, 86, 122, 100, 67, 53, 106, 98, 50, 48, 118, 82, 70, 78, 85, 85, 107, 57, 80, 86, 69, 78, 66, 87, 68, 78, 68, 85, 107, 119, 117, 10, 89, 51, 74, 115, 77, 66, 48, 71, 65, 49, 85, 100, 68, 103, 81, 87, 66, 66, 83, 111, 83, 109, 112, 106, 66, 72, 51, 100, 117, 117, 98, 82, 79, 98, 101, 109, 82, 87, 88, 118, 56, 54, 106, 115, 111, 84, 65, 78, 66, 103, 107, 113, 104, 107, 105, 71, 57, 119, 48, 66, 65, 81, 115, 70, 10, 65, 65, 79, 67, 65, 81, 69, 65, 51, 84, 80, 88, 69, 102, 78, 106, 87, 68, 106, 100, 71, 66, 88, 55, 67, 86, 87, 43, 100, 108, 97, 53, 99, 69, 105, 108, 97, 85, 99, 110, 101, 56, 73, 107, 67, 74, 76, 120, 87, 104, 57, 75, 69, 105, 107, 51, 74, 72, 82, 82, 72, 71, 74, 111, 10, 117, 77, 50, 86, 99, 71, 102, 108, 57, 54, 83, 56, 84, 105, 104, 82, 122, 90, 118, 111, 114, 111, 101, 100, 54, 116, 105, 54, 87, 113, 69, 66, 109, 116, 122, 119, 51, 87, 111, 100, 97, 116, 103, 43, 86, 121, 79, 101, 112, 104, 52, 69, 89, 112, 114, 47, 49, 119, 88, 75, 116, 120, 56, 47, 10, 119, 65, 112, 73, 118, 74, 83, 119, 116, 109, 86, 105, 52, 77, 70, 85, 53, 97, 77, 113, 114, 83, 68, 69, 54, 101, 97, 55, 51, 77, 106, 50, 116, 99, 77, 121, 111, 53, 106, 77, 100, 54, 106, 109, 101, 87, 85, 72, 75, 56, 115, 111, 47, 106, 111, 87, 85, 111, 72, 79, 85, 103, 119, 117, 10, 88, 52, 80, 111, 49, 81, 89, 122, 43, 51, 100, 115, 122, 107, 68, 113, 77, 112, 52, 102, 107, 108, 120, 66, 119, 88, 82, 115, 87, 49, 48, 75, 88, 122, 80, 77, 84, 90, 43, 115, 79, 80, 65, 118, 101, 121, 120, 105, 110, 100, 109, 106, 107, 87, 56, 108, 71, 121, 43, 81, 115, 82, 108, 71, 10, 80, 102, 90, 43, 71, 54, 90, 54, 104, 55, 109, 106, 101, 109, 48, 89, 43, 105, 87, 108, 107, 89, 99, 86, 52, 80, 73, 87, 76, 49, 105, 119, 66, 105, 56, 115, 97, 67, 98, 71, 83, 53, 106, 78, 50, 112, 56, 77, 43, 88, 43, 81, 55, 85, 78, 75, 69, 107, 82, 79, 98, 51, 78, 54, 10, 75, 79, 113, 107, 113, 109, 53, 55, 84, 72, 50, 72, 51, 101, 68, 74, 65, 107, 83, 110, 104, 54, 47, 68, 78, 70, 117, 48, 81, 103, 61, 61, 10, 45, 45, 45, 45, 45, 69, 78, 68, 32, 67, 69, 82, 84, 73, 70, 73, 67, 65, 84, 69, 45, 45, 45, 45, 45, 10 };
var cert = new X509Certificate2(rawCert, "symetria");
In windows, the certificate will not load. I get an WindowsCryptographicException with message Cannot find the requested object.
at Internal.Cryptography.Pal.CertificatePal.FromBlobOrFile(Byte[] rawData, String fileName, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags)
at System.Security.Cryptography.X509Certificates.X509Certificate..ctor(Byte[] rawData, String password, X509KeyStorageFlags keyStorageFlags)
at System.Security.Cryptography.X509Certificates.X509Certificate2..ctor(Byte[] rawData, String password)
at [my code]
In linux, the certificate loads successfully. However, later:
fail: Microsoft.AspNetCore.Server.Kestrel[0]
Unhandled exception while processing 0HLUCBELH5D73.
System.NotSupportedException: The server mode SSL must use a certificate with the associated private key.
at System.Net.Security.SecureChannel.AcquireServerCredentials(Byte[]& thumbPrint, ReadOnlySpan`1 clientHello)
at System.Net.Security.SecureChannel.GenerateToken(ReadOnlySpan`1 inputBuffer, Byte[]& output)
at System.Net.Security.SecureChannel.NextMessage(ReadOnlySpan`1 incomingBuffer)
at System.Net.Security.SslStream.ReceiveBlobAsync[TIOAdapter](TIOAdapter adapter)
at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](TIOAdapter adapter, Boolean receiveFirst, Byte[] reAuthenticationData, Boolean isApm)
at Microsoft.AspNetCore.Server.Kestrel.Https.Internal.HttpsConnectionMiddleware.OnConnectionAsync(ConnectionContext context)
at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Infrastructure.KestrelConnection.ExecuteAsync()
Oh, I thought I saw this work, I'm guessing I did something silly. (See, there is plenty of time left for me to prove I am not a genius) It's actually outputting a textual dump of the p12 file.
Let me see again..
vcsjones
on 20 Mar 2020
Looking closer at this, OpenSSL seems to be trying really really hard to preserve the key as-written. The easiest thing at this point I think would be to do File.WriteAllBytes("out.p12", cert.Export(X509ContentType.Pkcs12, "password")) from Windows and let Windows write the P12 from scratch.
vcsjones
on 20 Mar 2020
Our pipeline, including certificate generation, all runs in linux. I'll see if I can find a different workaround. I'll post if I find one.
joshlang
on 20 Mar 2020
We don't have an ECC calculator in the .NET layer;
I understand it's complex. I really think it should be considered one day, lest ye always be chasing inconsistencies between platforms.
joshlang
on 20 Mar 2020
I did some noodling to fix this in #33874. The Linux/OpenSSL case works, macOS I am tinkering with. I think this is doable in macOS, but I have the world's slowest Mac which doesn't help that macOS's APIs around all of this makes little sense to me.
@bartonjs instead of broadly permitting ECParameters Q to allow a null point, how would you feel about making a more targeting fix just for the Pkcs8/ECPrivateKey import code paths to start? I'm not suggesting it one way or the other right now, but it might be easier and wondering if that's sensible.
vcsjones
on 20 Mar 2020
ImportParameters is abstract, so all custom types have to implement it. Doing magic in the PKCS8/ECPrivateKey layer means all custom types have to do the same "OK, I'll let this work" magic.
Sure, some types might end up needing to reject no-Q; but that seems easier for them to handle than intercepting the other import flows.
So... I'd rather not; but if it's complicatedly required, then I'll accept it.
bartonjs
on 20 Mar 2020
👍1
@bartonjs is this widespread enough impact that we should try to hurry it into preview 3? I see only one report above.
danmosemsft
on 24 Mar 2020
@bartonjs another thought if we want something soonish for Preview 3: I have it working in CNG and OpenSSL, still need to figure out MacOS (haven't ruled it out..). Would you take a PR that fixes CNG/OpenSSL and MacOS throws a PNSE, and a separate PR to get MacOS working, or prefer to try and get it in all in one go?
Trying to figure if I should focus on MacOS or getting what I have polished and fully tested.
vcsjones
on 27 Mar 2020
@vcsjones Let's go with "polish and PR". Maybe one of us, or a mysterious third party, will come up with something easy to slide in for macOS before it gets merged.
bartonjs
on 27 Mar 2020
👍1
@joshlang
This has been fixed. I don't believe the fixes made the cut for preview3, but I did confirm that your original repro works with the latest nightly on Linux.
I've run into this D but not Q limitation several times before, whether for this, or stuff like deriving bitcoin addresses from private keys, etc.
This limitation has been removed. An EC private key that does not contain Q but does contain D will now work, and Q will be re-derived by the platform as needed.
vcsjones
on 9 Apr 2020
@vcsjones Thanks! I saw the pull request close yesterday, with much excitement :D I kept refreshing nuget to see if preview3 was out.
Alas, I'll be patient and wait for the next one!
Thanks for taking care of this.
joshlang
on 9 Apr 2020
👍1
Was this page helpful?
0 / 5 - 0 ratings
Related issues
aggieben
路
3Comments
jzabroski
路
3Comments
yahorsi
路
3Comments
btecu
路
3Comments
noahfalk
路
3Comments
Most helpful comment
@vcsjones ... I feel the need to inform you that you are a genius. Just sayin'.