Best way to Store an X509Certificate2 object with it's privateKey into the CertStore - private-key

Question

I have generated a CSR, and had it signed. I still have the private key that I used to create the CSR, and I want to store that cert in the Windows CertStores, along with that private key.
My metric for success is:
When I view the cert in the CertStore, it is marked as having a private key. Specifically, it has the little 'key' sub-icon in the top left of the cert icon, and if you open the cert up, it says "You have a private key that corresponds to this certificate" under the ValidDates info.
We initially assumed that .CopyWithPrivateKey(RSA key) would do that for us, but it doesn't seem to work on it's own. We also need to set some keyStorage flags, but we can only do that by .Export()ing the cert to a byte[] array and then "importing" it with another constructor call.
I've tried a bunch of variations, and that's the only sequence of events that works:
public void InstallCertOnNonUiThread(byte[] certificateDataFromCsrResponse, RSA privateKeyUsedToGenerateCsr)
{
var keyStorageFlags = X509KeyStorageFlags.Exportable | X509KeyStorageFlags.PersistKeySet | X509KeyStorageFlags.MachineKeySet;
var originalCert = new X509Certificate2(certificateDataFromCsrResponse);
var exportOfOriginalCert = originalCert.Export(X509ContentType.Pkcs12);
var withFlagsCert = new X509Certificate2(certificateDataFromCsrResponse, (SecureString)null, keyStorageFlags);
var exportOfWithFlagsCert = withFlagsCert.Export(X509ContentType.Pkcs12);
var copiedWithPKCert = originalCert.CopyWithPrivateKey(privateKeyUsedToGenerateCsr);
var exportOfCopiedWithPkCert = copiedWithPKCert.Export(X509ContentType.Pkcs12);
var withFlagsReimportOfOriginal = new X509Certificate2(exportOfOriginalCert, (SecureString)null, keyStorageFlags);
var withFlagsReimportOfWithFlags = new X509Certificate2(exportOfWithFlagsCert, (SecureString)null, keyStorageFlags);
var withFlagsReimportOfCopiedWithPK = new X509Certificate2(exportOfCopiedWithPkCert, (SecureString)null, keyStorageFlags);
InstallCertInStore(StoreLocation.LocalMachine, originalCert); // Doesn't work; no key in Store UI.
InstallCertInStore(StoreLocation.LocalMachine, withFlagsCert); // Doesn't work; no key in Store UI.
InstallCertInStore(StoreLocation.LocalMachine, copiedWithPKCert); // Doesn't work; no key in Store UI.
InstallCertInStore(StoreLocation.LocalMachine, withFlagsReimportOfOriginal); // Doesn't work; no key in Store UI.
InstallCertInStore(StoreLocation.LocalMachine, withFlagsReimportOfWithFlags); // Doesn't work; no key in Store UI.
InstallCertInStore(StoreLocation.LocalMachine, withFlagsReimportOfCopiedWithPK);// This one works. Cert has key icon, and text "You have a private key that corresponds to this certificate"
}
private static void InstallCertInStore(StoreLocation location, X509Certificate2 newCert)
{
using (var store = new X509Store(StoreName.My, location))
{
store.Open(OpenFlags.ReadWrite);
store.Add(newCert);
}
}
So my final code to do this will look like:
public Task<bool> InstallCertOnNonUiThread(byte[] certificateDataFromCsrResponse, RSA privateKeyUsedToGenerateCsr, string orgId)
{
var keyStorageFlags = X509KeyStorageFlags.Exportable | X509KeyStorageFlags.PersistKeySet | X509KeyStorageFlags.MachineKeySet;
var originalCert = new X509Certificate2(certificateDataFromCsrResponse);
var copiedWithPKCert = originalCert.CopyWithPrivateKey(privateKeyUsedToGenerateCsr);
var exportOfCopiedWithPkCert = copiedWithPKCert.Export(X509ContentType.Pkcs12);
var withFlagsReimportOfCopiedWithPK = new X509Certificate2(exportOfCopiedWithPkCert, (SecureString)null, keyStorageFlags);
InstallCertInStore(StoreLocation.LocalMachine, withFlagsReimportOfCopiedWithPK);// This one works. Cert has key icon, and text "You have a private key that corresponds to this certificate"
return Task.FromResult(true);
}
That final option does work, but it seems like way more steps than ought to be necessary, and it suggests that I'm about to define my own extention method: .ActuallyCopyWithPrivateKey, to replace the .NET framework version of that method. Which seems wrong.
Is there a better way to be achieving this, or does it really need all 4 steps.

Answer 1

CopyWithPrivateKey maintains the state of the private key. If it's an ephemeral key, it stays ephemeral. If it's a persisted key, it stays persisted. When you created the RSA privateKeyUsedToGenerateCsr object you created an ephemeral key object, and so you got the behavior you see.
Your 4-liner is correct (except you really want each of the cert objects in a using statement).
Hydrate the newly signed certificate into an X509Certificate2 object
CopyWithPrivateKey makes a new X509Certificate2 object with the private key bound (could be persisted, could be ephemeral).
Exporting as a PFX can fail if the key is persisted and non-exportable. It's up to you if you want to guard against this, or not. Otherwise, this creates the possibility of reimporting the key to a persisted key more easily.
Reimporting the PFX with PersistKeySet makes a new copy of the private key (if it was already persisted, or "the first copy" if it was ephemeral), and makes it so the key isn't erased when the cert object gets garbage collected or disposed.
On the other hand, you could create the key as a persisted key and just need to use CopyWithPrivateKey once. Of course, this notion only exists on Windows.
Creating a persisted CNG key
Assuming you created the key as new RSACng(2048) or RSA.Create(2048), you can make a persisted key by
CngKeyCreationParameters keyParameters = new CngKeyCreationParameters
{
// Or whatever.
ExportPolicy = CngExportPolicies.None,
// If applicable.
KeyCreationOptions = CngKeyCreationOptions.MachineKey,
Parameters =
{
new CngProperty("Key Length", BitConverter.GetBytes(2048), CngPropertyOptions.Persist),
},
};
using (CngKey key = CngKey.Create(CngAlgorithm.Rsa, Guid.NewGuid().ToString(), keyParameters))
{
return new RSACng(key);
}
Creating a persisted CAPI key
Ideally, don't. Create a persisted CNG instead. But, if you must:
Assuming you created the key as new RSACryptoServiceProvider(2048), you can make a persisted CAPI key by
CspParameters cspParams = new CspParameters
{
KeyContainerName = Guid.NewGuid().ToString(),
Flags =
// If appropriate
CspProviderFlags.UseMachineKeyStore |
// If desired
CspProviderFlags.UseNonExportableKey
};
return new RSACryptoServiceProvider(2048, cspParams);