Is there a method in .Net to import a PFX file along with the certificate chain to a certificate store?
Though not directly related to distributed services but I see this information useful, especially for developers doing certificate related operations in their code (which might be a WCF application).
The answer is NO. There’s no way to open a full cert chain in the .Net framework without a P/Invoke to the PFXImportCertStore() API. X509Certificate2 will only open the leaf certificate form the PFX.
The code to do a P/Invoke to PFXImportCertStore() for importing a certificate along with its chain to a user’s personal certificate store (“MY” store) is as shown below:
using System; using System.IO; using System.Runtime.InteropServices; public class Crypto { #region CONSTS
// #define CERT_STORE_ADD_REPLACE_EXISTING 3 public const Int32 CERT_STORE_ADD_REPLACE_EXISTING = 3;
// #define CERT_STORE_PROV_SYSTEM ((LPCSTR) 10) public const Int32 CERT_STORE_PROV_SYSTEM = 10;
// #define CERT_SYSTEM_STORE_CURRENT_USER_ID 1 public const Int32 CERT_SYSTEM_STORE_CURRENT_USER_ID = 1;
// #define CERT_SYSTEM_STORE_LOCATION_SHIFT 16 public const Int32 CERT_SYSTEM_STORE_LOCATION_SHIFT = 16;
// #define CERT_SYSTEM_STORE_CURRENT_USER \ // (CERT_SYSTEM_STORE_CURRENT_USER_ID << CERT_SYSTEM_STORE_LOCATION_SHIFT) public const Int32 CERT_SYSTEM_STORE_CURRENT_USER = CERT_SYSTEM_STORE_CURRENT_USER_ID << CERT_SYSTEM_STORE_LOCATION_SHIFT;
#endregion
#region STRUCTS
// typedef struct _CRYPTOAPI_BLOB // { // DWORD cbData; // BYTE *pbData; // } CRYPT_HASH_BLOB, CRYPT_INTEGER_BLOB, // CRYPT_OBJID_BLOB, CERT_NAME_BLOB; [StructLayout(LayoutKind.Sequential)] public struct CRYPT_DATA_BLOB { public int cbData; public IntPtr pbData; }
// typedef struct _CERT_CONTEXT { // DWORD dwCertEncodingType; // BYTE *pbCertEncoded; // DWORD cbCertEncoded; // PCERT_INFO pCertInfo; // HCERTSTORE hCertStore; //} *PCERT_CONTEXT; [StructLayout(LayoutKind.Sequential)] public struct CERT_CONTEXT { public uint dwCertEncodingType; [MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 2)] public byte[] pbCertEncoded; public uint cbCertEncoded; public IntPtr pCertInfo; public IntPtr hCertStore; }
#endregion
#region FUNCTIONS (IMPORTS)
[DllImport("Crypt32.dll", CharSet = CharSet.Auto, SetLastError = true)] public static extern IntPtr CertOpenStore( int storeProvider, uint dwMsgAndCertEncodingType, IntPtr hCryptProv, uint dwFlags, String cchNameString);
[DllImport("Crypt32.dll", SetLastError = true)] public static extern IntPtr PFXImportCertStore( ref CRYPT_DATA_BLOB pPfx, [MarshalAs(UnmanagedType.LPWStr)] String szPassword, uint dwFlags);
[DllImport("Crypt32.dll", SetLastError = true)] public static extern Boolean CertAddCertificateContextToStore( IntPtr hCertStore, IntPtr pCertContext, Int32 dwAddDisposition, ref IntPtr ppStoreContext );
[DllImport("Crypt32.DLL", SetLastError = true)] public static extern IntPtr CertEnumCertificatesInStore( IntPtr storeProvider, IntPtr prevCertContext );
[DllImport("Crypt32.dll", SetLastError = true)] public static extern Boolean CertCloseStore( IntPtr hCertStore, Int32 dwFlags );
#endregion }
namespace ImportCert { class Program { //Reads a file. internal static byte[] ReadFile(string fileName) { FileStream f = new FileStream(fileName, FileMode.Open, FileAccess.Read); int size = (int)f.Length; byte[] data = new byte[size]; size = f.Read(data, 0, size); f.Close(); return data; }
static void Main(string[] args) { //Test for correct number of arguments. if (args.Length < 2) { Console.WriteLine("Usage: ImportCert <PFX filename> password"); return; }
try { IntPtr hCryptProv = IntPtr.Zero; IntPtr hCertStore = Crypto.CertOpenStore(Crypto.CERT_STORE_PROV_SYSTEM, 0, hCryptProv, Crypto.CERT_SYSTEM_STORE_CURRENT_USER, "MY");
if (hCertStore != IntPtr.Zero) { byte[] rawData = ReadFile(args[0]);
Crypto.CRYPT_DATA_BLOB ppfx = new Crypto.CRYPT_DATA_BLOB(); ppfx.cbData = rawData.Length; ppfx.pbData = Marshal.AllocHGlobal(rawData.Length); Marshal.Copy(rawData, 0, ppfx.pbData, rawData.Length);
IntPtr hMemStore = Crypto.PFXImportCertStore(ref ppfx, args[1], 0);
if (hMemStore != IntPtr.Zero) { IntPtr pctx = IntPtr.Zero; IntPtr pStoreContext = IntPtr.Zero;
while (IntPtr.Zero != (pctx = Crypto.CertEnumCertificatesInStore(hMemStore, pctx))) { Crypto.CertAddCertificateContextToStore(hCertStore, pctx, Crypto.CERT_STORE_ADD_REPLACE_EXISTING, ref pStoreContext); }
Crypto.CertCloseStore(hMemStore, 0); } Crypto.CertCloseStore(hCertStore, 0); } } catch (Exception e) { Console.WriteLine(e.Message); } } } } |
Reference:
msdn.microsoft.com/en-us/library/aa387314(v=vs.85).aspx
Shamik Misra
Escalation Services, Microsoft Developer Support
- Anonymous
February 05, 2012
Same can be verified through WCF config setting, isnt it?