ArgumentNullException when calling RSACertificateExtensions.GetRSAPrivateKey

beho commented 8 years ago

Hi,

after migrating project to .NET Core 1.0.0 I had to change

RSACryptoServiceProvider cryptoProvider = (RSACryptoServiceProvider)_qzOptions.Certificate.PrivateKey;

to

RSA cryptoProvider = _qzOptions.Certificate.GetRSAPrivateKey();

Unfortunately this call throws following exception:

{System.ArgumentNullException: Value cannot be null.
Parameter name: source
   at System.Runtime.InteropServices.Marshal.CopyToManaged(IntPtr source, Object destination, Int32 startIndex, Int32 length)
   at Internal.Cryptography.Pal.Native.CRYPTOAPI_BLOB.ToByteArray()
   at Internal.Cryptography.Pal.CertificatePal.get_KeyAlgorithmParameters()
   at System.Security.Cryptography.X509Certificates.X509Certificate.GetKeyAlgorithmParameters()
   at System.Security.Cryptography.X509Certificates.X509Certificate2.get_PublicKey()
   at Internal.Cryptography.Pal.CertificateExtensionsCommon.GetPrivateKey[T](X509Certificate2 certificate, Predicate`1 matchesConstraints)
   at System.Security.Cryptography.X509Certificates.RSACertificateExtensions.GetRSAPrivateKey(X509Certificate2 certificate)}

This code is for signing requests for printing using QZ Tray (https://qz.io/wiki/2.0-signing-messages). C# example on which my code is based is provided at https://github.com/qzind/tray/blob/2.0/assets/signing/sign-message.cs.

Thanks!

bartonjs commented 8 years ago

@beho That's really weird. I don't suppose you know how your certificate was generated?

It'd be great if we could get a copy of the public portion (assuming that cert.GetKeyAlgorithmParameters() on the public portion also throws) so that we can debug here and see what's going on.

beho commented 8 years ago

The process is described here – https://qz.io/wiki/generate-certificate. It claims that the certificate is generated in browser so I assume Web Cryptography API. Then I had to create pfx by running openssl pkcs12 -export -inkey private-key.pem -in digital-certificate.txt -out private-key.pfx as described in QZ's C# example (https://github.com/qzind/tray/blob/2.0/assets/signing/sign-message.cs).

Yes, call to GetKeyAlgorithmParameters() also fails. Public key as generated by their in-browser process is:

bartonjs commented 8 years ago

Hm. That Public Key block looks normal to me. I don't suppose you have the full certificate? (-----BEGIN CERTIFICATE-----).

@AtsushiKan can you take a look at this one? I'm sure we can guard it with a defensive nullcheck somewhere; but I'd sort of like to understand what's happening. (Of course, it's also non-intuitive that we're calling get_PublicKey in GetPrivateKey, but I'm sure we have a reason)

beho commented 8 years ago

I'm not sure if that is what you mean but these are the contents of the digital-certificate.txt that was used in conjuction with private key to create pfx.

ghost commented 8 years ago

Most other places we convert CRYPTAPI_BLOB’s (PKCS, desktop X509), we make a special case check if cbData==0 and return an empty array without dereferencing pbData. (Windows likely sets this NULL for empty blob.)

Looks like this one should do the same.

From: Jeremy Barton [mailto:notifications@github.com] Sent: Saturday, July 2, 2016 3:39 PM To: dotnet/corefx corefx@noreply.github.com Cc: Atsushi Kanamori atsushik@microsoft.com; Mention mention@noreply.github.com Subject: Re: [dotnet/corefx] ArgumentNullException when calling RSACertificateExtensions.GetRSAPrivateKey (#9792)

Hm. That Public Key block looks normal to me. I don't suppose you have the full certificate? (-----BEGIN CERTIFICATE-----).

@AtsushiKanhttps://github.com/AtsushiKan can you take a look at this one? I'm sure we can guard it with a defensive nullcheck somewhere; but I'd sort of like to understand what's happening. (Of course, it's also non-intuitive that we're calling get_PublicKey in GetPrivateKey, but I'm sure we have a reason)

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHubhttps://github.com/dotnet/corefx/issues/9792#issuecomment-230125403, or mute the threadhttps://github.com/notifications/unsubscribe/AMnGmisEF1SpWsRgYnidtsrdAnWKcVTkks5qRuiggaJpZM4JDEi4.

beho commented 8 years ago

Is there some workaround I could use until this is fixed ?

bartonjs commented 8 years ago

@beho Sorry for the delay. I have this working locally now with your provided certificate. The CA, when encoding the certificate, has omitted the Algorithm.Parameters values (every other cert I've seen encodes them as NULL (05 00) instead of omitting them).

Is it okay to use the certificate you provided here as a test case, or would you prefer that I generate a new one?

beho commented 8 years ago

It does not contain private key so I have no problem with it being used for tests.

dotnet / runtime

ArgumentNullException when calling RSACertificateExtensions.GetRSAPrivateKey #17747