如何检查 X509Certificate2 是否可导出

Question

var store = new X509Store(StoreName.My, StoreLocation.CurrentUser);
store.Open(OpenFlags.ReadOnly);

var certificates = store.Certificates.Find(
    X509FindType.FindByThumbprint, thumbprint, false);

X509Certificate2 cert = certificates[0];

Now we have X509Certificate2 instance. How to check exportable private key or not? (preferably without trying to export explicitly)

Answer 1

Another approach I found here: How to determine whether an X509Certificate2 is exportable

X509Certificate2.PrivateKey Gets the AsymmetricAlgorithm object that represents the private key associated with a certificate.

The RSACryptoServiceProvider class is a AsymmetricAlgorithm

Then get the RSACryptoServiceProvider.CspKeyContainerInfo which is a CspKeyContainerInfo object that has a Exportable property that: Gets a value indicating whether a key can be exported from a key container.

Update: works. So, if you use RSA certificates, it is acceptable approach.

Answer 2

Looking at the reference source , the implementation of the Export method makes the following checks:

• That the X509ContentType parameter is Cert , SerializedCert or Pfx .
• When the content type is Pfx it makes a key container permission demand for both Export and Open permissions.

Beyond this, everything else happens via internal calls to the CLR, so it's much harder to say what demands are made of the caller. I can't observe a check in the source which tests for the exportable flag.

This is a scenario where I would suggest you attempt to perform the export and handle any exceptions as feedback; you cannot reasonably predict the outcome of the call with the information exposed by the certificate.

Answer 3

Use this method:

public static bool CheckCertificateIsExportable(X509Certificate2 certForCheck, X509ContentType certType)
    {
        try
        {
            certForCheck.Export(certType);
            return true;
        }
        catch
        {
            return false;
        }
    }

How to use:

if (CheckCertificateIsExportable(certForCheck, X509ContentType.Pkcs12))
        {
            // Do...
        }