SslStream not working with ephemeral keys

[rmannibucau]

Description

Same issue than #103101

Reproduction Steps

See #103101

Expected behavior

It just works since code is there (new X509Certificate2(current.Export(X509ContentType.Pkcs12)) makes it working)

Actual behavior

It fails as in Same issue than #103101

Regression?

I do not know

Known Workarounds

Using new X509Certificate2(current.Export(X509ContentType.Pkcs12)) but it relies on obsolete code which is undesired

Configuration

No response

Other information

No response

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[vcsjones]

As discussed in the linked issue #103101, this ephemeral key restriction comes from Windows, not .NET.

Using new X509Certificate2(current.Export(X509ContentType.Pkcs12)) but it relies on obsolete code which is undesired

The obsoletion message should direct you towards using the non-obsolete API. It should look something like this:

X509CertificateLoader.LoadPkcs12(current.Export(X509ContentType.Pkcs12), null);

[rmannibucau]

@vcsjones

The obsoletion message should direct you towards ...

Thanks, will check that!

As discussed in the linked issue #103101, this ephemeral key restriction comes from Windows, not .NET.

I get it but there are two issues in .NET there:

• if it can work it should be tried to cover more - for example when this exeption is thrown from a ssl handshake the conversion is worth a try as a fallback if you do not want to parse the cert upfront to try to do it upfront (which can be justified)
• it is unlikely the X509Certificate2.CreateFromPem* doesn't throw any exception but it fails at handshake time (http client) if it is really not supported

Indeed I'd prefer to fix it with the fallback mode since it would make it more widely adopted. For example this case happens with minikube.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[rzikm]

There might be a way to make this work in more recent Windows versions, but it will require some investigation. I will see if we can do something in .NET 10