GetRSAPrivateKey fails to retrieve ephemeral key that is persisted.

[Harmyder]

Description

Agent tries to get a certificate that is installed by Server over MDM. After Agent has been retargeted to .NET Core it is unable to read certificate created by .NET Framework version of Server.

Reproduction Steps

I'm unable to provide repro steps because certificate is installed by Windows MDM.

Expected behavior

.NET Core version of Agent should be able to retrieve the private key even if it is both persisted and ephemeral.

Actual behavior

Retargeted Agent it is unable to get certificate created by .NET Framework version of Server with the following error:

The CNG key handle being opened was detected to be ephemeral, but the EphemeralKey open option was not specified.

In CertificatePal.TryAcquireCngPrivateKey value of certificateContext.HasPersistedPrivateKey is true. So it doesn't update handleOptions with CngKeyHandleOpenOptions.EphemeralKey and later from OpenNoDuplicate I get aforementioned error.

There is no check for certificateContext.HasPersistedPrivateKey in .NET Framework version that is why it works.

Regression?

No response

Known Workarounds

No response

Configuration

No response

Other information

My SO question about this

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[bartonjs]

There shouldn't ever be a persisted key that is marked as .NET Ephemeral. If you have a stable repro of that, it's something we should fix.

If you can access the key as a CngKey on .NET Framework, you should be able to do

CngKey key = ...;
key.SetProperty(new CngProperty("CLR IsEphemeral", null, CngKeyPropertyOptions.Persist | CngKeyPropertyOptions.CustomProperty));

to erase the corrupt property.

[Harmyder]

@bartonjs thanks, it helped to resolve the issue for me.

Funny thing, if after this fix I run .Export(X509ContentType.Pfx) from net48 then the problem is back again and I need to reapply the fix.

I can't provide full code for repro because it happens only when the certificate gets installed via Windows MDM.