X509Store.Certificates on ARM64 OS does not return certificates on hardware keys

[sujitnayak]

Description

Customer is reporting an issue with ClickOnce publishing in VS. They have a code signing certificate from Sectigo on a hardware key.

On x64 VS 2022 .NET FX project (Console/Forms/WPF), Properties -> Sign -> Select Certificate from Store shows the new certificate and it can be selected for code signing.

On ARM64 VS 2022 .NET FX project, same steps don't show the Sectigo certificate.

I asked customer to run the following snippet in a console project on ARM64 and check if the certificate is displayed. Customer confirmed it did not.

            var personalStore = new X509Store(StoreName.My, StoreLocation.CurrentUser);
            personalStore.Open(OpenFlags.OpenExistingOnly);
            var certs = personalStore.Certificates;
            X509Certificate2UI.SelectFromCollection(certs, "Certificates", "Select", X509SelectionFlag.SingleSelection);

ClickOnce retrieves certificates that can be used for code signing with the above code and then filters the list for certs that have a private key and can be used for code signing.

More details in this f/b ticket:
https://developercommunity.visualstudio.com/t/Certificates-Store-in-Visual-Studio-Arm/10577088

Reproduction Steps

            var personalStore = new X509Store(StoreName.My, StoreLocation.CurrentUser);
            personalStore.Open(OpenFlags.OpenExistingOnly);
            var certs = personalStore.Certificates;
            X509Certificate2UI.SelectFromCollection(certs, "Certificates", "Select", X509SelectionFlag.SingleSelection);

Run above code in a .NET FX Console project on ARM64 OS with a certificate on a h/w key.

Expected behavior

The expectation is that ARM64 OS behaves identical to x64 VS when retrieving certicates from Personal Store.

Actual behavior

Certificates on hardware key are not displayed.

Regression?

No

Known Workarounds

None

Configuration

ARM64 VS 2022 on ARM64 Windows

Other information

No response

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Description

Customer is reporting an issue with ClickOnce publishing in VS. They have a code signing certificate from Sectigo on a hardware key.

On x64 VS 2022 .NET FX project (Console/Forms/WPF), Properties -> Sign -> Select Certificate from Store shows the new certificate and it can be selected for code signing.

On ARM64 VS 2022 .NET FX project, same steps don't show the Sectigo certificate.

I asked customer to run the following snippet in a console project on ARM64 and check if the certificate is displayed. Customer confirmed it did not.

            var personalStore = new X509Store(StoreName.My, StoreLocation.CurrentUser);
            personalStore.Open(OpenFlags.OpenExistingOnly);
            var certs = personalStore.Certificates;
            X509Certificate2UI.SelectFromCollection(certs, "Certificates", "Select", X509SelectionFlag.SingleSelection);

ClickOnce retrieves certificates that can be used for code signing with the above code and then filters the list for certs that have a private key and can be used for code signing.

More details in this f/b ticket:
https://developercommunity.visualstudio.com/t/Certificates-Store-in-Visual-Studio-Arm/10577088

Reproduction Steps

            var personalStore = new X509Store(StoreName.My, StoreLocation.CurrentUser);
            personalStore.Open(OpenFlags.OpenExistingOnly);
            var certs = personalStore.Certificates;
            X509Certificate2UI.SelectFromCollection(certs, "Certificates", "Select", X509SelectionFlag.SingleSelection);

Run above code in a .NET FX Console project on ARM64 OS with a certificate on a h/w key.

Expected behavior

The expectation is that ARM64 OS behaves identical to x64 VS when retrieving certicates from Personal Store.

Actual behavior

Certificates on hardware key are not displayed.

Regression?

No

Known Workarounds

None

Configuration

ARM64 VS 2022 on ARM64 Windows

Other information

No response

Author:	sujitnayak
Assignees:	-
Labels:	area-System.Security
Milestone:	-

[vcsjones]

This is likely an artifact of the eToken software not natively supporting ARM64. https://www.sectigo.com/knowledge-base/detail/SafeNet-Authentication-Client-Download-for-Sectigo-Certificates-on-eToken/kA03l000000o6kL

Their installers indicate they only support x86 32-bit and x86_64. Since their providers lack ARM64 support, CNG does not see the hardware token's certificates in an ARM64 process.

The customer should work with the CA and token vendor on ARM64 support.

X509Certificate2UI.SelectFromCollection

This is presented from the Windows OS itself, so the fact that Windows itself does not see the certificate indicates an issue with the token's software, not .NET.

[sujitnayak]

I am checking with the customer if they have the eToken software on the x64 box.
I agree that the underlying issue is likely outside of .NET.

If I understand correctly, are you saying that the issue is that the software (https://www.sectigo.com/knowledge-base/detail/SafeNet-Authentication-Client-Download-for-Sectigo-Certificates-on-eToken/kA03l000000o6kL) for the key is x64 instead of ARM?
....mmm... that's a problem because an Arm version unexists...
marc.

[sujitnayak]

@Epomops
Was the x64 SafeNet Authentication Client installed on the VS x64 box?

I'm not sure I understand what you mean by "VS x64 box". On my mac I use:
Window 11 Arm (via Parallels)
VS 2019 x64 [Certificate Visible]
VS 2022 Arm [Certificate Not Visible]
SafeNet x64.

[vcsjones]

On x64 VS 2022 .NET FX project

The question is, for the environment where the eToken works, the x64 environment, did you install any software to get the eToken working? If so, what was it?

In my test the eToken works:

1. In the Arm VM using VS 2019 (SafeNet Authentication Client Tools x64 installed)
2. In a x64 Surface using VS 2022 (SafeNet Authentication Client Tools x64 installed)

[sujitnayak]

@Epomops
Thanks for the clarification. I think you need to clarify the behavior with Sectigo. The question would be if an Arm64 flavour of SafeNet Authentication Client is required for the certificate to be visible in the Arm64 process that 'VS 2022 for Arm64' runs in.