Question

I’m trying to enumerate certificates from Azure within a web role (running on the v1.3 Azure SDK Dev Fabric) but no certificates are returned when I use the following code. It’s important to note, however, that code works fine when run from a console program:

private static void EnumCerts()
{
    var selectedCerts = new X509Certificate2Collection();

    var store = new X509Store(
        StoreName.My, StoreLocation.CurrentUser);

    try
    {
        store.Open(OpenFlags.OpenExistingOnly | OpenFlags.ReadOnly);

        foreach (X509Certificate2 cert in store.Certificates)
            Console.WriteLine(cert.Subject);
    }
    finally
    {
        store.Close();
    }
}

My working assumption is that this is due to a security issue. My web role is running with Elevated Trust but I’m guessing that the IIS web instances are not.

In either case I have no idea how to solve the problem, so any help would be greatly appreciated…

Answer 1

I ended up solving the problem by embedding the certificate in my service code then reading it from the resource:

using System.IO;
using System.Reflection;
using System.Security.Cryptography.X509Certificates;

namespace AcsTest.Shared
{
    public static class CertHelper
    {
        public static X509Certificate2 GetCertFromManifest(
            Assembly assembly, string certName, string password)
        {
            byte[] bytes;

            using (var stream = assembly.
                GetManifestResourceStream(certName))
            {
                bytes = new BinaryReader(stream).
                    ReadBytes((int)stream.Length);
            }

            return new X509Certificate2(bytes, password,
                X509KeyStorageFlags.MachineKeySet);
        }
    }
}

The key insight was that I’d need to store a password in my service to load the cert from the certificate store so I was gaining no security advantage by keeping it in the store.