The specified network password exception in the X509Certificate2 constructor is fixed

Question

I have a console application that downloads an X509 certificate from an array of bytes as follows:

var cert = new X509Certificate2(certificateContent, // byte[] password, // string X509KeyStorageFlags.PersistKeySet); 

certificateContent is a byte[] representing the contents of a pfx file. This code is great for the few certificates I tested. However, there is one certificate that I am testing that causes this string to throw a CryptographicException with the message "The specified network password is invalid." Although the password provided is correct.

The weird part is that I can use the same code in LinqPad to create a certificate from the same pfx file with the same password, and it works fine.

I checked the call site in the console application in the debugger and verified that the correct values ​​were being transmitted.

What can cause this constructor to throw this exception in a console application, but not in LinqPad, using the same data, and work fine in both places for other certificates?

More details

Certificates are stored in a database in Base64. The Console application reads the certificate from the database, converts it from Base64 to byte [], and then tries to create the X509Certificate2 object, as described above.

There are three certificates that I tested:

• My personal customer authentication certificate provided by my employer CA.
• Test certificate created by a colleague using their own self-employed CA.
• My own test certificate created by me using a self-signed CA.

Certificates 1 and 2 work both in the console application and in LinqPad.

Certificate 3 loads fine in LinqPad, but generates the error above if I try to use it in a console application.

There are two significant differences between certificates 2 and 3.

• Cert2 expires in 2016, and Cert3 expires in 2039.
• The private key associated with cert2 is 2048 bits. Cert3 - 1024 bits.

Can one of these differences lead to the error "the specified network password is incorrect"? And why all 3 certs work fine in LinqPad, but only 1 throws an error in the Console application?

Answer 1

Hope this helps someone:

User "SC" specifies the following requirement for certificate passwords in Windows XP and Windows Server 2003.

 0 < password.Length < 32 

I saw conflicting messages about whether 32 is allowed. I can confirm that I used a 32-character password (MD5 hash) and truncating it to 30 characters fixed the problem.

Answer 2

According to uGeeen's answer here, certificates created on Windows Server 2003 or Windows XP must have a password, otherwise they will throw this exception.

Answer 3

 Public Function sign(keystore As String, level As Integer, src As String, name As String,dest As String, sig As String, pass As String) 'Dim store As System.Security.Cryptography.X509Certificates.X509Store = New System.Security.Cryptography.X509Certificates.X509Store 'store.Open(System.Security.Cryptography.X509Certificates.OpenFlags.ReadOnly) 'Dim sel As System.Security.Cryptography.X509Certificates.X509Certificate2Collection ' If sig <> "" And pass <> "" Then Try Dim y As Int16 = 200 ' For i As Integer = 0 To sel.Count - 1 Dim pdfReader As PdfReader = New PdfReader(src) Dim signedPdf = New FileStream(dest, FileMode.Create) Try Dim cert As X509Certificate2 = New X509Certificate2(sig, pass) Dim cp As Org.BouncyCastle.X509.X509CertificateParser = New Org.BouncyCastle.X509.X509CertificateParser() Dim chain As Org.BouncyCastle.X509.X509Certificate() = New Org.BouncyCastle.X509.X509Certificate() {cp.ReadCertificate(cert.RawData)} Dim stamper As PdfStamper stamper = PdfStamper.CreateSignature(pdfReader, signedPdf, "0"c, Nothing, True) Dim signatureAppearance As PdfSignatureAppearance = stamper.SignatureAppearance 'signatureAppearance.SignatureGraphic = Image.GetInstance(pathToSignatureImage) signatureAppearance.SetVisibleSignature(name) signatureAppearance.CertificationLevel = level Dim externalSignature As IExternalSignature = New X509Certificate2Signature(cert, "SHA-1") ' Dim digest As IExternalSignature = New BouncyCastleDigest ' signatureAppearance.s 'signatureAppearance.SetVisibleSignature(New Rectangle(50,50,50, signatureAppearance.SignatureRenderingMode = PdfSignatureAppearance.RenderingMode.NAME_AND_DESCRIPTION MakeSignature.SignDetached(signatureAppearance, externalSignature, chain, Nothing, Nothing, Nothing, 0, CryptoStandard.CADES) ' MakeSignature. Catch ex As Exception MsgBox("Signature File Password is not correct for the user Id :" & error_userid) 'Exit Function End Try Catch ex As Exception 'MsgBox(ex.Message) End Try ' End If Return 0 End Function