The requested operation is not supported in CngKey.Create

Question

I am trying to create a self-signed certificate on the fly (programmatically) in a C # assembly (targeting .NET 4.0) to serve as the root CA for creating other certificates. The certificate should not be stored in the Windows certificate store, I export it as a file.

After reading this question (and, in particular, @dthorpe answer ), I decided to give a try CLR Security .

The library CLR Securityhosted the extension method of the CngKey class to create a self-signed certificate, but I could not succeed by creating an instance CngKeywith:

var key = CngKey.Create(CngAlgorithm.Sha1); //same with Sha256, Sha512 and MD5
//or
var key = CngKey.Create(CngAlgorithm.Sha1, null, new CngKeyCreationParameters()
{
    ExportPolicy = CngExportPolicies.AllowExport,
    KeyUsage = CngKeyUsages.AllUsages,
    KeyCreationOptions = CngKeyCreationOptions.MachineKey,
});

Any of these lines throw an exception:

System.Security.Cryptography.CryptographicException
HResult = -2146893783
= .

Source=System.Core  
StackTrace:  
  at System.Security.Cryptography.NCryptNative.CreatePersistedKey(SafeNCryptProviderHandle provider, String algorithm, String name, CngKeyCreationOptions options)  
  at System.Security.Cryptography.CngKey.Create(CngAlgorithm algorithm,  String keyName, CngKeyCreationParameters creationParameters)  
  at System.Security.Cryptography.CngKey.Create(CngAlgorithm algorithm)  
  at Tests.Program.Main(String[] args) at Program.cs:line 51

SO , :

• Windows 7 ( RPC MSDN)
• Windows Server 2012,
• admin ( , )
• CNG Key Isolation Remote Procedure Call (RPC)

.

Answer 1

: Google HRESULT SO MSDN ( googled HRESULT -2146893783)

---

MSDN, HRESULT, MSDN :

NCRYPT_ALGORITHM_GROUP_PROPERTYL " "
Unicode , . . Microsoft:

• NCRYPT_RSA_ALGORITHM_GROUP
  "RSA", RSA.
• NCRYPT_DH_ALGORITHM_GROUP
  "DH", Diffie-Hellman.
• NCRYPT_DSA_ALGORITHM_GROUP
  "DSA", DSA.
• NCRYPT_ECDSA_ALGORITHM_GROUP
  "ECDSA", elliptic curve DSA.
• NCRYPT_ECDH_ALGORITHM_GROUP
  "ECDH", elliptic curve Diffie-Hellman.

MSDN CNG Key Storage Providers, :

• - (DH)
  , 512 to 4096 in 64-bit increments
• (DSA) , 512 to 1024 in 64-bit increments
• - (ECDH) , P256, P384, P521
• (ECDSA) , P256, P384, P521
• RSA , 512 to 16384 in 64-bit increments

, , Sha1, Sha256, Sha512 MD5, , ? :

• RSA
• ECDSA
  • P256
  • P384
  • P521
• ECDiffieHellman
  • P256
  • P384
  • P521

:

var cngKey = CngKey.Create(CngAlgorithm.ECDiffieHellmanP256, null,
    new CngKeyCreationParameters { ExportPolicy = CngExportPolicies.AllowPlaintextExport });