How can I get the "purpose" (Client Authentication Certificate) of a certificate in .NET?

Question

I want to find all client authentication certificates from the X509Store(StoreLocation.CurrentUser)

Is there anyway to do this? Even by getting all then filtering by a certain property to get all Client Authentication certificates?

Answer 1

You'd need to examine the Extensions of each certificate. So far as I can see, once you've got to the Key Usage extension, you should have all the info you need.

Edit Actually, for client authentication, you probably need the Enhanced Key Usage extension. I don't have a client authentication certificate lying around to test this with, but the following prints "Server Authentication" for a server certificate I've got:

        var cert1 = new X509Certificate2(/* Path to certificate */);
        foreach (var ext in cert1.Extensions)
        {
            var eku = ext as X509EnhancedKeyUsageExtension;
            if (eku != null)
            {
                foreach (var oid in eku.EnhancedKeyUsages)
                {
                    Console.WriteLine(oid.FriendlyName);
                }
            }
        }

Answer 2

There are extensions that help identifying what can be used as client-certificate:

• The Extended Key Usage extension, which will be id-kp-clientAuth if present.
• The "legacy" Netscape Cert Type extension (not strictly standard, but widely adopted, even outside the world of Netscape/Mozilla tools).

Certificates without these extensions at all could also be used as client-certificate, provided it's compatible with the (non-extended) Key Usage extension (if present). What you need at least in the (non-extended) Key Usage extension is digitalSignature for a client-certificate. It's not really clear what happens if you get both the Netscape Cert Type and the Extended Key Usage extensions, although, in the spirit of RFC 5280, it would be worth considering usage for purposes compatible with all the extensions present:

If a certificate contains both a key usage extension and an extended key usage extension, then both extensions MUST be processed independently and the certificate MUST only be used for a purpose consistent with both extensions. If there is no purpose consistent with both extensions, then the certificate MUST NOT be used for any purpose.

The NSS Technical Note 3 (All About Certificate Extensions) should be of interest.