8

Is there any way to convert a Org.BouncyCastle.X509.X509Certificate to System.Security.Cryptography.X509Certificates.X509Certificate2?

The inverse operation is easy, combining Org.BouncyCastle.X509.X509CertificateParser with System.Security.Cryptography.X509Certificates.X509Certificate2.Export().

kaptux
  • 413
  • 1
  • 4
  • 12

3 Answers3

13

Easy!!

using B = Org.BouncyCastle.X509; //Bouncy certificates
using W = System.Security.Cryptography.X509Certificates;

W.X509Certificate2 certificate = new W.X509Certificate2(pdfCertificate.GetEncoded());

And now I can validate certificate chain in the server:

W.X509Chain ch = new W.X509Chain();
ch.ChainPolicy.RevocationMode = W.X509RevocationMode.NoCheck;
if (!ch.Build(certificate))
   res |= ErroresValidacion.CAInvalida;

Useful to validate pdf certifcates extracted with iTextSharp.

kaptux
  • 413
  • 1
  • 4
  • 12
2

From https://github.com/dotnet/corefx/wiki/ApiCompat :

Most users of X509Certificate and X509Certificate2 objects assume that the object is immutable except for the Reset()/Dispose() methods, the use of Import violates this assumption.

In other words, trying to use import throws an exception in .net core. You should now use:

new X509Certificate(cert.GetEncoded());

but, according to the .net API analyzer (https://learn.microsoft.com/en-us/dotnet/standard/analyzers/api-analyzer),

warning PC001: X509Certificate2.X509Certificate2(byte[]) isn't supported on macOS

cube45
  • 3,429
  • 2
  • 24
  • 35
-2

I guess that is the best answer:

var cert = pdf.Certificates[0];//Org.BouncyCastle.X509.X509Certificate
        var cert50 = new X509Certificate();
        cert50.Import(cert.GetEncoded());
Igor Monteiro
  • 933
  • 1
  • 11
  • 29
  • This is weird... the OP asked for a way to convert *"to an X509Certificate2"* but you convert to a *"X509Certificate"*. And correcting that, all that remains is something already said in the accepted answer by kaptux. – mkl Jan 27 '17 at 13:50
  • This does not answer the question, as it converts to a `X509Certificate`, not an `X509Certificate2` object. It also adds no *new* logic compared to the accepted answer. – Kevin Nov 21 '19 at 14:58