Skip to content

Resolve data-protection certificate

Field Value
Operation ID OP-07
Trigger Called from Configure cookie authentication step 2
Inputs DPCertName
Outputs A certificate, null (developer machine), or an exception
Primary components DataProtectionCertService.GetCertificate
Entry point src/SAIF.NetCore.OIDC/src/SAIF.NetCore.OIDC/Services/DataProtectionCertService.cs

Steps

  1. Open X509Store(StoreLocation.LocalMachine) (default store name My) read-only (BR-OIDC-14).
  2. Select a certificate where Subject == DPCertName and NotBefore <= now < NotAfter (BR-OIDC-14) — DPCertName resolved via Resolve OIDC settings.
  3. If found → return it.
  4. If not found and not a developer machine (IsDeveloperMachine(), captured once in the constructor) → log Error and throw MissingDataProtectionCertificateException(DPCertName) (BR-OIDC-15).
  5. On failure: startup or first-request failure.
  6. If not found on a developer machine → return null (BR-OIDC-15).
  7. On branch: keys are unprotected.

Process flow

flowchart TD
    Start([GetCertificate called]) --> OpenStore["Open LocalMachine My store, read-only"]
    OpenStore --> Select["Select cert: Subject == DPCertName<br>and within validity window"]
    Select --> Found{Found?}
    Found -->|Yes| Return([Return certificate])
    Found -->|No| DevCheck{Developer machine?}
    DevCheck -->|No| Throw["Log Error; throw MissingDataProtectionCertificateException"]
    DevCheck -->|Yes| Null([Return null - unencrypted key ring])

Failure and edge-case behavior

  • A missing certificate is fatal on any non-developer machine, blocking cookie-options construction entirely.
  • The developer-machine flag is captured once in the constructor (singleton lifetime), so a misdetected flag persists for the process lifetime.
  • DPCertName must match the certificate Subject exactly; no partial or fuzzy matching is performed.

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

  • src/SAIF.NetCore.OIDC/src/SAIF.NetCore.OIDC/Services/DataProtectionCertService.cs