Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

ServiceAccountCredential fails for non-exportable CryptoAPI key

See original GitHub issue

Create a certificate with a non-exportable CryptoAPI key

New-SelfSignedCertificate `
  -KeyUsage DigitalSignature `
  -FriendlyName "Sample CryptoAPI service account key" `
  -Subject "Sample CryptoAPI service account key" `
  -KeyExportPolicy NonExportable `
  -CertStoreLocation "cert:\CurrentUser\My" `
  -Provider "Microsoft Base Cryptographic Provider v1.0" `
  -KeySpec Signature

Use they to initialize a ServiceAccountCredential:

  using (var store = new X509Store(StoreName.My, StoreLocation.CurrentUser))
  {
    store.Open(OpenFlags.ReadOnly);

    using (var certificate = store.Certificates
        .Cast<X509Certificate2>()
        .Where(c => c.FriendlyName == "Sample CryptoAPI service account key")
        .FirstOrDefault() 
      ?? throw new Exception("Certificate not found"))
    {
      //
      // Initialize a ServiceAccountCredential with the certificate.
      //
      var credential = new ServiceAccountCredential(
        new ServiceAccountCredential.Initializer(emailAddress)
        {
          Scopes = new[] { "https://www.googleapis.com/auth/cloud-platform" }
        }
        .FromCertificate(certificate));

    }
  }

Run the code on .NET Core --> works
Run the code on .NET Framework

Expected: Works too

Actual:

Unhandled Exception: System.Security.Cryptography.CryptographicException: Key not valid for use in specified state.

   at System.Security.Cryptography.CryptographicException.ThrowCryptographicException(Int32 hr)
   at System.Security.Cryptography.Utils.ExportCspBlob(SafeKeyHandle hKey, Int32 blobType, ObjectHandleOnStack retBlob)
   at System.Security.Cryptography.Utils.ExportCspBlobHelper(Boolean includePrivateParameters, CspParameters parameters, SafeKeyHandle safeKeyHandle)
   at Google.Apis.Auth.OAuth2.ServiceAccountCredential.Initializer.FromCertificate(X509Certificate2 certificate) in C:\Apiary\2021-03-18.17-02-24\Src\Support\Google.Apis.Auth\OAuth2\ServiceAccountCredential.cs:line 128
   at CryptoApiNetFx.Program.Main(String[] args) in C:\...\Program.cs:line 33

For some reason, FromCertificate tries to export and re-import the key on .NET Framework. It’s marked as a workaround, but I am not sure for what.