Repository navigation
Resize PFX export buffer after export as appropriate - #136365
Merged
Merged
Conversation
|
Azure Pipelines: Successfully started running 3 pipeline(s). 13 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
|
Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security |
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The targeted length correction addresses the reported defect, with regression coverage and only optional spelling cleanup remaining.
1 open issue
What changed in this PR
Fixes Windows PKCS#12 exports returning trailing bytes by using the final native export length, addressing interoperability failures described in #136316.
Changes:
- Resize returned PFX buffers to the actual exported length.
- Pass only the exported bytes to the re-encryption helper.
- Add single-certificate and collection regression tests with a shared legacy RSA fixture.
Review was source-only; no builds or tests were run.
| File | Description |
|---|---|
| src/libraries/System.Security.Cryptography/tests/X509Certificates/ExportTests.cs | Adds a legacy Windows single-certificate export regression test. |
| src/libraries/System.Security.Cryptography/tests/X509Certificates/CollectionTests.cs | Adds corresponding collection export coverage. |
| src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/X509Certificates/StorePal.Windows.Export.cs | Uses the final native length for returned and re-encrypted PFX data. |
| src/libraries/Common/tests/System/Security/Cryptography/X509Certificates/TestData.cs | Adds the certificate and CSP key fixture for the regression tests. |
Review effort: Balanced
bartonjs
reviewed
Oct 23, 2026
bartonjs
reviewed
Oct 23, 2026
bartonjs
reviewed
Oct 23, 2026
bartonjs
approved these changes
Oct 23, 2026
bartonjs
approved these changes
Oct 23, 2026
vcsjones
enabled auto-merge (squash)
October 23, 2026 19:17
Member
Author
|
/azp run runtime |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
Member
Author
|
/azp run runtime-coreclr libraries-jitstress |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
Member
Author
|
Running the "Windows 10SP0" pipelines because I am suspicious these tests may fail on Windows 10 if the certs got RC2 encrypted. |
Member
Author
|
/ba-g failures are #136367 |
Member
|
/backport to release/10.0 |
Contributor
|
Started backporting to |
Member
|
/backport to release/11.0 |
Contributor
|
Started backporting to |
This was referenced Oct 24, 2026
ViveliDuCh
pushed a commit
that referenced
this pull request
Nov 10, 2026
…136415) Backport of #136365 to release/11.0 /cc @bartonjs @vcsjones ## Customer Impact - [x] Customer reported - [ ] Found internally Reported in #136316. Customers that export a certificate with a private key using PKCS#12 ("PFX") format may include trailing zeros in the export. This impacts certain legacy RSA keys used with `RSACryptoServiceProvider`. Some ecosystems do not tolerate the trailing zeros in the PKCS#12 and reject them as input. This prevents interoperability between .NET and those ecosystems. ## Regression - [x] Yes - [ ] No Regressed from .NET Framework. ## Testing Custom provided a reproduction which was adapted in to a unit test. Existing unit tests ensure current export scenarios continue to work. ## Risk Low. This change is in a well-tested area and the needed change was well understood. A buffer was not being correctly resized based on an API's reported "amount written". Co-authored-by: Kevin Jones <kevin@vcsjones.com> Co-authored-by: Jeremy Barton <jbarton@microsoft.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #136316