无法将带私钥的X509Certificate2保存至X509Store的问题求助

希望避免使用CERTENROLLLib，改用原生.NET 8的CertificateRequest生成CSR，获取证书后将私钥整合到证书中，再存入Windows证书存储的StoreName.My目录。

调试时显示私钥已整合到证书中，但存入存储后无法导出带私钥的证书，私钥似乎消失了。相关代码如下：

证书导入与存储代码 #

public static readonly X509KeyStorageFlags InstallFlags = X509KeyStorageFlags.Exportable |
                                                          X509KeyStorageFlags.PersistKeySet |
                                                          X509KeyStorageFlags.UserKeySet;

byte[] rawData = Convert.FromBase64String(x509Base64);
using (var tmp = new X509Certificate2(rawData, "", InstallFlags))
{
    string pubKey = Convert.ToBase64String(tmp.PublicKey.EncodedKeyValue.RawData);

    SomeTempCryptoDictionary.TryGetValue(pubKey, out var crypto);
    using (var certWithPrivateKey = tmp.CopyWithPrivateKey((RSA) crypto))
    using (var store = new X509Store(StoreName.My, StoreLocation.CurrentUser))
    {
        store.Open(OpenFlags.ReadWrite);
        store.Add(certWithPrivateKey);
        store.Close();

        certWithPrivateKey.Reset();
    }
}

CSR生成代码 #

RSA rsa = RSA.Create(2048);
X500DistinguishedName dn = new X500DistinguishedName("CN=HelloWorld");
CertificateRequest csr = new CertificateRequest(dn, rsa,
                                                HashAlgorithmName.SHA256,
                                                RSASignaturePadding.Pkcs1);
string pubKey = Convert.ToBase64String(csr.PublicKey.EncodedKeyValue.RawData);
// 保存以便后续使用
SomeTempCryptoDictionary.Add(pubKey, rsa);

return Convert.ToBase64String(csr.CreateSigningRequest());

尝试过按建议以Pkcs12格式导出/导入，结果依旧：

using (var certWithPrivateKey = tmp.CopyWithPrivateKey((RSA) crypto))
using (var certExportable = new X509Certificate2(certWithPrivateKey.Export(X509ContentType.Pkcs12)))
using (var store = new X509Store(StoreName.My, StoreLocation.CurrentUser))

问题核心在于私钥的持久化标记未正确设置，以及临时密钥对象的生命周期管理问题，以下是修复步骤：

1. 生成RSA密钥时显式设置持久化与可导出标记
   默认创建的RSA密钥是临时的，对象释放后会被系统销毁。需通过CngKey显式配置密钥属性，确保私钥可持久化：

var keyParams = new CngKeyCreationParameters
{
    ExportPolicy = CngExportPolicies.AllowExport,
    KeyCreationOptions = CngKeyCreationOptions.PersistKeySet,
    KeyUsage = CngKeyUsages.Signing | CngKeyUsages.KeyAgreement
};
using CngKey cngKey = CngKey.Create(CngAlgorithm.Rsa, null, keyParams);
RSA rsa = RSA.Create(cngKey);

X500DistinguishedName dn = new X500DistinguishedName("CN=HelloWorld");
CertificateRequest csr = new CertificateRequest(dn, rsa,
                                                HashAlgorithmName.SHA256,
                                                RSASignaturePadding.Pkcs1);
string pubKey = Convert.ToBase64String(csr.PublicKey.EncodedKeyValue.RawData);
SomeTempCryptoDictionary.Add(pubKey, rsa);

return Convert.ToBase64String(csr.CreateSigningRequest());

2. 重新导入证书以确保密钥标记生效
   关联私钥后，通过导出为PKCS12再重新导入的方式，让X509KeyStorageFlags的设置完全作用于私钥：

byte[] rawData = Convert.FromBase64String(x509Base64);
using var tmpCert = new X509Certificate2(rawData);

string pubKey = Convert.ToBase64String(tmpCert.PublicKey.EncodedKeyValue.RawData);
if (!SomeTempCryptoDictionary.TryGetValue(pubKey, out RSA rsa))
    throw new InvalidOperationException("未找到对应私钥");

// 关联私钥
using var certWithPrivateKey = tmpCert.CopyWithPrivateKey(rsa);
// 导出为PKCS12并重新导入，确保存储标记生效
byte[] pkcs12Bytes = certWithPrivateKey.Export(X509ContentType.Pkcs12, "");
using var finalCert = new X509Certificate2(
    pkcs12Bytes, 
    "", 
    X509KeyStorageFlags.Exportable | X509KeyStorageFlags.PersistKeySet | X509KeyStorageFlags.UserKeySet
);

// 存入证书存储
using var store = new X509Store(StoreName.My, StoreLocation.CurrentUser);
store.Open(OpenFlags.ReadWrite);
store.Add(finalCert);
store.Close();

// 清理临时存储的RSA对象
SomeTempCryptoDictionary.Remove(pubKey);
rsa.Dispose();

3. 管理私钥对象生命周期
   确保SomeTempCryptoDictionary中的RSA对象在证书存入存储后再释放，避免私钥被提前回收。

内容的提问来源于stack exchange，提问作者codenamezero