导入自签名证书触发NTE_NOT_SUPPORTED错误的问题咨询

问题背景 #

我通过以下PowerShell命令创建自签名证书：

$file='c:\temp\testcert.pfx'
$email = "testmail@friends.com"
$mailname = "testmail"

$pwd = "tst"
$dnsname="friends.com"
$password = (convertto-securestring -string $pwd -force -asplaintext)
$params = @{
    Subject = "E=$email,CN=$mailname"
    KeyAlgorithm = 'RSA'
    KeyLength = 2048
    CertStoreLocation = 'Cert:\CurrentUser\My'
    NotAfter = (Get-Date).AddYears(1)
    NotBefore = (Get-Date).AddYears(-1)
    KeyUsage = @("DigitalSignature","CRLSign","CertSign","KeyEncipherment")
    DnsName = $dnsname
}
$cert = New-SelfSignedCertificate @params
Export-PfxCertificate -cert "Cert:\CurrentUser\My\$($cert.Thumbprint)" -FilePath $file -Password $password
$pwd | certutil -dump $file

尝试用C#先导入证书再添加到TemporarySecureMimeContext，代码如下：

var certFilePath = "c:\\temp\\testcert.pfx";
var secureCtx = new TemporarySecureMimeContext();
var cert = new X509Certificate2(certFilePath , "tst", X509KeyStorageFlags.Exportable);
secureCtx.Import(cert);

此时收到System.Security.Cryptography.CngKey.Export抛出的NTE_NOT_SUPPORTED错误，错误栈如下：

Internal.Cryptography.CryptoThrowHelper+WindowsCryptographicException : The requested operation is not supported.
   at System.Security.Cryptography.CngKey.Export(CngKeyBlobFormat format)
   at System.Security.Cryptography.RSACng.ExportKeyBlob(Boolean includePrivateParameters)
   at System.Security.Cryptography.RSACng.ExportParameters(Boolean includePrivateParameters)
   at MimeKit.Cryptography.AsymmetricAlgorithmExtensions.GetAsymmetricKeyParameters(RSA rsa, Boolean publicOnly, AsymmetricKeyParameter& pub, AsymmetricKeyParameter& key)
   at MimeKit.Cryptography.AsymmetricAlgorithmExtensions.GetAsymmetricKeyParameter(RSA rsa)
   at MimeKit.Cryptography.AsymmetricAlgorithmExtensions.AsAsymmetricKeyParameter(AsymmetricAlgorithm key)
   at MimeKit.Cryptography.X509Certificate2Extensions.GetPrivateKeyAsAsymmetricKeyParameter(X509Certificate2 certificate)
   at MimeKit.Cryptography.TemporarySecureMimeContext.Import(X509Certificate2 certificate, CancellationToken cancellationToken)

但如果直接调用secureCtx.Import(certFilePath, "tst");，证书可以成功导入。

原因解释 #

这个错误的核心原因是：

• New-SelfSignedCertificate默认使用CNG（下一代加密技术）密钥存储提供程序创建证书，即使指定了X509KeyStorageFlags.Exportable，CNG密钥在通过X509Certificate2对象导出私钥参数时仍存在限制，而MimeKit的TemporarySecureMimeContext.Import(X509Certificate2)方法需要导出私钥，因此触发NTE_NOT_SUPPORTED错误。
• 直接调用secureCtx.Import(certFilePath, "tst")时，MimeKit内部会直接解析PFX文件，绕过了CNG密钥导出的限制，因此可以成功导入。

可行代码方案 #

方案1：直接导入PFX文件（最简单且验证可行） #

直接使用文件路径和密码导入，无需提前加载X509Certificate2对象：

var certFilePath = "c:\\temp\\testcert.pfx";
var secureCtx = new TemporarySecureMimeContext();
// 直接导入PFX文件，MimeKit会处理密钥兼容问题
secureCtx.Import(certFilePath, "tst");

方案2：修改证书创建方式（使用CAPI密钥提供程序） #

如果必须先加载X509Certificate2对象再导入，可以修改PowerShell命令，指定使用旧版CAPI密钥存储提供程序，避免CNG的限制：
修改后的PowerShell命令：

$file='c:\temp\testcert.pfx'
$email = "testmail@friends.com"
$mailname = "testmail"

$pwd = "tst"
$dnsname="friends.com"
$password = (convertto-securestring -string $pwd -force -asplaintext)
$params = @{
    Subject = "E=$email,CN=$mailname"
    KeyAlgorithm = 'RSA'
    KeyLength = 2048
    CertStoreLocation = 'Cert:\CurrentUser\My'
    NotAfter = (Get-Date).AddYears(1)
    NotBefore = (Get-Date).AddYears(-1)
    KeyUsage = @("DigitalSignature","CRLSign","CertSign","KeyEncipherment")
    DnsName = $dnsname
    Provider = "Microsoft RSA SChannel Cryptographic Provider" # 添加该参数指定CAPI提供程序
}
$cert = New-SelfSignedCertificate @params
Export-PfxCertificate -cert "Cert:\CurrentUser\My\$($cert.Thumbprint)" -FilePath $file -Password $password
$pwd | certutil -dump $file

此时原C#代码即可正常运行：

var certFilePath = "c:\\temp\\testcert.pfx";
var secureCtx = new TemporarySecureMimeContext();
var cert = new X509Certificate2(certFilePath , "tst", X509KeyStorageFlags.Exportable);
secureCtx.Import(cert);

方案3：调整密钥存储标志（临时兼容方案） #

如果无法修改证书创建方式，可以尝试调整X509Certificate2的加载标志，部分环境下可绕过限制：

var certFilePath = "c:\\temp\\testcert.pfx";
var secureCtx = new TemporarySecureMimeContext();
// 添加MachineKeySet和PersistKeySet标志
var cert = new X509Certificate2(certFilePath, "tst", 
    X509KeyStorageFlags.Exportable | X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.PersistKeySet);
secureCtx.Import(cert);

注意：该方案兼容性不如前两种，仅作为临时备选。

内容的提问来源于stack exchange，提问作者Mike