X509Store.Certificates.Find with validOnly to true is not returning Intermediate authority certificate

Question

I had a certificate installed on:

• Certificates (Local Computer)
  • Trusted root Certification Authorities
    • Certificates

And this code got the certificate as valid.

X509Store certStore = new X509Store(StoreName.CertificateAuthority, StoreLocation.LocalMachine);
certStore.Open(OpenFlags.OpenExistingOnly | OpenFlags.ReadOnly);

try {
    var oAuthRootCertificateList = certStore.Certificates.Find(findType, findValue, true);
    oauthRootCertificate = oAuthRootCertificateList[0];
} catch (Exception ex) {
    Trace.TraceError(ex.Message);
} finally {
    certStore.Close();
}

*(findType and findValue are set previously in the code)

All was ok and the code was fine.

Now I have deleted the certificate from 'trusted root certification authorities' and installed on:

• Certificates (Local Computer)
  • Intermediate Certification Authorities
    • Certificates

because Azure doesn't let me to deploy the certificate on the Trusted Root branch.

And now, the code is failing. I must to change the last parameter (validOnly) from true to false to get it to run.

You can see the help for the Find method here.

Any idea why is it not running and how I can solve it?

Answer 1

The certificates in the intermediate store are used for certificate chain validation purpose. If your certificate is a self signed certificate then its issuer need to be present in trusted root authority for the certificate validation to succeed.

Just placing it in the intermediate certificate authority would not be enough.