title: How to create a X509 certificate that prevents "server mode SSL must use certificate with associated private key" exception?
body: <p>I'm trying to create an X.509 certificate file that will work with the following code as found in the <a href="https://smtp4dev.codeplex.com/" rel="nofollow noreferrer">smtp4dev</a> project:</p>
  
  <pre><code>var certificate = new X509Certificate(Settings.Default.SSLCertificatePath);
  var clientCertificateRequired = false;
  var protocols = SslProtocols.Ssl2 | SslProtocols.Ssl3 | SslProtocols.Tls;
  var checkRevocation = false;
  
  var stream = new SslStream(stream);
  stream.AuthenticateAsServer(certificate, clientCertificateRequired, protocols, checkRevocation);
  </code></pre>
  
  <p><code>Settings.Default.SSLCertificatePath</code> points to a .cer file.</p>
  
  <p>Whatever I try, this fails with a <code>System.NotSupportedException</code> with the message:</p>
  
  <blockquote>
    <p>The server mode SSL must use a certificate with the associated private key.</p>
  </blockquote>
  
  <p>I have created an X509 certificate using the <a href="https://technet.microsoft.com/en-us/itpro/powershell/windows/pkiclient/new-selfsignedcertificate" rel="nofollow noreferrer">New-SelfSignedCertificate</a> PowerShell CommandLet in an elevated PowerShell session:</p>
  
  <pre><code>New-SelfSignedCertificate `
      -DnsName "localhost" `
      -CertStoreLocation "cert:\CurrentUser\My" `
      -FriendlyName "smtp4dev" `
      -TextExtension "2.5.29.37={text}1.3.6.1.5.5.7.3.1" `
      -KeyUsage DigitalSignature,KeyEncipherment,DataEncipherment `
      -Provider "Microsoft RSA SChannel Cryptographic Provider"
  </code></pre>
  
  <p>I added these options to mirror as closely as possible a certificate that is already stored on my machine, and that was generated by the IIS Express installer. Because that particular certificate does work, although I don't know why.</p>
  
  <p>Both certificates are located in the <code>Local Computer &gt; Personal</code> certificate store. For both certificates the Certificate Manager mentions that "You have a private key that corresponds to this certificate". </p>
  
  <p>When I compare the properties of these 2 certificates, the smtp4dev certificate differs from the IIS Express Development Certificate in the following 3 ways (besides the Thumbprint and Serial number):</p>
  
  <ul>
  <li>Key Usage is marked as a critical extension</li>
  <li>Subject Alternative Name extension with value <code>DNS Name=localhost</code></li>
  <li>Subject Key Identifier extension with value <code>e7 12 f5 ...</code></li>
  </ul>
  
  <p>I exported both certificates to my desktop without the private key as "Base-64 encoded x.509 (.CER)" files using the Certificate Manager. (Including the private key would limit the export format to PKCS #12 (.PFX) which is not supported by smtp4dev.)</p>
  
  <p>After exporting the certificates this way, when I double-click them, neither shows the message about having the private key.</p>
  
  <p>Only the IIS Express Development Certificate works in the code shown at the beginning of this question. The smtp4dev one does not.</p>
  
  <p>Other things I tried:</p>
  
  <ol>
  <li><p>I often come across tutorials that use <code>makecert</code>, but I don't have that program. </p></li>
  <li><p>I have tried using a self-signed certificate generated by <code>openssl</code> and only setting the <code>Common Name</code> to <code>localhost</code> but I get the same exception ("The server mode SSL must use a certificate with the associated private key").</p></li>
  <li><p>Changing the code to use X509Certificate2 is not an option, as it would be time-consuming to get another release of smtp4dev with the patch applied, since the project seems not to be actively developed.</p></li>
  <li><p>Trying a different certificate file format (such as PFX) is actually possible, as long as I rename the file to .cer I can trick smtp4dev into using the certificate. This allows me to include the private key in the certificate. It works with an export of the IIS Express Development Certificate, but it doesn't work with an export of the smtp4dev certificate.</p></li>
  </ol>