title: How can constructing an X509Certificate2 from a PKCS#12 byte array throw CryptographicException("The system cannot find the file specified.")?
body: <p>I'm trying to construct an <code>X509Certificate2</code> from a PKCS#12 blob in a byte array and getting a rather puzzling error.  This code is running in a desktop application with administrator rights on Windows XP.</p>
  
  <p>The stack trace is as follows, but I got lost trying to troubleshoot because <code>_LoadCertFromBlob</code> is marked <code>[MethodImpl(MethodImplOptions.InternalCall)]</code>.</p>
  
  <pre><code>System.Security.Cryptography.CryptographicException: The system cannot find the file specified.
    at System.Security.Cryptography.CryptographicException.ThrowCryptogaphicException(Int32 hr)
    at System.Security.Cryptography.X509Certificates.X509Utils._LoadCertFromBlob(Byte[] rawData, IntPtr password, UInt32 dwFlags, Boolean persistKeySet, SafeCertContextHandle&amp; pCertCtx)
    at System.Security.Cryptography.X509Certificates.X509Certificate.LoadCertificateFromBlob(Byte[] rawData, Object password, X509KeyStorageFlags keyStorageFlags)
    at System.Security.Cryptography.X509Certificates.X509Certificate2..ctor(Byte[] rawData, String password, X509KeyStorageFlags keyStorageFlags)
  </code></pre>
  
  <p><strong>EDIT:</strong> The blob is a true PKCS#12 generated by <a href="http://www.bouncycastle.org/csharp/" rel="noreferrer">BouncyCastle for C#</a> containing a RSA private key and certificate (either self-signed or recently enrolled with a CA) -- what I'm trying to do is convert the private key and certificate from the BouncyCastle library to the System.Security.Cryptography library by exporting from one and importing to the other.  This code works on the vast majority of systems it's been tried on; I've just never seen that particular error thrown from that constructor.  It may be some sort of environmental weirdness on that one box.</p>
  
  <p><strong>EDIT 2:</strong> The error is occurring in a different environment in a different city, and I'm unable to reproduce it locally, so I may end up having to chalk it up to a broken XP installation.</p>
  
  <p>Since you asked, though, here is the fragment in question.  The code takes a private key and certificate in BouncyCastle representation, deletes any previous certificates for the same Distinguished Name from the personal key store, and imports the new private key and certificate into the personal key store via an intermediate PKCS#12 blob.</p>
  
  <pre><code>// open the personal keystore
  var msMyStore = new X509Store(StoreName.My);
  msMyStore.Open(OpenFlags.MaxAllowed);
  
  // remove any certs previously issued for the same DN
  var oldCerts =
      msMyStore.Certificates.Cast&lt;X509Certificate2&gt;()
          .Where(c =&gt; X509Name
                          .GetInstance(Asn1Object.FromByteArray(c.SubjectName.RawData))
                          .Equivalent(CurrentCertificate.SubjectDN))
          .ToArray();
  if (oldCerts.Length &gt; 0) msMyStore.RemoveRange(new X509Certificate2Collection(oldCerts));
  
  // build a PKCS#12 blob from the private key and certificate
  var pkcs12store = new Pkcs12StoreBuilder().Build();
  pkcs12store.SetKeyEntry(_Pkcs12KeyName,
                          new AsymmetricKeyEntry(KeyPair.Private),
                          new[] {new X509CertificateEntry(CurrentCertificate)});
  var pkcs12data = new MemoryStream();
  pkcs12store.Save(pkcs12data, _Pkcs12Password.ToCharArray(), Random);
  
  // and import it.  this constructor call blows up
  _MyCertificate2 = new X509Certificate2(pkcs12data.ToArray(),
                                         _Pkcs12Password,
                                         X509KeyStorageFlags.Exportable);
  msMyStore.Add(_MyCertificate2);
  msMyStore.Close();
  </code></pre>