title: "The credentials supplied to the package were not recognized" error when authenticating as server with certificate generated using BouncyCastle
body: <p>I'm trying to create a certificate using the BouncyCastle.Crypto dll, which is then used to authenticate a SslStream as the server in a Windows Service process, which runs under the Local System account.</p>
  
  <p>However when I get to the SslStream.AuthenticateAsServer(certificate) call, it throws a Win32 exception with the error message "The credentials supplied to the package were not recognized".</p>
  
  <p>There are several questions on here about this error message, but none of them seem to describe, or solve, my particular problem.  </p>
  
  <p>In the hope that someone may be able to offer some help, I include the code I am using to create and install the certificate:</p>
  
  <pre><code>// First create a certificate using the BouncyCastle classes
  BigInteger serialNumber = BigInteger.ProbablePrime(120, new Random());
  AsymmetricCipherKeyPair keyPair = GenerateKeyPair();
  
  X509V1CertificateGenerator generator = new X509V1CertificateGenerator();
  generator.SetSerialNumber(serialNumber);
  generator.SetIssuerDN(new X509Name("CN=My Issuer"));
  generator.SetNotBefore(DateTime.Today);
  generator.SetNotAfter(DateTime.Today.AddYears(100));
  generator.SetSubjectDN(new X509Name("CN=My Issuer"));
  generator.SetPublicKey(keyPair.Public);
  generator.SetSignatureAlgorithm("SHA1WITHRSA");
  
  Org.BouncyCastle.X509.X509Certificate cert = generator.Generate(
      keyPair.Private, SecureRandom.GetInstance("SHA1PRNG"));
  
  // Ok, now we have a BouncyCastle certificate, we need to convert it to the 
  // System.Security.Cryptography class, by writing it out to disk and reloading
  X509Certificate2 dotNetCert;
  
  string tempStorePassword = "Password01"; // In real life I'd use a random password
  FileInfo tempStoreFile = new FileInfo(Path.GetTempFileName());
  
  try
  {
      Pkcs12Store newStore = new Pkcs12Store();
  
      X509CertificateEntry entry = new X509CertificateEntry(cert);
  
      newStore.SetCertificateEntry(Environment.MachineName, entry);
  
      newStore.SetKeyEntry(
          Environment.MachineName,
          new AsymmetricKeyEntry(keyPair.Private),
          new [] { entry });
  
      using (FileStream s = tempStoreFile.Create())
      {
          newStore.Save(s, 
              tempStorePassword.ToCharArray(), 
              new SecureRandom(new CryptoApiRandomGenerator()));
      }
  
      // Reload the certificate from disk
      dotNetCert = new X509Certificate2(tempStoreFile.FullName, tempStorePassword);
  }
  finally
  {
      tempStoreFile.Delete();
  }
  
  // Now install it into the required certificate stores
  X509Store targetStore = new X509Store(StoreName.My, StoreLocation.LocalMachine);
  targetStore.Open(OpenFlags.ReadWrite);
  targetStore.Add(dotNetCert);
  targetStore.Close();
  </code></pre>
  
  <p>Ok, now I have created and installed the certificate. I then configure my Windows Service to use this certificate by supplying it with the generated certificate's thumbprint. I then use the certificate like this:</p>
  
  <pre><code>// First load the certificate
  X509Certificate2 certificate = null;
  
  X509Store store = new X509Store(StoreName.My, StoreLocation.LocalMachine);
  store.Open(OpenFlags.ReadOnly);
  
  foreach (X509Certificate2 certInStore in store.Certificates)
  {
      if (certInStore.Thumbprint == "...value not shown...")
      {
          certificate = certInStore;
          break;
      }
  }
  
  SslStream sslStream = new SslStream(new NetworkStream(socket, false), false);
  
  // Now this line throws a Win32Exception 
  // "The credentials supplied to the package were not recognized"
  sslStream.AuthenticateAsServer(certificate);
  </code></pre>
  
  <p>Does anyone have any idea what the problem could be here?</p>
  
  <p>I don't get the problem if I install a certificate created with 'makecert', but that isn't suitable for production certificates.</p>
  
  <p>I've also tried creating a separate x509v1 CA certificate and then x509v3 certificate for server authentication, but I get the same error, so I removed this in the example code for simplicity.</p>