title: PFX Certificate Imported for TLS/SSL Encryption of MQTTnet Client Messages Works with Service but Fails with Xamarin UWP App
body: <h1>What We're Trying to Do</h1>
  <p>We in the process of encrypting our MQTT messages. We've been using MQTTnet. This supports TLS encryption, so it is a question of enabling this functionality for an existing solution. Our UWP Xamarin application and a .NET console application both use the same .NET standard DLL for all things MQTT. For the broker, we were using Mosquitto, but we're planning to switch to a simple application that uses MQTTnet server.</p>
  <h1>Here's the Problem</h1>
  <p>We've successfully added TLS encryption on the broker side as well as one of a console application but are having trouble with our UWP Xamarin application. In its current state it is throwing an exception with the message that says &quot;The client certificate provided is missing the required private key information.&quot;</p>
  <h1>What We're Looking For</h1>
  <ul>
  <li>confirmation that this is possible</li>
  <li>a basic understanding of why this is not working (i.e. confirmation of our assumptions or otherwise)</li>
  <li>a solution to this problem</li>
  <li>ideas of things to check.</li>
  </ul>
  <p>So if someone knows &quot;the answer,&quot; great. Otherwise, ideas, advice, expertise, shared experience, etc.</p>
  <h1>Our Assumptions</h1>
  <ul>
  <li>we're assuming that this is possible</li>
  <li>this does not appear to be a MQTTnet bug or limitation</li>
  <li>we're assuming that the reason that we get this error when using the Xamarin UWP application is because of some restriction to disk access or registry access</li>
  <li>we've been assuming that because the PFX file works with the console applicaton it should also work for the Xamarin UWP application (but we've played around with which store it is in as the Xamarin UWP application can only access it in the user key store)</li>
  </ul>
  <h1>Things We've Tried</h1>
  <ul>
  <li>we've read specification docs on MSDN</li>
  <li>we've read blog posts</li>
  <li>we've read and followed advice from various Stack Overflow posts</li>
  <li>we've read and followed advice from various MQTTnet support posts</li>
  <li>we've tried two different brokers (Mosquitto and a sample application that uses MQTTnet server).</li>
  <li>we've tried creating the certificates using OpenSSL and manually through the OS (Windows 10); for more controllable/deterministic/repeatable results we will switch to using a PS script for the latter</li>
  <li>we've tried creating the certificate for user store and machine store</li>
  <li>we've tried importing the certificate into the store (see code)</li>
  <li>we've tried many different combinations for X509KeyStorage flags (i.e. exportable, persist, user key set,  etc.)</li>
  <li>we've tried running visual studio as administrator</li>
  <li>we've uses SysInternals ProcMon and tried to determine where this is failing (i.e. HD access or registry access)</li>
  <li>we've tried enabling different capabilities for the Xamarin application</li>
  </ul>
  <h1>Useful Links</h1>
  <ul>
  <li><a href="https://docs.microsoft.com/en-us/dotnet/framework/wcf/feature-details/working-with-certificates" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/dotnet/framework/wcf/feature-details/working-with-certificates</a></li>
  <li><a href="https://docs.microsoft.com/en-us/troubleshoot/iis/cannot-import-ssl-pfx-local-certificate" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/troubleshoot/iis/cannot-import-ssl-pfx-local-certificate</a></li>
  <li><a href="https://github.com/chkr1011/MQTTnet/wiki/Server-and-client-method-documentation" rel="nofollow noreferrer">https://github.com/chkr1011/MQTTnet/wiki/Server-and-client-method-documentation</a></li>
  <li><a href="https://github.com/chkr1011/MQTTnet/issues/115" rel="nofollow noreferrer">https://github.com/chkr1011/MQTTnet/issues/115</a></li>
  <li><a href="https://github.com/chkr1011/MQTTnet/issues/124" rel="nofollow noreferrer">https://github.com/chkr1011/MQTTnet/issues/124</a></li>
  <li><a href="https://paulstovell.com/x509certificate2/" rel="nofollow noreferrer">https://paulstovell.com/x509certificate2/</a></li>
  <li><a href="https://stackoverflow.com/questions/55575078/mqttnet-client-cant-connect-server-certificate">MQTTnet client can&#39;t connect server certificate</a></li>
  <li><a href="https://stackoverflow.com/questions/52929805/extract-private-key-from-pfx-file-or-certificate-store-without-using-openssl-on">Extract private key from pfx file or certificate store WITHOUT using OpenSSL on Windows</a></li>
  </ul>
  <h1>Some of our Code</h1>
  <pre><code>    /// &lt;summary&gt;
      /// Connect to the MQTT broker using the defined options
      /// &lt;/summary&gt;
      private async Task ConnectAsync()
      {
          IMqttClientOptions options = CreateMqttClientOptions();
      
          try
          {
              await m_mqttClient.ConnectAsync(options);
          }
          catch (Exception ex)
          {
              m_logger?.LogCritical(ex, &quot;Failed to reconnect - service unavailable&quot;);
          }
      }
      
      /// &lt;summary&gt;
      /// Helper function used to create the MQTT client options object. This includes the certificate.
      /// &lt;/summary&gt;
      private IMqttClientOptions CreateMqttClientOptions()
      {
          string filepath = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), &quot;MobileTools.2.pfx&quot;);
      
          X509Certificate2 certificate = new X509Certificate2(
              filepath,
              &quot;notactuallymypassword&quot;,
              X509KeyStorageFlags.Exportable | X509KeyStorageFlags.UserKeySet);
      
          //InstallCertificate(certificate);
      
          // Set-up options.
          return new MqttClientOptionsBuilder()
              .WithCleanSession(true)
              .WithClientId(m_clientID)
              .WithTcpServer(&quot;NotActuallyDnsName&quot;, m_configuration.Port)
              .WithTls(new MqttClientOptionsBuilderTlsParameters
              {
                  Certificates = new List&lt;byte[]&gt;
                  {
                      certificate.Export(X509ContentType.Cert)
                  },
                  CertificateValidationCallback = (X509Certificate xCertificate, X509Chain xChain, SslPolicyErrors sslPolicyErrors, IMqttClientOptions clientOptions) =&gt;
                  {
                      return true;
                  },
                  UseTls = true
              })
             .Build();
      }
      
      /// &lt;summary&gt;
      /// Helper function used to create the MQTT client options object. This includes the certificate.
      /// &lt;/summary&gt;
      private void InstallCertificate(X509Certificate2 certificate)
      {
          X509Store store = new X509Store(StoreName.My, StoreLocation.CurrentUser);
      
          store.Open(OpenFlags.ReadWrite);
          store.Add(certificate);
          store.Close();
      }
  </code></pre>
  <h1>Stack Trace</h1>
  <pre><code>The client certificate provided is missing the required private key information. ---&gt; System.ArgumentException: The parameter is incorrect.
  
  The client certificate provided is missing the required private key information.
     at Windows.Networking.Sockets.StreamSocketControl.put_ClientCertificate(Certificate value)
     at MQTTnet.Implementations.MqttTcpChannel.ConnectAsync(CancellationToken cancellationToken)
     at MQTTnet.Internal.MqttTaskTimeout.WaitAsync(Func`2 action, TimeSpan timeout, CancellationToken cancellationToken)
     at MQTTnet.Adapter.MqttChannelAdapter.ConnectAsync(TimeSpan timeout, CancellationToken cancellationToken)
     --- End of inner exception stack trace ---
     at MQTTnet.Adapter.MqttChannelAdapter.WrapException(Exception exception)
     at MQTTnet.Adapter.MqttChannelAdapter.ConnectAsync(TimeSpan timeout, CancellationToken cancellationToken)
     at MQTTnet.Client.MqttClient.ConnectAsync(IMqttClientOptions options, CancellationToken cancellationToken)
     at MQTTnet.Client.MqttClient.ConnectAsync(IMqttClientOptions options, CancellationToken cancellationToken)
     at TS.Orbit.MQTTLib.Client.MqttNetClient.ConnectAsync(IMQTTClientConfiguration configuration)
  </code></pre>