Loading the Jira Public Certificate in .Net from a string (how to convert ASN.1 encoded SubjectPublicKeyInfo to X509 Cert in .Net)

Question

I am building an oauth 1.0a service that will be consumed by a gadget within Jira, it's a .Net 3.5 Application written in C#.

Jira makes requests to this service using the RSA-SHA1 signature method, which means to verify the signature of the request I need create an X509Certificate instance form their public cert.

Within the Jira application you can get the public cert by going to the consumer info screen (which also has the consumer key for Jira etc.) and it presents the public key in this format:

MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCObJRTGSZbAo
jRkvKmm0cwFXnKcPMfR4t/sghvLe/+QVs6TJOz5cUh5UokSqyz
VeMsL0jomP18ZcR3SPcIFT7xtOGQjLwLk7ghfYSsxjTGs9VxsC
/PQk5OQRP3v43IxFNF3M2SYhFWJZTOnqrab5AsMh2Kxdv+D69D
CINXCu5ltQIDAQAB

Looking at the Jira code which generates this key I can see it's (supposedly) PEM encoded without the BEGIN/END certificate header/footer.

RSAKeys.toPemEncoding(consumer.getPublicKey())

RSAKeys is an open source class found here:

https://studio.atlassian.com/source/browse/OAUTH/trunk/api/src/main/java/com/atlassian/oauth/util/RSAKeys.java?r=HEAD

I wish to load this public cert (key) into an X509Certificate instance within .Net, but my attempts so far have failed. Here's the code I have:

static readonly Regex stripRegex = new Regex("-----[A-Z ]*-----");

public string ConvertFromOpenSsl(string key)
{
    return stripRegex.Replace(key, "").Replace("\r", "").Replace("\n", "");
}

public X509Certificate2 GetConsumerCertificate(IConsumer consumer)
{
    string cert =               
    @"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCObJRTGSZbAo
    jRkvKmm0cwFXnKcPMfR4t/sghvLe/+QVs6TJOz5cUh5UokSqyz
    VeMsL0jomP18ZcR3SPcIFT7xtOGQjLwLk7ghfYSsxjTGs9VxsC
    /PQk5OQRP3v43IxFNF3M2SYhFWJZTOnqrab5AsMh2Kxdv+D69D
    CINXCu5ltQIDAQAB";

    string converted = ConvertFromOpenSsl(cert);

    var bytes = Convert.FromBase64String(converted);


    var cert = new X509Certificate2(bytes); // throws here

But on the last line of code I have an exception thrown:

System.Security.Cryptography.CryptographicException: Cannot find the requested object.

    at System.Security.Cryptography.CryptographicException.ThrowCryptogaphicException(Int32 hr)
    at System.Security.Cryptography.X509Certificates.X509Utils._QueryCertBlobType(Byte[] rawData)
    at System.Security.Cryptography.X509Certificates.X509Certificate.LoadCertificateFromBlob(Byte[] rawData, Object password, X509KeyStorageFlags keyStorageFlags)
    at System.Security.Cryptography.X509Certificates.X509Certificate..ctor(Byte[] data)
    at System.Security.Cryptography.X509Certificates.X509Certificate2..ctor(Byte[] rawData) 

I'm pretty sure I am missing something elementary, but I can think what it is.

UPDATE

OK, on further investigation it appears that this is a SubjectPublicKeyInfo serialization of the public key, so it's ASN.1, base 64 encoded (162 bytes unencoded), which is the default output from Java using java.security.PublicKey.getEncoded().

So given all that - is there any easy way to create an X509Certificate2 instance wrapping this public key - or is additional metadata required beyond the public key to create an x509Certificate2 instance?

Answer 1

Jira should provide you with a Certificate (not just a public key).

Typically the Java world will give a base64 encoded or PEM certificate. X509Certificate2 from .Net can automatically .Load a base64, PEM or binary certificate.

Answer 2

you can generate your XML RSA certificate via .NET using RSACryptoServiceProvider. This will give you XML (FromXmlString method), the public key then needs to be encoded, for example by using this service:

https://superdry.apphb.com/tools/online-rsa-key-converter

and then used to create application link to JIRA.

The private key in XML form you got previously, can be used for signing .NET app requests directly.

I personally used DonNetAuth library for signing, exchannging tokens, etc and it works for me. The only bug I encountered was regarding jql queries, where the signing needed a bit of tweaking to work correctly. Here is the link:

http://samondotnet.blogspot.sk/2012/12/introduction-to-dotnetauth.html

Additionally see this link: https://answers.atlassian.com/questions/172760/is-there-any-jira-oauth-implementation-example-in-net

Hope this helps.