How to create self-signed certificate using Ed25519 in C#

Question

I have to generate X509 certificates using Ed25519. I know I should use RequestCertificate class from System.Security.Cryptography.X509Certificates namespace but seems that it doesn't support ed25519.

That's my scenario: I have private ed25519 key and basing on it I need to generate self-signed X509 Certificate that will be able to use in mutual TLS.

I don't have any idea how can I do this while using ed25519, because it seems there is not support for this curve. How can I do this?

The built-in .NET cryptography classes don't support Edwards DSA (EdDSA). If you have an implementation of EdDSA, then you could create an [X509SignatureGenerator](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.x509certificates.x509signaturegenerator?view=net-7.0) to represent EdDSA, and use that with the `CertificateRequest` class. Otherwise, you'll need to use something external (Bouncy Castle, directly using OpenSSL, using the OpenSSL command line tools, et cetera). — bartonjs, Jan 04 '23 at 01:02

Nora Söderlund · Answer 1 · 2022-12-29T17:53:08.617

Create a configuration file for OpenSSL, e.g. openssl-25519.cnf:

[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no
[req_distinguished_name]
C = DE
CN = www.example.com
[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = www.example.com
DNS.2 = example.com

You can use File.WriteAllText to a temp file to use it during the certificate signing whereas openSsl25519Configuration is a string of the configuration above, where you can interpolate in your dynamic values.

string tempCnfName = Path.GetTempFileName();

File.WriteAllText(tempCnfName, openSsl25519Configuration);

Then use OpenSSL to request a certificate signing request file, using your private key (example.com.key).

openssl req -new -out example.com.csr -key example.com.key -config openssl-25519.cnf

If you already have an existing private key, refer to the file path to the .key file in the process arguments:

string tempCsrName = Path.GetTempFileName();

Process process = new Process() {
    StartInfo = {
        FileName = "openssl.exe",
        Arguments = $"req -new -out {tempCsrName} -key example.com.key -config {tempCnfName}"
    }
};

process.Start();
process.WaitForExit();

And now you can use OpenSSL again to self-sign example.com.csr:

openssl x509 -req -days 700 -in example.com.csr -signkey example.com.key -out example.com.crt

string tempCrtName = Path.GetTempFileName();

Process process = new Process() {
    StartInfo = {
        FileName = "openssl.exe",
        Arguments = $"req x509 -req -days 700 -in {tempCsrName} -signkey example.com.key -out {tempCrtName}"
    }
};

process.Start();
process.WaitForExit();

And now you have a self-signed ED25519 certificate that you can move or read as you need through tempCrtName.

If you don't already have a private key, you can generate one:

openssl genpkey -algorithm ED25519 > example.com.key

Source: https://blog.pinterjann.is/ed25519-certificates.html

I know it's possible to do with OpenSSL. But I need to generate these certificates "on the fly" in C#. — Szyszka947, Dec 29 '22 at 17:41
You can achieve the same result using Processes in C#, I'll update my answer to reflect this. — Nora Söderlund, Dec 29 '22 at 17:44
A clever solution. But it seems a not performance solution because we need to start a new process (and OpenSSL must be installed), we need to create temporary file, write to it at later read from it. Forgive me, but I think it's not the best possible answer. — Szyszka947, Dec 29 '22 at 18:28
I/O is not really an "issue" in performance talks, unless we're of course talking about using I/O as a large scale database - then yes of course. But writing to a file, reading from a file, 2 times in a somewhat large operation is not an issue at all. — Nora Söderlund, Dec 30 '22 at 05:44
That sounds very sketchy...and undoable on a single machine/synchronous thread. What are you trying to do with all these certificates? — Nora Söderlund, Dec 30 '22 at 09:11

How to create self-signed certificate using Ed25519 in C#

1 Answers1