Edit Question - KnowledgeHub

Title Body

I want to validate chain of certificates, I get a X509Certificate2 collection and have to validate if all the certificates build one chain. Usually, in order to verify the certificates chain I should take the digital signature from the leaf certificate and check if it is signed by the root certificate - but in .NET I can't find a way to extract the signature from the X509Certificate2 object. Therefore, I thought of using X509Chain.Build() method in the following way: void ValidateChain(X509Certificate2Collection collection, X509Certificate2 leaf) { X509Chain x509Chain = new X509Chain(); x509Chain.ChainPolicy.ExtraStore.AddRange(collection); bool isValid = x509Chain.Build(leaf); } But I have some questions about the build method: As I understood, the chain was built also from my computer store, and I want that it is built only from the ExtraStore , how can I define this behaviour? I saw that after the chain was built it doesn't contain the Root Certificate; my question is why , and how can I verify that the chain has Root CA, since this is not part of the chain elements. I will so appreciate it if someone can explain to me how the Build() method works.

Tags (comma-separated) Cancel