Add easy way to create a certificate from just a cert-PEM

[shadow-cs]

Background and Motivation

#31944 was a great addition but it is sort of a shame we cannot use it just to create a cert from PEM without private key.

All that is needed is to expose ExtractCertificateFromPem publicly.

Proposed API

namespace System.Security.Cryptography.X509Certificates
{
    partial class X509Certificate2
    {
        public static X509Certificate2 CreateFromPem(ReadOnlySpan<char> certPem);
    }
}

Usage Examples

Cases where I need a single certificate from PEM data that is already in a System.String or ReadOnlySpan<char>.

Alternatives

• Using a X509Certificate2Collection.ImportFromPem and extracting the single certificate.
• Stripping the header and footer, decoding base64 and feeding to constructor.
• new X509Certificate2(Encoding.ASCII.GetBytes(certPem))

[ghost]

Tagging subscribers to this area: @bartonjs, @vcsjones, @krwq, @jeffhandley
See info in area-owners.md if you want to be subscribed.

[vcsjones]

The first case should be covered by the constructor that takes a path. For that one I think we wanted to avoid introducing a public method that does the same thing as the constructor.

For the latter where you have PEM contents, I would agree that there is not a super straight forward API that does that.

Stripping the header and footer, decoding base64 and feeding to constructor.

There is also the new PemEncoding functionality to parse and iterate over PEM files.

[bartonjs]

The only thing this API would add that the existing ctor doesn't do is support reading the PEM content from a string without passing it through Encoding.ASCII/Encoding.UTF8. (I guess it also would enforce that it's a plain PEM certificate, vs any of the zillions of other formats that the ctors support).

I agree that it's not a negligible thing to have a PEM cert already in a string, but I'm not sure that it's worth creating confusion on the CreateFromPemFile method. Adding just public static X509Certificate2 CreateFromPem(ReadOnlySpan<char> certPem) seems slightly wrong from a symmetry point of view, but its mirror already exists as new X509Certificate2(string path).

Is the scenario you want to solve actually "I have a PEM-encoded certificate in a string and want an X509Certificate2 object", or am I mis-projecting?

[shadow-cs]

The first case should be covered by the constructor that takes a path. For that one I think we wanted to avoid introducing a public method that does the same thing as the constructor.

Right @vcsjones! I added it just to be complete with the new static methods and didn't realize it was in the ctor also.

Is the scenario you want to solve actually "I have a PEM-encoded certificate in a string and want an X509Certificate2 object", or am I mis-projecting?

No @bartonjs you're exactly right. We're implementing a PKI with a custom CTLs (edit: and .NET5 is bringing a lot of improvements in handling chain verification etc. 😉) so parsing a single cert from string is what I need at this point. I did found some other helpers (thanks again @vcsjones for pointing at more). And I do agree that stripping the headers and decoding is simple enough but the method we need is sitting just right there.

[bartonjs]

So

namespace System.Security.Cryptography.X509Certificates
{
    partial class X509Certificate2
    {
        public static X509Certificate2 CreateFromPem(ReadOnlySpan<char> certPem);
    }
}

seems to be all that's required for your scenario. It's pretty low development cost (rename the existing method, make it public) and has a scenario.

Any dissenters?

[shadow-cs]

👍 @bartonjs that's just what we need.

[vcsjones]

Any dissenters?

Seems good to me.

[terrajobst]

Video

• Looks good as proposed

namespace System.Security.Cryptography.X509Certificates
{
    partial class X509Certificate2
    {
        public static X509Certificate2 CreateFromPem(ReadOnlySpan<char> certPem);
    }
}