new X509Certificate2(); Cause System.PlatformNotSupportedException: The PKCS#12 Exportable flag is not supported on this platform in Mac OS

[Ternence]

Summury

new X509Certificate2(ms.ToArray(), password, X509KeyStorageFlags.Exportable);
This line causes this Exception: Cause System.PlatformNotSupportedException: The PKCS#12 Exportable flag is not supported on this platform.

Code

private static X509Certificate2 withPrivateKey(X509Certificate certificate, AsymmetricKeyParameter privateKey)
{
const string password = "password";
Pkcs12Store store;

        if (RunTime.IsRunningOnMono)
        {
            var builder = new Pkcs12StoreBuilder();
            builder.SetUseDerEncoding(true);
            store = builder.Build();
        }
        else
        {
            store = new Pkcs12Store();
        }

        var entry = new X509CertificateEntry(certificate);
        store.SetCertificateEntry(certificate.SubjectDN.ToString(), entry);

        store.SetKeyEntry(certificate.SubjectDN.ToString(), new AsymmetricKeyEntry(privateKey), new[] { entry });
        using (var ms = new MemoryStream())
        {
            store.Save(ms, password.ToCharArray(), new SecureRandom(new CryptoApiRandomGenerator()));
            try
            {
                return new X509Certificate2(ms.ToArray(), password, X509KeyStorageFlags.Exportable);
            } catch (Exception e){
                Console.WriteLine(e);
                return null;
            }              
        }
    }

Exception

2022-07-06 11:55:57.418 WebDebugger[29683:4734908] System.PlatformNotSupportedException: The PKCS#12 Exportable flag is not supported on this platform.
2022-07-06 11:55:57.418 WebDebugger[29683:4734908] at Internal.Cryptography.Pal.AppleCertificatePal.FromDerBlob(ReadOnlySpan1 rawData, X509ContentType contentType, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags) at Internal.Cryptography.Pal.AppleCertificatePal.FromBlob(ReadOnlySpan1 rawData, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags)
2022-07-06 11:55:57.418 WebDebugger[29683:4734908] at Internal.Cryptography.Pal.CertificatePal.FromBlob(ReadOnlySpan`1 rawData, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags)
at System.Security.Cryptography.X509Certificates.X509Certificate..ctor(Byte[] rawData, String password, X509KeyStorageFlags keyStorageFlags)
2022-07-06 11:55:57.418 WebDebugger[29683:4734908] at System.Security.Cryptography.X509Certificates.X509Certificate2..ctor(Byte[] rawData, String password, X509KeyStorageFlags keyStorageFlags)
2022-07-06 11:55:57.418 WebDebugger[29683:4734908] at Titanium.Web.Proxy.Network.Certificate.BCCertificateMaker.withPrivateKey(X509Certificate certificate, AsymmetricKeyParameter privateKey) in /Users/zty/Downloads/src1/Titanium.Web.Proxy/Certificates/Makers/BCCertificateMaker.cs:line 193

[justcoding121]

Fixed on current develop / net10.0.

On non-Windows platforms (notably macOS), BcCertificateMaker / BcCertificateMakerFast now attach the private key via CopyWithPrivateKey instead of importing a PKCS#12 blob with X509KeyStorageFlags.Exportable, which throws PlatformNotSupportedException on Apple platforms. The Windows path still uses PKCS#12 + Exportable so DefaultCertificateDiskCache export continues to work.

Platform-conditional characterization: CertificateManagerTests.BC_Leaf_HasPrivateKey_And_IsSslUsable_OnCurrentPlatform (added in e9669c8). Product fix commit: ff60249.

macOS CI is not available in this environment; the non-Windows code path is in place and the Windows exportable path is preserved and tested.