On Linux, cannot create PFX with private key if has more than single cert in collection

[ayende]

Sample code:

var collection = new X509Certificate2Collection();
collection.Add(certificateWithPrivateKey);
collection.Add(anotherCertWithoutPrivateKey);

var output = collection.Export(X509ContentType.Pkcs12);

The output is a pfx value that has a single certificate in place, the second one, without the private key.

I tracked it down to this piece of code:
https://github.com/dotnet/corefx/blob/master/src/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.Unix/ExportProvider.cs#L75

In particular, this loop:

https://github.com/dotnet/corefx/blob/d7dd6a4b03a7c3bb03379e03ff9dbd656913cc85/src/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.Unix/ExportProvider.cs#L101-L126

Looking at the code, I think that the code is missing setting of privateCertHandle and privateCertKeyHandle, which cause it to skip the entry with the private key.

[EDIT] Add C# syntax highlighting by @karelz

[ayende]

Note that the same code on Windows generates the PFX properly

[danmoseley]

Do you want to offer a PR + test @ayende ?

[ayende]

@danmosemsft Yes, I can do that.
One thing that I wonder, there is the GC.KeepAlive call there, which is strange.
The value that is there is already kept alive because is is on _certs, no? Am I missing something?

[danmoseley]

@ayende it looks like from 1dd166f comment that it was added for consistency/defensively.

[ayende]

Okay, some of them looks legit, if the GC is really active, some are probably not relevant since the instance is holding this, I'll match this style, just in case.

[bartonjs]

Fixed by dotnet/corefx#26152.