17

I'm using IdentityServer4 and I want to load signing certificate from file. For example,

var certificate = new X509Certificate2(
        path, 
        password, 
        X509KeyStorageFlags.EphemeralKeySet);

services.AddIdentityServer()
        .AddSigningCredential(certificate)
...
certificate.Dispose();

The code above won't work when I request the token from IdentityServer. But it will work in case I remove certificate.Dispose();.

I also tried another option. I created RsaSecurityKey from certificate's private key and used it for adding signing credential. And in this case disposing will not break anything.

var rsk = new RsaSecurityKey(certificate.GetRSAPrivateKey()))

services.AddIdentityServer()
        .AddSigningCredential(rsk)
...
certificate.Dispose()

So my question is more general. Should I dispose X509Certificate2 object created from the existing certificate?


From Microsoft Docs:

Starting with the .NET Framework 4.6, this type implements the IDisposable interface. When you have finished using the type, you should dispose of it either directly or indirectly.

2 Answers 2

13

By looking at .NET Core source code, X509Certificate2 and its base class X509Certificate use class CertificatePal to deal with the certificate. The CertificatePal class supports creation of objects of the class from various sources: blob, file, certificate store. It calls Windows CryptoAPI to get a handle to the certificate when creating the object. So, after using the object, it would be necessary to free the resources pointed to by the handle. The good news is that, the handle is stored in a SafeCertContextHandle object, which is guaranteed to close the handle after garbage collector collects the X509Certificate2 object and finishes calling the finalizers of the objects. My understanding is that, we don't need to call the Dispose method manually.

1
  • 6
    I read the blog post below last night and it got me looking into this issue as well: snede.net/the-most-dangerous-constructor-in-net My code is using the constructor and never disposing or calling the Reset method. On my local machine, dev, and staging servers I did not see more than two files within the past year in the various folders that Microsoft uses to store the files for x509Certficate2 so I guess the garbage collection is cleaning it up as you said. Commented Feb 14, 2020 at 17:58
5

No, you should not dispose certificate object while the application runs, because when requested, IdentityServer will attempt to use disposed certificate object and will fail.

1
  • Yeah, that's reasonable in the first case. But with RsaSecurityKey I can dispose certificate. I wonder if I use the certificate properly, maybe there is another way.
    – qwermike
    Commented May 29, 2019 at 7:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.