This is my scenario:

A CA signs a certificate with its private key and sends it to a client via https response. From this response the client creates a X509Certificate2 class, that represents the certificate in .NET

X509Certificate2 myCert = new X509Certificate2(certBuffer);

I also have the CA's public key to verify the signature


I am now looking for a way to check if the signature is valid. How can I do that? The X509Certificate2 class doesn't seem to provide a way to access the signature field.


X.509 certificate validation is a complex process. With .NET, you are supposed to use the X509Chain class to perform such a validation, which entails path building, verifying signatures, revocation status, and a gazillion of other things. See this answer for an example.

X509Certificate2 also has a Verify() method, but that one checks the certificate with regards to the machine defaults: the user's trust store, the user's policies... which may or may not map well to your specific case. To have full control on the process, use X509Chain.

(Extracting the signature value, and the exact byte sequence which is signed, is not overly complex if you know a bit of ASN.1/DER, but the point is that there is much more to certificate validation than mere signatures. Doing things manually is a path which I have personally walked several times, and it entails a lot of suffering. Using the implementation already provided by .NET will save you a lot of time; and that implementation is X509Chain.)

  • So did I understand correctly, that chain.Build() will among others perform a signature verification? I added the CA certificate to the chain and called Build(myCert). This method returned true and calling it with an invalid certificate returned false. Can that be prove enough?
    – PogoMips
    Oct 2 '13 at 9:42
  • Yes, that's how this class is supposed to work.
    – Tom Leek
    Oct 2 '13 at 10:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.