Can't find x509 Certificate in any store

Question

I have a webapp hosted on HostGator shared Windows hosting. Inside Plesk, I secured the site with their Let's Encrypt SSL tool which automatically installs the certificate for you on creation. I can see, on visiting the site, that the browser confirms it is secured by Let's Encrypt.

Now, on starting my app, I am trying to obtain the certificate via thumbprint, but it is coming up empty handed with the following code(note: I have tried both CurrentUser and LocalMachine with the same results):

var x509Store = new X509Store(StoreLocation.CurrentUser);

                    x509Store.Open(OpenFlags.ReadOnly);

                    var x509Certificate = x509Store.Certificates
                        .Find(
                            X509FindType.FindByThumbprint,
                            builder.Configuration["Config:AzureADCertThumbprint"],
                            validOnly: false)
                        .OfType<X509Certificate2>()
                        .Single();
                    x509Store.Close();

So, to dig a bit deeper, I used the following to log all available certs so that I could search through and see what is going on:

                    logfile.WriteLine("\r\nExists Certs Name and Location");
                    logfile.WriteLine("------ ----- -------------------------");

                    foreach (StoreLocation storeLocation in (StoreLocation[])
                        Enum.GetValues(typeof(StoreLocation)))
                    {
                        foreach (StoreName storeName in (StoreName[])
                            Enum.GetValues(typeof(StoreName)))
                        {
                            X509Store store = new X509Store(storeName, storeLocation);

                            try
                            {
                                store.Open(OpenFlags.OpenExistingOnly);

                                logfile.WriteLine("Yes    {0,4}  {1}, {2}",
                                    store.Certificates.Count, store.Name, store.Location);

                                foreach(var cert in store.Certificates)
                                {
                                    logfile.WriteLine("---"+cert.Thumbprint+" name: "+cert.Subject);
                                }
                            }
                            catch (CryptographicException)
                            {
                                logfile.WriteLine("No           {0}, {1}",
                                    store.Name, store.Location);
                            }
                        }
                        logfile.WriteLine();
                    }

I see lots of certs in the stores, and even some Let's Encrypt certs, but none of them with a matching thumbprint. To be more thorough, I used openssl, to calculate the thumbprint in sha256, sha1, and md5. None of those had matches in my logs. Note, the sha1 calculation is the thumbprint I was given on certificate creation.

At this point, I am totally stumped at what is going on and how to proceed. All help is appreciated, thanks!

Answer 1

Let's Encrypt tools such as certbot do not install SSL certificates into certificate stores nor should they.

The certificates (certificate, chain, and key) are stored as files on the file system.

The let's Encrypt root CA and intermediate CA certificates are already trusted by the OS. The root CA certificate will be in "Trusted Root Certificate Authorities" and the intermediates will be in "Intermediate Certificate Authorities" for the machine.

All that is left is the server leaf certificate and there is no need to put that into any store. The only time you might consider storing the server leaf certificate is if it is self-signed.

Certificate thumbprints can be SHA-256, SHA-1, or MD5. Make sure you are checking for the correct type. A simple method to guess the thumbprint algorithm is to compare the length. For example, MD5 is 16 bytes, SHA-1 is 20 bytes, and SHA-256 is 32 bytes.