{"record":{"id":"c74f1ed36a70056b","repo":"dotnet/wpf","slug":"sr-certificatekeytypenotsupported","errorCode":null,"errorMessage":"SR.CertificateKeyTypeNotSupported","messagePattern":"SR\\.CertificateKeyTypeNotSupported","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlDigitalSignatureProcessor.cs","lineNumber":1080,"sourceCode":"        private KeyInfo GenerateKeyInfo(AsymmetricAlgorithm key, X509Certificate2 signer)\n        {\n            // KeyInfo section\n            KeyInfo keyInfo = new KeyInfo();\n            KeyInfoName keyInfoName = new KeyInfoName\n            {\n                Value = signer.Subject\n            };\n            keyInfo.AddClause(keyInfoName);               // human readable Principal name\n\n            // Include the public key information (if we are familiar with the algorithm type)\n            if (key is RSA)\n                keyInfo.AddClause(new RSAKeyValue((RSA)key));    // RSA key parameters\n            else\n            {\n                if (key is DSA)\n                    keyInfo.AddClause(new DSAKeyValue((DSA)key));    // DSA\n                else\n                    throw new ArgumentException(SR.CertificateKeyTypeNotSupported, nameof(signer));\n            }\n\n            // the actual X509 cert\n            keyInfo.AddClause(new KeyInfoX509Data(signer));\n\n            return keyInfo;\n        }\n\n        private DataObject GenerateObjectTag(\n                HashAlgorithm hashAlgorithm,\n                IEnumerable<Uri> parts, IEnumerable<System.IO.Packaging.PackageRelationshipSelector> relationshipSelectors,\n                String signatureId)\n        {\n            XmlDocument xDoc = new XmlDocument();\n            xDoc.AppendChild(xDoc.CreateNode(XmlNodeType.Element, \"root\", \"namespace\")); // dummy root\n            xDoc.DocumentElement.AppendChild(XmlSignatureManifest.GenerateManifest(_manager, xDoc, hashAlgorithm, parts, relationshipSelectors));\n            xDoc.DocumentElement.AppendChild(XmlSignatureProperties.AssembleSignatureProperties(xDoc, DateTime.Now, _manager.TimeFormat, signatureId));\n","sourceCodeStart":1062,"sourceCodeEnd":1098,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlDigitalSignatureProcessor.cs#L1062-L1098","documentation":"GenerateKeyInfo builds the KeyInfo section for a new signature and supports only RSA and DSA asymmetric keys. If the supplied key is neither, ArgumentException(SR.CertificateKeyTypeNotSupported) is thrown, because the signer certificate's private key algorithm cannot be represented as KeyInfo key values.","triggerScenarios":"Calling PackageDigitalSignatureManager.Sign with a certificate whose private key is not RSA or DSA — e.g. ECDSA (EC) or other modern algorithm certificates on newer Windows/SmartCard/HSM stores.","commonSituations":"Using a PFX or store certificate with an EC private key; hardware tokens issuing ECC keys; .NET Core/5+ environments where ECDSA certificates are common but this WPF path only handles RSA/DSA.","solutions":["Sign with a certificate whose private key is RSA (or DSA); issue or export an RSA-based certificate from your CA.","Check the key algorithm before signing: cert.GetKeyAlgorithm() / key is RSA.","Use an alternative signing stack (e.g. .NET's SignXml with supported providers or an OPC-compliant third-party signer) that supports the key type.","If the certificate lives on a smart card, re-issue it as RSA for use with WPF packaging signatures."],"exampleFix":"// before: ECDSA cert fails\nX509Certificate2 cert = GetEcdsaCert();\ndsm.Sign(toSign, cert); // throws\n// after: ensure RSA\nif (cert.GetKeyAlgorithm() != \"1.2.840.113549.1.1.1\") // RSA OID\n    cert = GetRsaCert();\ndsm.Sign(toSign, cert);","handlingStrategy":"type-guard","validationCode":"// Guard before Sign\nstatic bool IsSupportedSigner(X509Certificate2 cert) =>\n    cert != null && cert.HasPrivateKey &&\n    (cert.PrivateKey is RSA || cert.PrivateKey is DSA);\n// or: cert.GetKeyAlgorithm() == \"1.2.840.113549.1.1.1\" (RSA)","typeGuard":"static bool IsRsaOrDsa(X509Certificate2 c) =>\n    c?.PrivateKey is RSA || c?.PrivateKey is DSA;","tryCatchPattern":"try { dsm.Sign(toSign, cert); }\ncatch (ArgumentException ex) when (ex.ParamName == \"signer\")\n{ /* unsupported key algorithm — provision an RSA certificate */ }","preventionTips":["Provision RSA certificates for package signing.","Check cert.GetKeyAlgorithm() before signing.","Avoid ECDSA certs with the WPF packaging signer.","Document the RSA/DSA restriction for PKI teams."],"tags":["wpf","cryptography","certificate","rsa","ecdsa"],"backgroundTag":"unsupported-operation","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-21T21:30:21.729Z"}