Certificate Issues on macOS 15 ("Sequoia")

# Certificate Issues on macOS 15 ("Sequoia")

> This is a locked mirror of dotnet/runtime#106775. See that issue for discussion.

The `CopyWithPrivateKey` methods that combine a certificate with its associated private key fail on macOS 15 when using in-memory (ephemeral) keys. This failure is most commonly seen when creating new certificates via `CertificateRequest.CreateSelfSigned` or when loading a certificate and key from a PEM file (or files) with `X509Certificate2.CreateFromPem`, which utilize the affected methods.

Callers of these methods on macOS 15 ("Sequoia") will receive a `CryptographicException`, specifically `Interop+AppleCrypto+AppleCommonCryptoCryptographicException: The specified item is no longer valid. It may have been deleted from the keychain.` The `dotnet dev-certs https` command relies on `CertificateRequest.CreateSelfSigned` and fails with this error.

This issue affects .NET 6, .NET 8, and .NET 9. The issue is addressed in the upcoming .NET 6.0.34, .NET 8.0.10, and 9.0.0-rc2 releases, scheduled for release in October 2024.

## Root Cause

macOS 15 uses a different status code to indicate a key is not in a Keychain than prior versions do.

## Workarounds

If you have not already upgraded to macOS 15 from a prior version and use .NET, you are not impacted by this issue. If you are planning to upgrade to macOS 15, the workaround is to upgrade to .NET 6.0.34. .NET 8.0.10, or .NET 9.0.0-rc2 (scheduled for October 2024) prior to upgrading to macOS 15.

Loading a certificate and its associated private key from a PKCS#12/PFX are not affected. If you are using an application that supports loading a certificate (and associated private key) by either PFX or PEM, converting your PEM contents to PFX - and updating configuration appropriately - may unblock you.