title: how to load password protected certificates from the X509Store?
body: <p>I am building an ACS protected Azure WCF service that will require clients to authenticate via  a certificate.</p>
  
  <p>I would like the client (and the server) to load their respective password certs from the X509Store instead of from the file system.</p>
  
  <p>I am using this code:</p>
  
  <pre><code>private static X509Certificate2 GetCertificate(string thumbprint)
  {
      var certStore = new X509Store(StoreName.My, StoreLocation.LocalMachine);
      certStore.Open(OpenFlags.ReadOnly);
  
      X509Certificate2Collection certCollection = certStore.Certificates.Find(
          X509FindType.FindByThumbprint,
          thumbprint, false);
  
      certStore.Close();
  
      if (certCollection.Count == 0)
      {
          throw new System.Security.SecurityException(string.Format(CultureInfo.InvariantCulture, "No certificate was found for thumbprint {0}", thumbprint));
      }
  
      return certCollection[0]; 
  }
  </code></pre>
  
  <p>Problem is, it's not loading the private key which it needs for authentication.  I have tried to modify the return statement to this:</p>
  
  <pre><code>return new X509Certificate2(certCollection[0].Export(X509ContentType.Pfx, "password"));
  </code></pre>
  
  <p>However, this fails with a CryptographicException "The spcecified network password is incorrect".</p>
  
  <p><strong>Edit:</strong>
  The .Export() method works properly if you don't pass the password argument in.</p>
  
  <p>Any help on this?</p>