title: Generating Certificate Policies Extension In C# Using Mono Security API
body: <p>I appreciate any advice I can on this issue it has been driving me crazy and I cannot find any documentaion. I am currently trying to generate a self-signed root certificate in C# using the mono security api that meets certain requirements (RSA 2048, SHA256, Etc). I have been successfully able to generate a certificate that meets all of these requirements but one.</p>
  
  <p>I am trying to add a CertificatePoliciesExtension these extensions are usually formatted as follows in X509 certs </p>
  
  <pre><code>[4]: ObjectId: 2.5.29.32 Criticality=false
  CertificatePolicies [
   [CertificatePolicyId: [some policy oid]
      [PolicyQualifierInfo: 
         [qualifierID: some qualifier oid
           qualifier: some ascii encoded byte stream]]]]
  </code></pre>
  
  <p>My Code Is Below:</p>
  
  <pre><code>private void GenerateRootCertMono(RSACryptoServiceProvider rsa, byte[] serialNumber, string password)
      {
           // default values
          string subject = "CN= company name";
          string issuer = "CN=company name";
          DateTime notBefore = DateTime.Now;
          DateTime notAfter = new DateTime(643445675990000000); // 12/31/2039 23:59:59Z
  
  
          X509CertificateBuilder cb = new X509CertificateBuilder(3);
          cb.SerialNumber = serialNumber;
          cb.IssuerName = issuer;
          cb.NotBefore = notBefore;
          cb.NotAfter = notAfter;
          cb.SubjectName = subject;
          cb.SubjectPublicKey = rsa;
          // extensions
          BasicConstraintsExtension bce = new BasicConstraintsExtension();
          bce.CertificateAuthority = true;
          cb.Extensions.Add(bce);
          KeyUsageExtension kue = new KeyUsageExtension();
          kue.KeyUsage = KeyUsages.digitalSignature ;
  
          KeyUsageExtension kue1 = new KeyUsageExtension();
          kue1.KeyUsage = KeyUsages.keyCertSign;
  
         //my failed attempt to generate a simple Certificate Policy Extension
         **ASN1 a = new ASN1 ();
          a.Add(ASN1Convert.FromOid("2.5.29.32"));
          a.Add(ASN1Convert.FromOid("some oid"));
          a.Add(new ASN1 (System.Text.Encoding.ASCII.GetBytes("some text")));
          CertificatePoliciesExtension pce = new CertificatePoliciesExtension(a); 
  
  
          cb.Extensions.Add(pce);
          cb.Extensions.Add(kue);
          cb.Extensions.Add(kue1);
      // signature
          cb.Hash = "SHA256";
          byte[] rawcert = cb.Sign(rsa);
          X509Certificate2 pfx = new X509Certificate2(rawcert);
          pfx.PrivateKey = rsa;
          this.PFX = pfx.Export(X509ContentType.Pkcs12, password);
          return;
    }
  </code></pre>
  
  <p>I know generating these extensions is possible because I have seen them in other certificates. Does anyone have any experience or advice? I am also flexible with the API if someone knows how to generate theses extensions using MSCAPI in C# for example that would also be an acceptable solution. Thank you in advance for any help.</p>