public static X509Certificate2 GetCertificate(StoreName storeName, StoreLocation storeLocation, string subjectName) {
            X509Store store = new X509Store(storeName, storeLocation);
            X509Certificate2Collection certificates = null;
            store.Open(OpenFlags.ReadOnly);
            try {
                X509Certificate2 result = null;
                //
                // Every time we call store.Certificates property, a new collection will be returned.
                //
                certificates = store.Certificates;
                for (int i = 0; i < certificates.Count; i++) {
                    X509Certificate2 cert = certificates[i];

                    if (cert.SubjectName.Name.ToLower() == subjectName.ToLower()) {
                        if (result != null)
                            throw new ApplicationException(string.Format("There are multiple certificate for subject Name {0}", subjectName));

                        result = new X509Certificate2(cert);
                    }
                }
                if (result == null) {
                    throw new ApplicationException(string.Format("No certificate was found for subject Name {0}", subjectName));
                }
                return result;
            } finally {
                if (certificates != null) {
                    for (int i = 0; i < certificates.Count; i++) {
                        X509Certificate2 cert = certificates[i];
                        cert.Reset();
                    }
                }
                store.Close();
            }
        }

        public X509Store (StoreName storeName, StoreLocation storeLocation) {
            if (storeLocation != StoreLocation.CurrentUser && storeLocation != StoreLocation.LocalMachine)
                throw new ArgumentException(String.Format(CultureInfo.CurrentCulture, SR.GetString(SR.Arg_EnumIllegalVal), "storeLocation"));

            switch (storeName) {
            case StoreName.AddressBook:
                m_storeName = "AddressBook";
                break;
            case StoreName.AuthRoot:
                m_storeName = "AuthRoot";
                break;
            case StoreName.CertificateAuthority:
                m_storeName = "CA";
                break;
            case StoreName.Disallowed:
                m_storeName = "Disallowed";
                break;
            case StoreName.My:
                m_storeName = "My";
                break;
            case StoreName.Root:
                m_storeName = "Root";
                break;
            case StoreName.TrustedPeople:
                m_storeName = "TrustedPeople";
                break;
            case StoreName.TrustedPublisher:
                m_storeName = "TrustedPublisher";
                break;
            default:
                throw new ArgumentException(String.Format(CultureInfo.CurrentCulture, SR.GetString(SR.Arg_EnumIllegalVal), "storeName"));
            }

            m_location = storeLocation;
        }

        /// <summary>
        /// Adds a certificate to a cert store in the local machine.
        /// </summary>
        /// <param name="certificate">The file path to find the certificate file.</param>
        /// <param name="storeName">Name of the certificate store.</param>
        /// <param name="storeLocation">Location of the certificate store.</param>
        public static void AddCertificate(X509Certificate2 certificate, StoreName storeName, StoreLocation storeLocation)
        {
            X509Store store = null;

            try
            {
                store = new X509Store(storeName, storeLocation);
                store.Open(OpenFlags.ReadOnly | OpenFlags.ReadWrite);

                var certificates = from cert in store.Certificates.OfType<X509Certificate2>()
                                   where cert.Thumbprint == certificate.Thumbprint
                                   select cert;

                if (certificates.FirstOrDefault() == null)
                {
                    store.Add(certificate);
                    Console.WriteLine(string.Format("Added certificate with thumbprint {0} to store '{1}', has private key: {2}.", certificate.Thumbprint, storeName.ToString(), certificate.HasPrivateKey));

                    store.Close();
                    store = null;
                }
            }
            catch (Exception ex)
            {
                throw new Exception(String.Format("AddCert exception storeName={0} storeLocation={1}", storeName.ToString(), storeLocation.ToString()), ex);
            }
            finally
            {
                if (store != null)
                {
                    store.Close();
                }
            }
        }

        protected virtual X509Store GetStore(StoreName storeName, StoreLocation? storeLocation = null)
        {
            if (!storeLocation.HasValue)
                return new X509Store(storeName);

            return new X509Store(storeName, storeLocation.GetValueOrDefault());
        }

 /// <summary>
 /// Private Utility method to get a certificate from a given store
 /// </summary>
 /// <param name="storeName">Name of certificate store (e.g. My, TrustedPeople)</param>
 /// <param name="storeLocation">Location of certificate store (e.g. LocalMachine, CurrentUser)</param>
 /// <param name="subjectDistinguishedName">The Subject Distinguished Name of the certificate</param>
 /// <returns>The specified X509 certificate</returns>
 static X509Certificate2 LookupCertificate( StoreName storeName, StoreLocation storeLocation, string subjectDistinguishedName )
 {
     X509Store store = null;
     X509Certificate2Collection certs = null;
     X509Certificate2 certificate = null;
     try
     {
         store = new X509Store( storeName, storeLocation );
         store.Open( OpenFlags.ReadOnly );
         certs = store.Certificates.Find( X509FindType.FindBySubjectDistinguishedName,
                                                                    subjectDistinguishedName, false );
         if ( certs.Count != 1 )
         {
             throw new X509HelperException( String.Format( "FedUtil: Certificate {0} not found or more than one certificate found", subjectDistinguishedName ) );
         }
         certificate = new X509Certificate2( certs[0] );
         return certificate;
     }
     finally
     {
         if ( certs != null )
         {
             for ( int i = 0; i < certs.Count; ++i )
             {
                 certs[i].Reset();
             }
         }
         if ( store != null ) store.Close();
     }
 }

        public static X509Certificate2 FindCertificateBy(string thumbprint, StoreName storeName, StoreLocation storeLocation, PhysicalServer server, DeploymentResult result)
        {
            if (string.IsNullOrEmpty(thumbprint)) return null;

            var certstore = new X509Store(storeName, storeLocation);

            try
            {
                certstore.Open(OpenFlags.ReadOnly);

                thumbprint = thumbprint.Trim();
                thumbprint = thumbprint.Replace(" ", "");

                foreach (var cert in certstore.Certificates)
                {
                    if (string.Equals(cert.Thumbprint, thumbprint, StringComparison.OrdinalIgnoreCase) || string.Equals(cert.Thumbprint, thumbprint, StringComparison.InvariantCultureIgnoreCase))
                    {
                        return cert;
                    }
                }

                result.AddError("Could not find a certificate with thumbprint '{0}' on '{1}'".FormatWith(thumbprint, server.Name));
                return null;
            }
            finally
            {
                certstore.Close();
            }
        }

        /// <summary>
        /// Finds the cert having thumbprint supplied from store location supplied
        /// </summary>
        /// <param name="storeName"></param>
        /// <param name="storeLocation"></param>
        /// <param name="thumbprint"></param>
        /// <param name="validationRequired"></param>
        /// <returns>X509Certificate2</returns>
        public static X509Certificate2 FindCertificateByThumbprint(StoreName storeName, StoreLocation storeLocation, string thumbprint, bool validationRequired)
        {
            Guard.ArgumentNotNullOrWhiteSpace(thumbprint, nameof(thumbprint));

            var store = new X509Store(storeName, storeLocation);
            try
            {
                store.Open(OpenFlags.ReadOnly);
                var col = store.Certificates.Find(X509FindType.FindByThumbprint, thumbprint, validationRequired);
                if (col == null || col.Count == 0)
                {
                    throw new ArgumentException("certificate was not found in store");
                }

                return col[0];
            }
            finally
            {
#if NET451
                // IDisposable not implemented in NET451
                store.Close();
#else
                // Close is private in DNXCORE, but Dispose calls close internally
                store.Dispose();
#endif
            }
        }

        // Adds the given certificate to the given store unless it is
        // already present.  Returns 'true' if the certificate was added.
        private static bool AddToStoreIfNeeded(StoreName storeName,
                                               StoreLocation storeLocation,
                                               X509Certificate2 certificate)
        {
            X509Store store = null;
            X509Certificate2 existingCert = null;
            try
            {
                store = new X509Store(storeName, storeLocation);

                // We assume Bridge is running elevated
                store.Open(OpenFlags.ReadWrite);
                existingCert = CertificateFromThumbprint(store, certificate.Thumbprint);
                if (existingCert == null)
                {
                    store.Add(certificate);
                    Trace.WriteLine(string.Format("[CertificateManager] Added certificate to store: "));
                    Trace.WriteLine(string.Format("    {0} = {1}", "StoreName", storeName));
                    Trace.WriteLine(string.Format("    {0} = {1}", "StoreLocation", storeLocation));
                    Trace.WriteLine(string.Format("    {0} = {1}", "CN", certificate.SubjectName.Name));
                    Trace.WriteLine(string.Format("    {0} = {1}", "HasPrivateKey", certificate.HasPrivateKey));
                    Trace.WriteLine(string.Format("    {0} = {1}", "Thumbprint", certificate.Thumbprint));
                }

            }
            finally
            {
                if (store != null)
                {
                    store.Close();
                }
            }

            return existingCert == null;
        }

        private void UninstallCertificate(StoreName storeName, StoreLocation storeLocation)
        {
            Trace.TraceInformation("Removing store object for '{1}', '{0}'.", storeName, storeLocation);
            var store = new X509Store(storeName, storeLocation);
            store.Open(OpenFlags.ReadWrite);
            try
            {
                X509Certificate2Collection result = store.Certificates.Find(
                    X509FindType.FindByThumbprint, _cert.Thumbprint, false);

                if (result.Count > 0)
                {
                    store.Remove(_cert);
                    Trace.TraceInformation("Certificate successfully removed from the store.");
                }
                else
                {
                    Trace.TraceWarning("Certificate with thumbprint '{0}', name '{1}' not found in store.",
                        _cert.Thumbprint, _cert.Subject);
                }
            }
            finally
            {
                store.Close();
            }
        }

        private static X509Certificate2 FindCertificate(string name) {
            var stores = new StoreName[] { StoreName.Root, StoreName.AuthRoot, StoreName.CertificateAuthority, StoreName.My };
            foreach (StoreName storeName in stores) {
                using (var store = new X509Store(storeName, StoreLocation.LocalMachine)) {
                    try {
                        store.Open(OpenFlags.OpenExistingOnly);
                    } catch(CryptographicException) {
                        // Not all stores may be present
                        continue;
                    }

                    try {
                        var collection = store.Certificates.Cast<X509Certificate2>();
                        var cert = collection.FirstOrDefault(c => c.FriendlyName.EqualsIgnoreCase(name));
                        if (cert == null) {
                            cert = collection.FirstOrDefault(c => c.Subject.EqualsIgnoreCase(name));
                            if (cert != null) {
                                return cert;
                            }
                        }
                    } finally {
                        store.Close();
                    }
                }
            }
            return null;
        }

    private static void ValidateCertificate(X509Certificate2 certificate, StoreName storeName, StoreLocation storeLocation)
    {
        Assert.True(certificate != null, "Certificate is null");

        DateTime now = DateTime.Now;
        Assert.True(now > certificate.NotBefore,
                   String.Format("The current date {{0}} is earlier than NotBefore ({1})",
                                 now,
                                 certificate.NotBefore));

        Assert.True(now < certificate.NotAfter,
           String.Format("The current date {{0}} is later than NotAfter ({1})",
                         now,
                         certificate.NotAfter));

        using (X509Store store = new X509Store(storeName, storeLocation))
        {
            store.Open(OpenFlags.ReadOnly);
            X509Certificate2Collection certificates = store.Certificates.Find(X509FindType.FindByThumbprint, certificate.Thumbprint, validOnly: true);
            Assert.True(certificates.Count == 1,
                        String.Format("Did not find valid certificate with thumbprint {0} in StoreName '{1}', StoreLocation '{2}'",
                                      certificate.Thumbprint,
                                      storeName,
                                      storeLocation));
        }

        using (X509Store store = new X509Store(StoreName.Disallowed, storeLocation))
        {
            store.Open(OpenFlags.ReadOnly);
            X509Certificate2Collection certificates = store.Certificates.Find(X509FindType.FindByThumbprint, certificate.Thumbprint, validOnly: false);
            Assert.True(certificates.Count == 0, "Certificate was found in Disallowed store.");
        }
    }

        public static X509Certificate2 Load(StoreName name, StoreLocation location, X509FindType type, string findValue)
        {
            if (string.IsNullOrWhiteSpace(findValue))
                throw new ArgumentNullException("findValue");
            
            var store = new X509Store(name, location);
            store.Open(OpenFlags.ReadOnly);
            try
            {
                var certificates = store.Certificates.Find(type, findValue, false);

                if (certificates.Count != 1)
                {
                    throw new InvalidOperationException(
                        string.Format(CultureInfo.InvariantCulture,
                        "Finding certificate with [StoreName:{0}, StoreLocation:{1}, X509FindType: {2}, FindValue: {3}] matched {4} certificates. A unique match is required.",
                        name, location, type, findValue, certificates.Count));
                }

                return certificates[0];
            }
            finally
            {
                store.Close();
            }
        }

        /// <summary>
        /// Find a certificate with the given common name. This is an imprecise search method, as multiple certificates may have the same name. 
        /// Returns the first certificate found matching the specified name. 
        /// </summary>
        /// <param name="storeLocation">The CertificateStore to search. Some stores require admin access</param>
        /// <param name="storeName">The StoreName to search under. Generally "My" is the correct one to use</param>
        /// <param name="requirePrivateKey">Only return certificates with a PrivateKey embedded</param>
        /// <returns></returns>
        public static X509Certificate2 GetCertificateByCommonName(string commonName, StoreLocation storeLocation = StoreLocation.LocalMachine, StoreName storeName = StoreName.My, bool requirePrivateKey = false)
        {
            if (string.IsNullOrEmpty(commonName))
            {
                throw new ArgumentNullException("commonName");
            }

            //commonName = commonName.Replace(" ", "").ToUpperInvariant();

            X509Store store = new X509Store(storeName, storeLocation);

            try
            {
                store.Open(OpenFlags.OpenExistingOnly | OpenFlags.ReadOnly);

                X509Certificate2Collection foundCerts = store.Certificates.Find(X509FindType.FindBySubjectName, commonName, false);
                foreach (var cert in foundCerts)
                {
                    if (!requirePrivateKey || cert.HasPrivateKey)
                    {
                        return cert;
                    }
                }
            }
            finally
            {
                store.Close();
            }

            return null;
        }

        /// <summary>
        /// Create a new resolver that is backed by the specified X509Store. Key Identifiers
        /// are expected to be thumbprints of X509 certificates in the store.
        /// </summary>
        public CertificateStoreKeyResolver( StoreName storeName, StoreLocation storeLocation )
        {
            _store = new X509Store( storeName, storeLocation );

            // The store is held open throughout the lifetime of the resolver
            _store.Open( OpenFlags.ReadOnly );
        }

        private static IEnumerable<Certificate> GetCertificates(StoreName StoreName, string StoreDescription)
        {
            var store = new X509Store(StoreName, StoreLocation.LocalMachine);
            store.Open(OpenFlags.ReadOnly);
            try
            {
                foreach (var certificate in store.Certificates)
                {
                    yield return new Certificate()
                    {
                        Store = StoreDescription,
                        SubjectName = certificate.SubjectName.Name,
                        Thumbprint = certificate.Thumbprint,
                        FriendlyName = certificate.FriendlyName,
                        DnsName = certificate.GetNameInfo(X509NameType.DnsName, false),
                        Version = certificate.Version,
                        SignatureAlgorithm = certificate.SignatureAlgorithm.FriendlyName,
                        Issuer = certificate.IssuerName.Name,
                        NotAfter = certificate.NotAfter,
                        NotBefore = certificate.NotBefore,
                        HasPrivateKey = certificate.HasPrivateKey
                    };
                }
            }
            finally
            {
                store.Close();
            }

        }

        /// <summary>
        /// Checks for the certificate in the certificate store.  Loads it from a resource if it does not exist.
        /// </summary>
        public static X509Certificate2 InitializeCertificate(StoreName storeName, StoreLocation storeLocation, string subjectName)
        {
            // find matching certificate.
            X509Certificate2 certificate = Find(storeName, storeLocation, subjectName);

            // put a copy in the trusted people store because that is the default location used by WCF to determine trust.
            X509Store store = new X509Store(StoreName.TrustedPeople, StoreLocation.CurrentUser);
            store.Open(OpenFlags.ReadWrite);

            try
            {
                X509Certificate2Collection hits = store.Certificates.Find(X509FindType.FindByThumbprint, certificate.Thumbprint, false);

                if (hits.Count == 0)
                {
                    // copy the certificate to ensure the private key is not placed in the trusted people store.
                    store.Add(new X509Certificate2(certificate.GetRawCertData()));
                }
            }
            finally
            {
                store.Close();
            }

            return certificate;
        }

    public static X509Certificate2Collection GetCertificates(StoreName name, StoreLocation location)
    {
        X509Store store = null;

        try
        {

            store = new X509Store(name, location);
            X509Certificate2Collection certificates = null;
            store.Open(OpenFlags.ReadOnly);


            // Every time we call store.Certificates property, a new collection will be returned.
            return store.Certificates;
        }
        finally
        {
            if (store != null)
            {
                store.Close();
            }
        }

        return null;
    }

        public static X509Certificate2 GetCertificate(StoreName storeName, StoreLocation storeLocation, string thumbprint)
        {
            var certificateStore = new X509Store(storeName, storeLocation);
            try
            {
                certificateStore.Open(OpenFlags.ReadOnly);

                var certificates = certificateStore.Certificates.Find(X509FindType.FindByThumbprint, thumbprint, false);
                if (certificates.Count == 1)
                {
                    return certificates[0];
                }

                if (certificates.Count > 1)
                {
                    const string format = "{0} matching the thumbprint {1} were found.";
                    var message = String.Format(format, certificates.Count, thumbprint);
                    throw new InvalidOperationException(message);
                }
            }
            finally
            {
                certificateStore.Close();
            }

            return null;
        }

        // Adds the given certificate to the given store unless it is
        // already present.  Returns 'true' if the certificate was added.
        private static bool AddToStoreIfNeeded(StoreName storeName, 
                                               StoreLocation storeLocation, 
                                               X509Certificate2 certificate)
        {
            X509Store store = null;
            X509Certificate2 existingCert = null;
            try
            {
                store = new X509Store(storeName, storeLocation);
                store.Open(OpenFlags.ReadWrite);
                existingCert = CertificateFromThumbprint(store, certificate.Thumbprint);
                if (existingCert == null)
                {
                    store.Add(certificate);
                    Console.WriteLine("Added to store '{0}', location '{1}', certificate '{2}'", 
                                       storeName, storeLocation, certificate.SubjectName.Name);
                }

            }
            finally
            {
                if (store != null)
                {
                    store.Close();
                }
            }

            return existingCert == null;
        }

        public void SetCertificate(StoreLocation storeLocation, StoreName storeName, X509FindType findType, object findValue)
        {
            if (findValue == null)
            {
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("findValue");
            }
            ThrowIfImmutable();
            var dotNetCertificate = SecurityUtils.GetCertificateFromStore(storeName, storeLocation, findType, findValue, null);
            IReadOnlyList<Certificate> uwpCertificates;
            try
            {
                uwpCertificates = GetCertificatesFromWinRTStore(dotNetCertificate);
            }
            catch (Exception)
            {
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(SecurityUtils.CreateCertificateLoadException(
                    storeName, storeLocation, findType, findValue, null, 0));
            }

            if (uwpCertificates.Count != 1)
            {
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(SecurityUtils.CreateCertificateLoadException(
                    storeName, storeLocation, findType, findValue, null, uwpCertificates.Count));
            }

            AttachUwpCertificate(dotNetCertificate, uwpCertificates[0]);
            _certificate = dotNetCertificate;
        }