/// <summary>
        /// Finds the cert having thumbprint supplied from store location supplied
        /// </summary>
        /// <param name="storeName"></param>
        /// <param name="storeLocation"></param>
        /// <param name="thumbprint"></param>
        /// <param name="validationRequired"></param>
        /// <returns>X509Certificate2</returns>
        public static X509Certificate2 FindCertificateByThumbprint(StoreName storeName, StoreLocation storeLocation, string thumbprint, bool validationRequired)
        {
            Guard.ArgumentNotNullOrWhiteSpace(thumbprint, nameof(thumbprint));

            var store = new X509Store(storeName, storeLocation);
            try
            {
                store.Open(OpenFlags.ReadOnly);
                var col = store.Certificates.Find(X509FindType.FindByThumbprint, thumbprint, validationRequired);
                if (col == null || col.Count == 0)
                {
                    throw new ArgumentException("certificate was not found in store");
                }

                return col[0];
            }
            finally
            {
#if NET451
                // IDisposable not implemented in NET451
                store.Close();
#else
                // Close is private in DNXCORE, but Dispose calls close internally
                store.Dispose();
#endif
            }
        }

        public X509SecurityTokenProvider(StoreLocation storeLocation, StoreName storeName, X509FindType findType, object findValue)
        {
            if (findValue == null)
            {
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("findValue");
            }

            X509CertificateStore store = new X509CertificateStore(storeName, storeLocation);
            X509Certificate2Collection certificates = null;
            try
            {
                store.Open(OpenFlags.ReadOnly);
                certificates = store.Find(findType, findValue, false);
                if (certificates.Count < 1)
                {
                    throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new SecurityTokenException(SR.GetString(SR.CannotFindCert, storeName, storeLocation, findType, findValue)));
                }
                if (certificates.Count > 1)
                {
                    throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new SecurityTokenException(SR.GetString(SR.FoundMultipleCerts, storeName, storeLocation, findType, findValue)));
                }

                this.certificate = new X509Certificate2(certificates[0]);
            }
            finally
            {
                SecurityUtils.ResetAllCertificates(certificates);
                store.Close();
            }
        }

        private static X509Certificate2 GetACertificateWithPrivateKeyInStore(StoreName storeName, StoreLocation storeLocation)
        {
            Trace.WriteLine(string.Format("Looking for certificates in store : {0}, store location : {1}", storeName, storeLocation));

            var certificateStore = new X509Store(storeName, storeLocation);
            certificateStore.Open(OpenFlags.ReadOnly);
            foreach (var certificate in certificateStore.Certificates)
            {
                if (certificate.HasPrivateKey && certificate.PublicKey.Key.KeySize == 2048)
                {
                    try
                    {
                        var key = certificate.PrivateKey;
                        Trace.WriteLine("Found a suitable certificate with a private key");
                        Trace.WriteLine(string.Format("Certificate issuer : {0}, Subject Name : {1}", certificate.Issuer, certificate.Subject));
                        return certificate;
                    }
                    catch (Exception)
                    {
                        Trace.WriteLine("Ignoring a Cryptography Next generation (CNG) cert");
                    }
                }
            }

            return null;
        }

 /// <summary>
 /// Gets a X509 specific certificate from windows store withoit asking the user.
 /// </summary>
 /// <returns></returns>
 public static X509Certificate2 GetCertificate(StoreLocation location, string subjectName)
 {
     X509Certificate2 cert = null;
     var store = new X509Store(StoreName.My, location);
     store.Open(OpenFlags.ReadOnly);
     try
     {
         X509Certificate2Collection certs = store.Certificates.Find(X509FindType.FindBySubjectName, subjectName,
                                            false);
         if (certs.Count == 1)
         {
             cert = certs[0];
         }
         else
         {
             cert = null;
         }
     }
     finally
     {
         if (store != null)
         {
             store.Close();
         }
     }
     return cert;
 }

		internal static List<string> GetStoreNamesAtLocation(StoreLocation location)
		{
			NativeMethods.CertStoreFlags certStoreFlag = NativeMethods.CertStoreFlags.CERT_SYSTEM_STORE_CURRENT_USER;
			StoreLocation storeLocation = location;
			switch (storeLocation)
			{
				case StoreLocation.CurrentUser:
				{
					certStoreFlag = NativeMethods.CertStoreFlags.CERT_SYSTEM_STORE_CURRENT_USER;
					break;
				}
				case StoreLocation.LocalMachine:
				{
					certStoreFlag = NativeMethods.CertStoreFlags.CERT_SYSTEM_STORE_LOCAL_MACHINE;
					break;
				}
			}
			NativeMethods.CertEnumSystemStoreCallBackProto certEnumSystemStoreCallBackProto = new NativeMethods.CertEnumSystemStoreCallBackProto(Crypt32Helpers.CertEnumSystemStoreCallBack);
			List<string> strs = new List<string>();
			lock (Crypt32Helpers.staticLock)
			{
				Crypt32Helpers.storeNames.Clear();
				NativeMethods.CertEnumSystemStore(certStoreFlag, IntPtr.Zero, IntPtr.Zero, certEnumSystemStoreCallBackProto);
				foreach (string storeName in Crypt32Helpers.storeNames)
				{
					strs.Add(storeName);
				}
			}
			return strs;
		}

        public void SetCertificate(StoreLocation storeLocation, StoreName storeName, X509FindType findType, object findValue)
        {
            if (findValue == null)
            {
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("findValue");
            }
            ThrowIfImmutable();
            var dotNetCertificate = SecurityUtils.GetCertificateFromStore(storeName, storeLocation, findType, findValue, null);
            IReadOnlyList<Certificate> uwpCertificates;
            try
            {
                uwpCertificates = GetCertificatesFromWinRTStore(dotNetCertificate);
            }
            catch (Exception)
            {
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(SecurityUtils.CreateCertificateLoadException(
                    storeName, storeLocation, findType, findValue, null, 0));
            }

            if (uwpCertificates.Count != 1)
            {
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(SecurityUtils.CreateCertificateLoadException(
                    storeName, storeLocation, findType, findValue, null, uwpCertificates.Count));
            }

            AttachUwpCertificate(dotNetCertificate, uwpCertificates[0]);
            _certificate = dotNetCertificate;
        }

        internal static bool TryResolveCertificate(StoreName storeName, StoreLocation storeLocation, X509FindType findType, object findValue, out X509Certificate2 certificate)
        {
            X509Store store = new X509Store(storeName, storeLocation);
            store.Open(OpenFlags.ReadOnly);

            certificate = null;
            X509Certificate2Collection certs = null;
            X509Certificate2Collection matches = null;
            try
            {
                certs = store.Certificates;
                matches = certs.Find(findType, findValue, false);

                // Throwing InvalidOperationException here, following WCF precedent. 
                // Might be worth introducing a more specific exception here.
                if (matches.Count == 1)
                {
                    certificate = new X509Certificate2(matches[0]);
                    return true;
                }
            }
            finally
            {
                CryptoHelper.ResetAllCertificates(matches);
                CryptoHelper.ResetAllCertificates(certs);
                store.Close();
            }

            return false;
        }

        private NuGetCertificate FindCert(CertificatesHub certs, StoreLocation storeLocation)
        {
            var specificMatch = certs.GetCertificateFromConfigSetting(ConfigSetting, StoreName.My, storeLocation);
            if(specificMatch != null) 
            {
                AzureHubEventSource.Log.SingleMatch(storeLocation.ToString(), specificMatch.Thumbprint, specificMatch.Subject);
                return specificMatch;
            }

            var candidates = certs
                .GetCertificatesByPurpose(CommonCertificatePurposes.AzureManagement, StoreName.My, storeLocation)
                .ToList();
            // No candidates? Return null.
            if (candidates.Count == 0)
            {
                AzureHubEventSource.Log.NoMatch(storeLocation.ToString());
                return null;
            }
            // One candidate? Return it.
            else if (candidates.Count == 1)
            {
                AzureHubEventSource.Log.SingleMatch(storeLocation.ToString(), candidates[0].Thumbprint, candidates[0].Subject);
                return candidates[0];
            }
            // Multiple candidates? Return the first one
            else
            {
                var match = candidates.FirstOrDefault();
                AzureHubEventSource.Log.MultipleMatches(storeLocation.ToString(), match.Thumbprint, match.Subject);
                return match;
            }
        }

        protected virtual X509Store GetStore(StoreName storeName, StoreLocation? storeLocation = null)
        {
            if (!storeLocation.HasValue)
                return new X509Store(storeName);

            return new X509Store(storeName, storeLocation.GetValueOrDefault());
        }

 internal X509ClientCertificateAuthentication()
 {
     this.certificateValidationMode = X509CertificateValidationMode.ChainTrust;
     this.revocationMode = X509RevocationMode.Online;
     this.trustedStoreLocation = StoreLocation.LocalMachine;
     this.includeWindowsGroups = true;
 }

        /// <summary>
        /// Searches the certificate store of the current user and returns the matching certificate.
        /// </summary>
        /// <param name="thumbprint">Thumbprint of the certificate</param>
        /// <param name="storeName">Name of the certificate store</param>
        /// <param name="storeLocation">Location of the certificate store</param>
        /// <returns>The matching certificate</returns>
        public static X509Certificate2 GetCertificate(string thumbprint, StoreName storeName, StoreLocation storeLocation)
        {
            Logger.Instance.WriteMethodEntry(EventIdentifier.ProtectedDataGetCertificate, "Thumbprint: {0}.", thumbprint);

            try
            {
                if (string.IsNullOrEmpty(thumbprint))
                {
                    throw new ArgumentNullException("thumbprint");
                }

                X509Store store = new X509Store(storeName, storeLocation);
                store.Open(OpenFlags.ReadOnly);

                X509Certificate2 certificate = store.Certificates.Cast<X509Certificate2>().FirstOrDefault(cert => cert.Thumbprint.Equals(thumbprint, StringComparison.OrdinalIgnoreCase));

                if (certificate == null)
                {
                    Logger.Instance.ReportError(new Exceptions.CryptographicException(Messages.ProtectedData_EncryptionCertificateNotFoundError, thumbprint));
                }

                return certificate;
            }
            finally
            {
                Logger.Instance.WriteMethodExit(EventIdentifier.ProtectedDataGetCertificate, "Thumbprint: {0}.", thumbprint);
            }
        }

        // Adds the given certificate to the given store unless it is
        // already present.  Returns 'true' if the certificate was added.
        private static bool AddToStoreIfNeeded(StoreName storeName, 
                                               StoreLocation storeLocation, 
                                               X509Certificate2 certificate)
        {
            X509Store store = null;
            X509Certificate2 existingCert = null;
            try
            {
                store = new X509Store(storeName, storeLocation);
                store.Open(OpenFlags.ReadWrite);
                existingCert = CertificateFromThumbprint(store, certificate.Thumbprint);
                if (existingCert == null)
                {
                    store.Add(certificate);
                    Console.WriteLine("Added to store '{0}', location '{1}', certificate '{2}'", 
                                       storeName, storeLocation, certificate.SubjectName.Name);
                }

            }
            finally
            {
                if (store != null)
                {
                    store.Close();
                }
            }

            return existingCert == null;
        }

    public static X509Certificate2Collection GetCertificates(StoreName name, StoreLocation location)
    {
        X509Store store = null;

        try
        {

            store = new X509Store(name, location);
            X509Certificate2Collection certificates = null;
            store.Open(OpenFlags.ReadOnly);


            // Every time we call store.Certificates property, a new collection will be returned.
            return store.Certificates;
        }
        finally
        {
            if (store != null)
            {
                store.Close();
            }
        }

        return null;
    }

        public X509Certificate2 GetCertificateByThumbprint(StoreLocation storeLocation, string thumbprint)
        {
            X509Store certStore = new X509Store(StoreName.My, storeLocation);
            try
            {
                try
                {
                    certStore.Open(OpenFlags.ReadOnly);
                }
                catch (Exception ex)
                {
                    var outerEx = new SecurityException(string.Format("Failed to open X509Store in '{0}'.", storeLocation.ToString()), ex);
                    throw outerEx;
                }
                

                foreach(var thisCert in certStore.Certificates)
                {
                    Console.WriteLine(thisCert.Thumbprint + "\t" + thisCert.Subject);
                }

                var certCollection = certStore.Certificates.Find(X509FindType.FindByThumbprint, thumbprint, false);
                if (certCollection == null || certCollection.Count == 0)
                {
                    throw new ArgumentException(string.Format("thumbprint '{0}' does not match any certificates in '{1}'.", thumbprint, storeLocation.ToString()));
                }
                var cert = certCollection[0];
                return cert;
            }
            finally
            {
                certStore.Close();
            }
        }

        public static X509Certificate2 GetCertificate(StoreName storeName, StoreLocation storeLocation, string thumbprint)
        {
            var certificateStore = new X509Store(storeName, storeLocation);
            try
            {
                certificateStore.Open(OpenFlags.ReadOnly);

                var certificates = certificateStore.Certificates.Find(X509FindType.FindByThumbprint, thumbprint, false);
                if (certificates.Count == 1)
                {
                    return certificates[0];
                }

                if (certificates.Count > 1)
                {
                    const string format = "{0} matching the thumbprint {1} were found.";
                    var message = String.Format(format, certificates.Count, thumbprint);
                    throw new InvalidOperationException(message);
                }
            }
            finally
            {
                certificateStore.Close();
            }

            return null;
        }

        public static X509Certificate2 GetCertificate(StoreName storeName, StoreLocation storeLocation, string subjectName) {
            X509Store store = new X509Store(storeName, storeLocation);
            X509Certificate2Collection certificates = null;
            store.Open(OpenFlags.ReadOnly);
            try {
                X509Certificate2 result = null;
                //
                // Every time we call store.Certificates property, a new collection will be returned.
                //
                certificates = store.Certificates;
                for (int i = 0; i < certificates.Count; i++) {
                    X509Certificate2 cert = certificates[i];

                    if (cert.SubjectName.Name.ToLower() == subjectName.ToLower()) {
                        if (result != null)
                            throw new ApplicationException(string.Format("There are multiple certificate for subject Name {0}", subjectName));

                        result = new X509Certificate2(cert);
                    }
                }
                if (result == null) {
                    throw new ApplicationException(string.Format("No certificate was found for subject Name {0}", subjectName));
                }
                return result;
            } finally {
                if (certificates != null) {
                    for (int i = 0; i < certificates.Count; i++) {
                        X509Certificate2 cert = certificates[i];
                        cert.Reset();
                    }
                }
                store.Close();
            }
        }

 /// <summary>
 /// Private Utility method to get a certificate from a given store
 /// </summary>
 /// <param name="storeName">Name of certificate store (e.g. My, TrustedPeople)</param>
 /// <param name="storeLocation">Location of certificate store (e.g. LocalMachine, CurrentUser)</param>
 /// <param name="subjectDistinguishedName">The Subject Distinguished Name of the certificate</param>
 /// <returns>The specified X509 certificate</returns>
 static X509Certificate2 LookupCertificate( StoreName storeName, StoreLocation storeLocation, string subjectDistinguishedName )
 {
     X509Store store = null;
     X509Certificate2Collection certs = null;
     X509Certificate2 certificate = null;
     try
     {
         store = new X509Store( storeName, storeLocation );
         store.Open( OpenFlags.ReadOnly );
         certs = store.Certificates.Find( X509FindType.FindBySubjectDistinguishedName,
                                                                    subjectDistinguishedName, false );
         if ( certs.Count != 1 )
         {
             throw new X509HelperException( String.Format( "FedUtil: Certificate {0} not found or more than one certificate found", subjectDistinguishedName ) );
         }
         certificate = new X509Certificate2( certs[0] );
         return certificate;
     }
     finally
     {
         if ( certs != null )
         {
             for ( int i = 0; i < certs.Count; ++i )
             {
                 certs[i].Reset();
             }
         }
         if ( store != null ) store.Close();
     }
 }

        public X509Store (StoreName storeName, StoreLocation storeLocation) {
            if (storeLocation != StoreLocation.CurrentUser && storeLocation != StoreLocation.LocalMachine)
                throw new ArgumentException(String.Format(CultureInfo.CurrentCulture, SR.GetString(SR.Arg_EnumIllegalVal), "storeLocation"));

            switch (storeName) {
            case StoreName.AddressBook:
                m_storeName = "AddressBook";
                break;
            case StoreName.AuthRoot:
                m_storeName = "AuthRoot";
                break;
            case StoreName.CertificateAuthority:
                m_storeName = "CA";
                break;
            case StoreName.Disallowed:
                m_storeName = "Disallowed";
                break;
            case StoreName.My:
                m_storeName = "My";
                break;
            case StoreName.Root:
                m_storeName = "Root";
                break;
            case StoreName.TrustedPeople:
                m_storeName = "TrustedPeople";
                break;
            case StoreName.TrustedPublisher:
                m_storeName = "TrustedPublisher";
                break;
            default:
                throw new ArgumentException(String.Format(CultureInfo.CurrentCulture, SR.GetString(SR.Arg_EnumIllegalVal), "storeName"));
            }

            m_location = storeLocation;
        }

        public static X509Certificate2 FindCertificateBy(string thumbprint, StoreName storeName, StoreLocation storeLocation, PhysicalServer server, DeploymentResult result)
        {
            if (string.IsNullOrEmpty(thumbprint)) return null;

            var certstore = new X509Store(storeName, storeLocation);

            try
            {
                certstore.Open(OpenFlags.ReadOnly);

                thumbprint = thumbprint.Trim();
                thumbprint = thumbprint.Replace(" ", "");

                foreach (var cert in certstore.Certificates)
                {
                    if (string.Equals(cert.Thumbprint, thumbprint, StringComparison.OrdinalIgnoreCase) || string.Equals(cert.Thumbprint, thumbprint, StringComparison.InvariantCultureIgnoreCase))
                    {
                        return cert;
                    }
                }

                result.AddError("Could not find a certificate with thumbprint '{0}' on '{1}'".FormatWith(thumbprint, server.Name));
                return null;
            }
            finally
            {
                certstore.Close();
            }
        }

        /// <summary>
        /// Checks for the certificate in the certificate store.  Loads it from a resource if it does not exist.
        /// </summary>
        public static X509Certificate2 Find(StoreName storeName, StoreLocation storeLocation, string subjectName)
        {
            X509Certificate2 certificate = null;

            // look for the the private key in the personal store.
            X509Store store = new X509Store(storeName, storeLocation);
            store.Open(OpenFlags.ReadWrite);

            try
            {
                X509Certificate2Collection hits = store.Certificates.Find(X509FindType.FindBySubjectName, subjectName, false);

                if (hits.Count == 0)
                {
                    return null;
                }

                certificate = hits[0];
            }
            finally
            {
                store.Close();
            }

            return certificate;
        }