public CmsRecipientCollection (SubjectIdentifierType recipientIdentifierType, X509Certificate2Collection certificates) : base () 
		{
			foreach (X509Certificate2 x509 in certificates) {
				CmsRecipient p7r = new CmsRecipient (recipientIdentifierType, x509);
				_list.Add (p7r);
			}
		}

 /// <summary>
 /// Initializes a new instance of the <see cref="X509Certificate2Collection"/> class.
 /// </summary>
 /// <param name="collection">
 /// The collection of certificates.
 /// </param>
 public void Initialize(X509Certificate2Collection collection)
 {
     foreach (var certificate in collection)
     {
         this.List.Add(certificate);
     }
 }

        private static SafeCertStoreHandle ConvertExtraStoreToSafeHandle(X509Certificate2Collection extraStore)
        {
            if (extraStore == null || extraStore.Count == 0)
                return SafeCertStoreHandle.InvalidHandle;

            return ((StorePal)StorePal.LinkFromCertificateCollection(extraStore)).SafeCertStoreHandle;
        }

 private static System.Security.Cryptography.SafeCertStoreHandle BuildDecryptorStore(X509Certificate2Collection extraStore)
 {
     X509Certificate2Collection collection = new X509Certificate2Collection();
     try
     {
         X509Store store = new X509Store("MY", StoreLocation.CurrentUser);
         store.Open(OpenFlags.IncludeArchived | OpenFlags.OpenExistingOnly);
         collection.AddRange(store.Certificates);
     }
     catch (SecurityException)
     {
     }
     try
     {
         X509Store store2 = new X509Store("MY", StoreLocation.LocalMachine);
         store2.Open(OpenFlags.IncludeArchived | OpenFlags.OpenExistingOnly);
         collection.AddRange(store2.Certificates);
     }
     catch (SecurityException)
     {
     }
     if (extraStore != null)
     {
         collection.AddRange(extraStore);
     }
     if (collection.Count == 0)
     {
         throw new CryptographicException(-2146889717);
     }
     return System.Security.Cryptography.X509Certificates.X509Utils.ExportToMemoryStore(collection);
 }

        internal static bool VerifyWithExtraRoots(
            this X509Chain chain,
            X509Certificate certificate,
            X509Certificate2Collection extraRoots)
        {
            chain.ChainPolicy.ExtraStore.AddRange(extraRoots);
            if (chain.Build(new X509Certificate2(certificate)))
                return true;
            else
            {
                // .NET returns UntrustedRoot status flag if the certificate is not in
                // the SYSTEM trust store. Check if it's the only problem with the chain.
                var onlySystemUntrusted =
                    chain.ChainStatus.Length == 1 &&
                    chain.ChainStatus[0].Status == X509ChainStatusFlags.UntrustedRoot;

                // Sanity check that indeed that is the only problem with the root
                // certificate.
                var rootCert = chain.ChainElements[chain.ChainElements.Count - 1];
                var rootOnlySystemUntrusted =
                    rootCert.ChainElementStatus.Length == 1 &&
                    rootCert.ChainElementStatus[0].Status
                    == X509ChainStatusFlags.UntrustedRoot;

                // Double check it's indeed one of the extra roots we've been given.
                var rootIsUserTrusted = extraRoots.Contains(rootCert.Certificate);

                return
                    onlySystemUntrusted && rootOnlySystemUntrusted && rootIsUserTrusted;
            }
        }

		internal static bool TrustEvaluateSsl (X509Certificate2Collection collection, object sender, X509Certificate2 certificate, X509Chain chain, SslPolicyErrors errors)
		{
			var certsRawData = new List <byte[]> (collection.Count);
			foreach (var cert in collection)
				certsRawData.Add (cert.RawData);
			return trustEvaluateSsl (certsRawData);
		}

        public sealed override byte[] Encrypt(CmsRecipientCollection recipients, ContentInfo contentInfo, AlgorithmIdentifier contentEncryptionAlgorithm, X509Certificate2Collection originatorCerts, CryptographicAttributeObjectCollection unprotectedAttributes)
        {
            using (SafeCryptMsgHandle hCryptMsg = EncodeHelpers.CreateCryptMsgHandleToEncode(recipients, contentInfo.ContentType, contentEncryptionAlgorithm, originatorCerts, unprotectedAttributes))
            {
                byte[] encodedContent;
                if (contentInfo.ContentType.Value.Equals(Oids.Pkcs7Data, StringComparison.OrdinalIgnoreCase))
                {
                    unsafe
                    {
                        byte[] content = contentInfo.Content;
                        fixed (byte* pContent = content)
                        {
                            DATA_BLOB blob = new DATA_BLOB((IntPtr)pContent, (uint)(content.Length));
                            encodedContent = Interop.Crypt32.CryptEncodeObjectToByteArray(CryptDecodeObjectStructType.X509_OCTET_STRING, &blob);
                        }
                    }
                }
                else
                {
                    encodedContent = contentInfo.Content;
                }

                if (encodedContent.Length > 0)
                {
                    if (!Interop.Crypt32.CryptMsgUpdate(hCryptMsg, encodedContent, encodedContent.Length, fFinal: true))
                        throw Marshal.GetLastWin32Error().ToCryptographicException();
                }

                byte[] encodedMessage = hCryptMsg.GetMsgParamAsByteArray(CryptMsgParamType.CMSG_CONTENT_PARAM);
                return encodedMessage;
            }
        }

 X509Certificate2 FindCertificateByCommonName(X509Certificate2Collection collection, X509Certificate2 find)
 {
     var str = GetCommonName(find);
     return (from X509Certificate2 cert in collection
             where GetCommonName(cert) == str
             select cert).FirstOrDefault();
 }

 public CertificateStore()
 {
     IntermediateCertList = new X509Certificate2Collection();
     RootCertList = new X509Certificate2Collection();
     AuthRootCertList = new X509Certificate2Collection();
     LoadStore();
 }

        public static void ImportEdgeCase()
        {
            //
            // Pfx's imported into a certificate collection propagate their "delete on Dispose" behavior to its cloned instances:
            // a subtle difference from Pfx's created using the X509Certificate2 constructor that can lead to premature or
            // double key deletion. Since EnvelopeCms.Decrypt() has no legitimate reason to clone the extraStore certs, this shouldn't
            // be a problem, but this test will verify that it isn't.
            //

            byte[] encodedMessage =
                ("3082010c06092a864886f70d010703a081fe3081fb0201003181c83081c5020100302e301a311830160603550403130f5253"
                + "414b65795472616e7366657231021031d935fb63e8cfab48a0bf7b397b67c0300d06092a864886f70d01010105000481805e"
                + "bb2d08773594be9ec5d30c0707cf339f2b982a4f0797b74d520a0c973d668a9a6ad9d28066ef36e5b5620fef67f4d79ee50c"
                + "25eb999f0c656548347d5676ac4b779f8fce2b87e6388fbe483bb0fcf78ab1f1ff29169600401fded7b2803a0bf96cc160c4"
                + "96726216e986869eed578bda652855c85604a056201538ee56b6c4302b06092a864886f70d010701301406082a864886f70d"
                + "030704083adadf63cd297a86800835edc437e31d0b70").HexToByteArray();

            EnvelopedCms ecms = new EnvelopedCms();
            ecms.Decode(encodedMessage);

            using (X509Certificate2 cert = Certificates.RSAKeyTransfer1.LoadPfxUsingCollectionImport())
            {
                X509Certificate2Collection extraStore = new X509Certificate2Collection(cert);
                ecms.Decrypt(extraStore);

                byte[] expectedContent = { 1, 2, 3 };
                ContentInfo contentInfo = ecms.ContentInfo;
                Assert.Equal<byte>(expectedContent, contentInfo.Content);
            }
        }

 void VerifyIsOrgCert(X509Certificate2Collection matches, string org)
 {
     foreach (X509Certificate2 cert in matches)
     {
         Assert.True(cert.MatchEmailNameOrName(org));
     }
 }

        static void Main(string[] args)
        {
            if (args.Length == 0)
              {
            Console.WriteLine("ERROR! Missing parameter");
            Console.WriteLine("syntax: certlimit.exe <cert-file.pfx> <password>");
            Environment.Exit(1);
              }

              int day_threshold = 30;
              string password = args[1]; // System.Environment.GetEnvironmentVariable("signtoolpassword");
              string certfile = args[0];
              X509Certificate2Collection coll = new X509Certificate2Collection();
              coll.Import(certfile, password, X509KeyStorageFlags.PersistKeySet);
              foreach (X509Certificate2 cert in coll)
              {
            Console.WriteLine("Subject: {0}", cert.Subject);
            Console.WriteLine("Issuer: {0}", cert.Issuer);
            if (cert.Subject.ToString().Contains("Rackspace"))
            {
              Console.WriteLine("Effective: {0}", cert.GetEffectiveDateString());
              Console.WriteLine("Expiration: {0}", cert.GetExpirationDateString());
              Console.WriteLine("Serial #: {0}", cert.SerialNumber.ToLower());
              int days_to_expiration = (int)((Convert.ToDateTime(cert.GetExpirationDateString()) - DateTime.Now).TotalDays);
              Console.WriteLine("Days to expiration: {0}", days_to_expiration);
              if (days_to_expiration < day_threshold)
              {
            Console.WriteLine("ERROR! Code signing cert expires in fewer than {0} days", day_threshold);
            Environment.Exit(1);
              }
            }
              }
        }

 public void AddRange(X509Certificate2Collection certificates)
 {
     if (certificates == null)
     {
         throw new ArgumentNullException("certificates");
     }
     int num = 0;
     try
     {
         X509Certificate2Enumerator enumerator = certificates.GetEnumerator();
         while (enumerator.MoveNext())
         {
             X509Certificate2 current = enumerator.Current;
             this.Add(current);
             num++;
         }
     }
     catch
     {
         for (int i = 0; i < num; i++)
         {
             this.Remove(certificates[i]);
         }
         throw;
     }
 }

        public void Execute(object parameter)
        {
            var pfx = CertificateManager.GeneratePfx(CertificateName, CertificatePassword);
            var certificate = CertificateManager.GetCertificateForBytes(pfx.GetBytes(), CertificatePassword);

            File.WriteAllBytes(Path.Combine(AppHelper.CachePath, "AzureAutomation.pfx"), pfx.GetBytes());
            File.WriteAllBytes(Path.Combine(AppHelper.CachePath, "AzureAutomation.cer"), certificate);

            var collection = new X509Certificate2Collection();
            collection.Import(Path.Combine(AppHelper.CachePath, "AzureAutomation.pfx"), CertificatePassword, X509KeyStorageFlags.PersistKeySet);

            var store = new X509Store(StoreName.My, StoreLocation.CurrentUser);
            store.Open(OpenFlags.ReadWrite);

            // Store the certificate
            foreach (var cert in collection)
                store.Add(cert);

            store.Close();

            // Delete the certificate that contains the private key - this is already imported into the cert store
            File.Delete(Path.Combine(AppHelper.CachePath, "AzureAutomation.pfx"));

            MessageBox.Show("The certificate has been generated. Please refresh the certificates list.", "Certificate", MessageBoxButton.OK);

            // Open the folder containing the certificate
            Process.Start("explorer.exe", AppHelper.CachePath);
        }

 internal static X509Certificate2Collection CreateBagOfCertificates(CmsSigner signer)
 {
     X509Certificate2Collection certificates = new X509Certificate2Collection();
     certificates.AddRange(signer.Certificates);
     if (signer.IncludeOption != X509IncludeOption.None)
     {
         if (signer.IncludeOption == X509IncludeOption.EndCertOnly)
         {
             certificates.Add(signer.Certificate);
             return certificates;
         }
         int count = 1;
         X509Chain chain = new X509Chain();
         chain.Build(signer.Certificate);
         if ((chain.ChainStatus.Length > 0) && ((chain.ChainStatus[0].Status & X509ChainStatusFlags.PartialChain) == X509ChainStatusFlags.PartialChain))
         {
             throw new CryptographicException(-2146762486);
         }
         if (signer.IncludeOption == X509IncludeOption.WholeChain)
         {
             count = chain.ChainElements.Count;
         }
         else if (chain.ChainElements.Count > 1)
         {
             count = chain.ChainElements.Count - 1;
         }
         for (int i = 0; i < count; i++)
         {
             certificates.Add(chain.ChainElements[i].Certificate);
         }
     }
     return certificates;
 }

        public static X509Certificate2 PickCertificate()
        {
            var store = new X509Store(StoreName.My, StoreLocation.CurrentUser);
            store.Open(OpenFlags.OpenExistingOnly | OpenFlags.ReadOnly);
            var collection = store.Certificates.Find(X509FindType.FindByTimeValid, DateTime.Now, false);
            var gostOnlyCollection = new X509Certificate2Collection();

            foreach ( var cert in collection.Cast<X509Certificate2>()
                        .Where(cert => cert.SignatureAlgorithm.Value.Equals("1.2.643.2.2.3")))
                gostOnlyCollection.Add(cert);

            if (gostOnlyCollection.Count == 0)
                throw new ApplicationException("Не найдено ни одной подписи соответствующей ГОСТ Р 34.11/34.10-2001. \n");

            var found = X509Certificate2UI.SelectFromCollection(
                    gostOnlyCollection,
                    "Выберите сертификат",
                    "Выбранная ЭЦП будет использована при подписании файла, и является эквивалентом собственноручной подписи либо печати организации",
                    X509SelectionFlag.SingleSelection
                );

            if (found.Count == 0)
            {
                throw new ApplicationException("Сертификат не выбран.\n");
            }

            if (found.Count > 1)
            {
                throw new ApplicationException("Найдено больше одного сертификата.\n");
            }

            return found[0];
        }

        public CmsSigner(SubjectIdentifierType signerIdentifierType, X509Certificate2 certificate)
        {
            switch (signerIdentifierType)
            {
                case SubjectIdentifierType.Unknown:
                    this.SignerIdentifierType = SubjectIdentifierType.IssuerAndSerialNumber;
                    this.IncludeOption = X509IncludeOption.ExcludeRoot;
                    break;

                case SubjectIdentifierType.IssuerAndSerialNumber:
                    this.SignerIdentifierType = signerIdentifierType;
                    this.IncludeOption = X509IncludeOption.ExcludeRoot;
                    break;

                case SubjectIdentifierType.SubjectKeyIdentifier:
                    this.SignerIdentifierType = signerIdentifierType;
                    this.IncludeOption = X509IncludeOption.ExcludeRoot;
                    break;

                case SubjectIdentifierType.NoSignature:
                    this.SignerIdentifierType = signerIdentifierType;
                    this.IncludeOption = X509IncludeOption.None;
                    break;

                default:
                    this.SignerIdentifierType = SubjectIdentifierType.IssuerAndSerialNumber;
                    this.IncludeOption = X509IncludeOption.ExcludeRoot;
                    break;
            }
            this.Certificate = certificate;
            this.DigestAlgorithm = new Oid("1.3.14.3.2.26");
            this.m_signedAttributes = new CryptographicAttributeObjectCollection();
            this.m_unsignedAttributes = new CryptographicAttributeObjectCollection();
            this.m_certificates = new X509Certificate2Collection();
        }

 internal static unsafe int BuildChain(IntPtr hChainEngine, System.Security.Cryptography.SafeCertContextHandle pCertContext, X509Certificate2Collection extraStore, OidCollection applicationPolicy, OidCollection certificatePolicy, X509RevocationMode revocationMode, X509RevocationFlag revocationFlag, DateTime verificationTime, TimeSpan timeout, ref SafeCertChainHandle ppChainContext)
 {
     if (pCertContext == null || pCertContext.IsInvalid)
         throw new ArgumentException(SecurityResources.GetResourceString("Cryptography_InvalidContextHandle"), "pCertContext");
     SafeCertStoreHandle hAdditionalStore = SafeCertStoreHandle.InvalidHandle;
     if (extraStore != null && extraStore.Count > 0)
         hAdditionalStore = X509Utils.ExportToMemoryStore(extraStore);
     CAPI.CERT_CHAIN_PARA pChainPara = new CAPI.CERT_CHAIN_PARA();
     pChainPara.cbSize = (uint)Marshal.SizeOf((object)pChainPara);
     SafeLocalAllocHandle localAllocHandle1 = SafeLocalAllocHandle.InvalidHandle;
     if (applicationPolicy != null && applicationPolicy.Count > 0)
     {
         pChainPara.RequestedUsage.dwType = 0U;
         pChainPara.RequestedUsage.Usage.cUsageIdentifier = (uint)applicationPolicy.Count;
         localAllocHandle1 = X509Utils.CopyOidsToUnmanagedMemory(applicationPolicy);
         pChainPara.RequestedUsage.Usage.rgpszUsageIdentifier = localAllocHandle1.DangerousGetHandle();
     }
     SafeLocalAllocHandle localAllocHandle2 = SafeLocalAllocHandle.InvalidHandle;
     if (certificatePolicy != null && certificatePolicy.Count > 0)
     {
         pChainPara.RequestedIssuancePolicy.dwType = 0U;
         pChainPara.RequestedIssuancePolicy.Usage.cUsageIdentifier = (uint)certificatePolicy.Count;
         localAllocHandle2 = X509Utils.CopyOidsToUnmanagedMemory(certificatePolicy);
         pChainPara.RequestedIssuancePolicy.Usage.rgpszUsageIdentifier = localAllocHandle2.DangerousGetHandle();
     }
     pChainPara.dwUrlRetrievalTimeout = (uint)timeout.Milliseconds;
     System.Runtime.InteropServices.ComTypes.FILETIME pTime = new System.Runtime.InteropServices.ComTypes.FILETIME();
     *(long*)&pTime = verificationTime.ToFileTime();
     uint dwFlags = X509Utils.MapRevocationFlags(revocationMode, revocationFlag);
     if (!CAPI.CAPISafe.CertGetCertificateChain(hChainEngine, pCertContext, ref pTime, hAdditionalStore, ref pChainPara, dwFlags, IntPtr.Zero, out ppChainContext))
         return Marshal.GetHRForLastWin32Error();
     localAllocHandle1.Dispose();
     localAllocHandle2.Dispose();
     return 0;
 }

        public static void Rc4AndCngWrappersDontMixTest()
        {
            //
            // Combination of RC4 over a CAPI certificate.
            //
            //  This works as long as the PKCS implementation opens the cert using CAPI. If he creates a CNG wrapper handle (by passing CRYPT_ACQUIRE_PREFER_NCRYPT_KEY_FLAG),
            //  the test fails with a NOTSUPPORTED crypto exception inside Decrypt(). The same happens if the key is genuinely CNG.
            //

            byte[] content = { 6, 3, 128, 33, 44 };
            AlgorithmIdentifier rc4 = new AlgorithmIdentifier(new Oid(Oids.Rc4));

            EnvelopedCms ecms = new EnvelopedCms(new ContentInfo(content), rc4);
            CmsRecipientCollection recipients = new CmsRecipientCollection(new CmsRecipient(Certificates.RSAKeyTransferCapi1.GetCertificate()));
            ecms.Encrypt(recipients);
            byte[] encodedMessage = ecms.Encode();

            ecms = new EnvelopedCms();
            ecms.Decode(encodedMessage);

            using (X509Certificate2 cert = Certificates.RSAKeyTransferCapi1.TryGetCertificateWithPrivateKey())
            {
                if (cert == null)
                    return; // Sorry - CertLoader is not configured to load certs with private keys - we've tested as much as we can.

                X509Certificate2Collection extraStore = new X509Certificate2Collection();
                extraStore.Add(cert);
                ecms.Decrypt(extraStore);
            }

            ContentInfo contentInfo = ecms.ContentInfo;
            Assert.Equal<byte>(content, contentInfo.Content);
        }

        /// <summary>
        /// Initialisiert eine neue Instanz der <see cref="ReceiverCertificates"/> Klasse.
        /// </summary>
        /// <param name="certificates">Die Empfänger-Zertifikate</param>
        public ReceiverCertificates(IReadOnlyCollection<X509Certificate2> certificates)
        {
            var receiverCertificates = new Dictionary<string, X509Certificate2>();
            var rootCertificates = new List<X509Certificate2>();
            var intermediateCertificates = new X509Certificate2Collection();
            foreach (var certificate in certificates)
            {
                var key = GetKey(certificate);
                if (key == null)
                {
                    if (certificate.SubjectName.Name == certificate.IssuerName.Name)
                    {
                        rootCertificates.Add(certificate);
                    }
                    else
                    {
                        intermediateCertificates.Add(certificate);
                    }
                }
                else
                {
                    receiverCertificates.Add(key, certificate);
                }
            }

            _rootCertificates = rootCertificates.ToArray();
            _intermediateCertificates = intermediateCertificates;
            Certificates = receiverCertificates;
        }