CertSetCertificateContextProperty returning true but no changes in the certificate - com-interop

Question

so I have an issue now with Windows Certificates. I have a list of certificates (identified by SerialNumber/Thumbprint) for which I have to set EnhancedKeyUsage
So what I would like to happen is for a certificate:
From code to "Enable only for following purposes" and only "Client Authentication" to be selected, basically I would like to set a specific certificate as client auth certificate.
So the end-result should be :
Now from what I've read only ( information is very limited) I found that I should use CertSetCertificateContextProperty from Crypt32.dll.
My code looks like this:
public async Task<bool> SetAuthKeyUsageExtension(string certThumbprint)
{
//open certificate store for Read/Write
using X509Store store = new X509Store(StoreName.My, StoreLocation.CurrentUser);
store.Open(OpenFlags.ReadWrite);
//find certificate
var certificate = FindCertificate(certThumbprint, store);
if (certificate != null)
{
//set EKU for Client Auth
SetKeyExtangeUsage(certificate);
return true;
}
return false;
}
private X509Certificate2 FindCertificate(string thumbPrint, X509Store store)
{
X509Certificate2Collection foundX509Certificates = store.Certificates.Find(X509FindType.FindByThumbprint, thumbPrint, false);
if (foundX509Certificates != null || foundX509Certificates.Count > 0)
{
return foundX509Certificates.FirstOrDefault();
}
return null;
}
My native class looks like this:
[DllImport("Crypt32.dll", CharSet = CharSet.Auto, SetLastError = true)]
internal static extern Boolean CertSetCertificateContextProperty(
[In] IntPtr pCertContext,
[In] UInt32 dwPropId,
[In] UInt32 dwFlags,
[In] IntPtr pvData);
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct CRYPT_OBJID_BLOB
{
public uint cbData;
public IntPtr pbData;
}
private const string OID_PKIX_KP_CLIENT_AUTH = "1.3.6.1.5.5.7.3.2";
private const int CERT_ENHKEY_USAGE_PROP_ID = 9;
public static bool SetKeyExtangeUsage(X509Certificate2 cert)
{
//Create a new Oid collection
OidCollection oids = new OidCollection();
//add to collection
oids.Add(new Oid
{
Value = OID_PKIX_KP_CLIENT_AUTH
});
X509EnhancedKeyUsageExtension eku = new X509EnhancedKeyUsageExtension(oids, true);
//pbData
var pbData = Marshal.AllocHGlobal(eku.RawData.Length);
CRYPT_OBJID_BLOB objID = new CRYPT_OBJID_BLOB();
IntPtr pvData = Marshal.AllocHGlobal(Marshal.SizeOf(objID));
objID.pbData = pbData;
objID.cbData = (uint)eku.RawData.Length;
Marshal.StructureToPtr(objID, pvData, false);
// var result = CertSetCertificateContextProperty(cert.Handle, CERT_ENHKEY_USAGE_PROP_ID, 0, objID.pbData);
var result = CertSetCertificateContextProperty(cert.Handle, CERT_ENHKEY_USAGE_PROP_ID, 0, pvData);
Marshal.FreeHGlobal(objID.pbData);
Marshal.FreeHGlobal(pvData);
return true;
}
This code "works" in terms that it does not break or throw any errors, but when I check the certificate using the UI, no Extended Key Usage are changed, basically it looks like I did nothing. I am sure I am missing something, but I have very few experience with X509Certificate2 and also Interop so I am guessing that somewhere in SetKeyExtangeUsage I am missing something. 5
I used this How to set certificate purposes? as reference, but there is no working code there, only steps, which I think I followed.
Any ideas, what I am missing?
NEDIT: Now running the same code I get this error:
"Attempted to read or write protected memory. This is often an indication that other memory is corrupt."
EDIT2: Changed pbData to pvData as mentioned.
EDIT3: Changed function
public static bool SetClientAuthEKU(X509Certificate2 cert)
{
OidCollection oids = new OidCollection();
oids.Add(new Oid
{
Value = OID_PKIX_KP_CLIENT_AUTH
});
X509EnhancedKeyUsageExtension eku = new X509EnhancedKeyUsageExtension(oids, true);
CRYPT_OBJID_BLOB objID = new CRYPT_OBJID_BLOB();
//allocate space in memory
IntPtr pbData = Marshal.AllocHGlobal(eku.RawData.Length);
IntPtr pvData = Marshal.AllocHGlobal(Marshal.SizeOf(objID));
//copy eku raw data into pbData
Marshal.Copy(eku.RawData, 0, pbData, eku.RawData.Length);
//set CRYPT_OBJECT value with ekuRaw data and Length
objID.pbData = pbData;
objID.cbData = (uint)eku.RawData.Length;
//copy CRYPT OBJECT into IntPtr
Marshal.StructureToPtr(objID, pvData, false);
var result = CertSetCertificateContextProperty(cert.Handle, CERT_ENHKEY_USAGE_PROP_ID, 0, pvData);
Marshal.FreeHGlobal(objID.pbData);
Marshal.FreeHGlobal(pvData);
return true;
}
EDIT4:

Answer 1

The problem is that you pass actual raw data (without length indicator) to CertSetCertificateContextProperty function, while it must be a pointer to CRYPTOAPI_BLOB. That is, last parameter of CertSetCertificateContextProperty function must be pvData.
The mistake can be easily detected by finding usages of pvData in your code. You write structure into pvData pointer, but the pointer is not used anywhere in the code.
Update:
I just noticed that you don't put anything in pbData. You allocate the buffer, but don't write anything there. You have to copy extension's raw data into pbData buffer.