Detect orphaned KG certs via public key modulus comparison

[Robbie-Microsoft]

Problem

After a VM or app restart, KeyGuard regenerates the per-boot private key in the same CNG container while the old cert remains on disk. The cert appears valid (time-wise, HasPrivateKey=true) but the key material has changed. MSAL loads it from the persistent store, attempts an mTLS handshake, and fails.

Fix

Compare the cert's embedded public key (modulus) against the public key currently in the CNG container. A mismatch conclusively means the container was regenerated — the cert is orphaned. The check runs inside WindowsPersistentCertificateCache.Read during candidate selection.

Orphaned certs are removed from the store on detection (not just skipped) so they don't accumulate and don't require the modulus check on every subsequent Read.

Design notes

• Non-CNG keys (software CSP) are accepted on faith — KG regeneration does not apply
• GetRSAPrivateKey() returning null for an RSA cert is treated as orphaned (inaccessible = unusable); non-RSA certs (ECDSA, etc.) are accepted on faith
• CryptographicException during key load is treated as orphaned (inaccessible = unusable)
• The CNG modified-time heuristic (Check 3 from Dragos's proposal) is intentionally omitted — the modulus comparison is definitive and covers the same case without the false-negative window
• The internal Read overload accepts an injectable isOrphaned delegate for testability; IPersistentCertificateCache interface is unchanged

Testing

6 new unit tests in PersistentCertificateStoreUnitTests.cs:

• IsCertKeyOrphaned_ReturnsTrue_For_NullCert
• IsCertKeyOrphaned_ReturnsFalse_For_ValidCert
• IsCertKeyOrphaned_ReturnsTrue_For_RsaCert_WithNoPrivateKey
• PublicKeyMatchesCert_ReturnsTrue_When_KeyMatchesCert
• PublicKeyMatchesCert_ReturnsFalse_When_ModulusMismatch (passes a different RSACng to simulate post-reboot key replacement)
• Read_RemovesOrphanedCert_FromStore (injects always-true orphan check, verifies cert is deleted from store and Read returns false)

Companion to #6017 (token_not_after OID eviction — different failure mode).

[Copilot]

Pull request overview

Adds a Windows KeyGuard-specific “orphaned cert” detection to MSAL’s persistent mTLS certificate selection logic by validating that the certificate’s embedded RSA public key matches the current RSA public key in the associated CNG container. This prevents MSAL from reusing a persisted cert whose key container was regenerated after reboot, avoiding repeated SCHANNEL handshake failures.

Changes:

• Add modulus/exponent comparison helpers (IsCertKeyOrphaned, PublicKeyMatchesCert) to detect CNG-container/key mismatches.
• Update WindowsPersistentCertificateCache.Read to skip orphaned candidates and continue searching for a usable cert.
• Add unit tests covering the new helper methods.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
tests/Microsoft.Identity.Test.Unit/ManagedIdentityTests/PersistentCertificateStoreUnitTests.cs	Adds tests for orphan detection and RSA public key matching logic.
src/client/Microsoft.Identity.Client/ManagedIdentity/V2/WindowsPersistentCertificateCache.cs	Skips persisted cert candidates whose CNG container key no longer matches the cert’s embedded public key.
src/client/Microsoft.Identity.Client/ManagedIdentity/V2/MtlsCertificateCache.cs	Introduces orphan-detection helpers based on RSA modulus/exponent comparison with logging on crypto failures.

Comments suppressed due to low confidence (1)

tests/Microsoft.Identity.Test.Unit/ManagedIdentityTests/PersistentCertificateStoreUnitTests.cs:912

• Same issue as the KeyMatches test: on net48, RSA.Create(2048) commonly returns RSACryptoServiceProvider, so key2 as RSACng will be null and the test will fail. Create key2 as an RSACng explicitly (or gate the test on key2 is RSACng) to keep the multi-targeted test suite passing.

            using var key1 = RSA.Create(2048);
            using var key2 = RSA.Create(2048);
            var rsaCng2 = key2 as RSACng;
            Assert.IsNotNull(rsaCng2, "Expected RSACng on Windows.");

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

src/client/Microsoft.Identity.Client/ManagedIdentity/V2/WindowsPersistentCertificateCache.cs:190

• RemoveByThumbprints uses List<string> + thumbprints.Contains(...) inside a loop over all certificates, making removal O(storeSize * orphanCount). Since this can run on the read path after a reboot, consider using a HashSet<string> (e.g., OrdinalIgnoreCase) for thumbprints (and/or X509Certificate2Collection.Find by thumbprint) to keep the removal cost predictable.

                int removed = 0;
                foreach (var cert in items)
                {
                    try
                    {
                        if (thumbprints.Contains(cert.Thumbprint))
                        {
                            store.Remove(cert);
                            removed++;