Network Audit and Documentation, CENTREL Solutions Blog

You may see the error "System.InvalidOperationException: 'An X509Extension with OID '2.5.29.15' has already been specified.'" when creating a self signed certificate. This can occur if you try and add multiple KeyUsageFlags as two separate extensions. certificateRequest.CertificateExtensions.Add( new X509KeyUsageExtension(X509KeyUsageFlags.KeyEncipherment , true )); certificateRequest.CertificateExtensions.Add( new X509KeyUsageExtension( X509KeyUsageFlags.DigitalSignature, true )); To resolved the issue assign the flags to a single extension. certificateRequest.CertificateExtensions.Add( new X509KeyUsageExtension(X509KeyUsageFlags.KeyEncipherment | X509KeyUsageFlags.DigitalSignature, true ));

You might be wondering why some properties on the details tab of a certificate in the Certificates MMC in Windows shows with a warning yellow triangle and exclamation mark (exclamation point).# This simply indicates whether the extension is marked as "Critical". The critical setting can be seen in .NET on the constructor of the extension https://learn.microsoft.com/dotnet/api/system.security.cryptography.x509certificates.x509extension.-ctor