Skip to content

Commit c5039b8

Browse files
Copilotjeffhandley
andcommitted
Add ordering documentation for X509Chain.ChainElements property
Co-authored-by: jeffhandley <[email protected]>
1 parent 5ec38d5 commit c5039b8

File tree

1 file changed

+22
-0
lines changed

1 file changed

+22
-0
lines changed

xml/System.Security.Cryptography.X509Certificates/X509Chain.xml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -464,9 +464,31 @@
464464
465465
A chain element consists of an <xref:System.Security.Cryptography.X509Certificates.X509Certificate2> object, an <xref:System.Security.Cryptography.X509Certificates.X509ChainStatus> structure, and an extra information string.
466466
467+
The `ChainElements` collection is ordered from the end-entity (leaf) certificate at index 0, through any intermediate certificates, to the trust anchor (root certificate) at the final index. This ordering is consistent across all platforms:
467468
469+
- On Windows, this matches the `CERT_CHAIN_CONTEXT` structure where `rgpChain[0]` is the end certificate and `rgpChain[cChain–1]` is the final chain element (root).
470+
- On Linux and macOS, this matches OpenSSL's `X509_STORE_CTX_get0_chain()` which returns a `STACK_OF(X509)` ordered from leaf to root.
468471
469472
## Examples
473+
The following code example demonstrates the ordering of chain elements:
474+
475+
```csharp
476+
using var chain = new X509Chain();
477+
chain.Build(serverCertificate);
478+
479+
// chain.ChainElements[0] is the leaf (end-entity) certificate
480+
// chain.ChainElements[^1] is the root (trust anchor) certificate
481+
482+
Console.WriteLine("Certificate chain from leaf to root:");
483+
for (int i = 0; i < chain.ChainElements.Count; i++)
484+
{
485+
var cert = chain.ChainElements[i].Certificate;
486+
var role = i == 0 ? "Leaf" :
487+
i == chain.ChainElements.Count - 1 ? "Root" : "Intermediate";
488+
Console.WriteLine($"[{i}] {role}: {cert.Subject}");
489+
}
490+
```
491+
470492
The following code example opens the current user's personal certificate store, allows you to select a certificate, then writes certificate and certificate chain information to the console. The output depends on the certificate you select.
471493
472494
:::code language="csharp" source="~/snippets/csharp/System.Security.Cryptography.X509Certificates/X509Chain/Overview/x509chaintest.cs" id="Snippet4":::

0 commit comments

Comments
 (0)