Has anyone tried to encrypt a certificate for MS Graph subscription?

[mohammadamer]

Unfortunately, it's not clear in MS documentation how to encrypt a certificate for MS Graph Subscription.
Has anyone tried to encrypt a certificate for MS Graph subscription?

` // Get ngrok URL if set (for local development)
var notificationHost = _config["ngrokUrl"] ?? req.Url.Host;
var certificateThumbprint = _config["CertificateThumbprint"];

            // Load the X509Certificate and add it to the subscription object
            var certificate = Utilities.X509CertificateUtility.LoadCertificate(StoreName.My, StoreLocation.CurrentUser, certificateThumbprint);
            var encryptionCertificateId = !string.IsNullOrEmpty(certificate?.FriendlyName) ? certificate.FriendlyName : certificate?.Subject;
            var encryptionCertificate = Convert.ToBase64String(certificate.Export(X509ContentType.Cert));

            // Create a new subscription object
            var subscription = new Subscription
            {
                ChangeType = "created",
                IncludeResourceData = true,
                NotificationUrl = $"{notificationHost}/api/Notify",
                Resource = "/teams/getAllMessages",// all messages and replies across channels.
                //Resource = "/chats/getAllMessages",//all messages across chats in a tenant.
                ExpirationDateTime = DateTime.UtcNow.AddMinutes(60),
                ClientState = SetSubscription.ClientState,
                EncryptionCertificateId = encryptionCertificateId,
                EncryptionCertificate = encryptionCertificate,
            };
            //subscription.AddPublicEncryptionCertificate(certificate);

            _logger.LogInformation($"Creating subscription...");

            // POST /subscriptions
            var createdSubscription = await graphClient.Subscriptions.PostAsync(subscription);`

[waldekmastykarz]

Certificate itself doesn't have to be encrypted, just base64 encoded. Do you have some code that we could look like to better understand what you're trying and where you're stuck?

[waldekmastykarz]

Let me check with @andrueastman

[mohammadamer]

When I change to Microsoft Graph .NET v4, Then I managed to encrypt the certificate.
Now, I'm getting issue with decrypt the notification content.

Message: Internal.Cryptography.CryptoThrowHelper.WindowsCryptographicException: 'Access denied.'
Code where it raises the issue:
var attachedMessage = await notificationItem.EncryptedContent.DecryptAsync<ChatMessage>((id, thumbprint) => Task.FromResult(certificate));

[mohammadamer]

@AsmaaNoh
I'll submit my code soon, Just wanted to finish everything before submission :)

[mohammadamer]

[mohammadamer]

Here is the URL for the code of azure function that has the issue.