This settings specifies the certificate comment when calling ExportCertificate. This setting is only applicable when ExportFormat is set to one of the following values:

• "OpenSSHKey" (ExportPrivateKey must be False)
• "SSH2PublicKey"
• "PPK"

This setting specifies the extended key usage flags of the certificate created by calling CreateCertificate or IssueCertificate. If specified, the value is a comma separated list of OIDs. Common OIDs are:

For instance, the following value specified the extended key usage for Server Authentication, Client Authentication, and Code Signing: 1.3.6.1.5.5.7.3.1, 1.3.6.1.5.5.7.3.2, 1.3.6.1.5.5.7.3.3

When CreateCertificate creates a new certificate and associated key, or when CreateKey creates a key, this setting determines the length of the new public key (in bits). The default value is 2048.

When CreateCertificate creates a new certificate and associated key, or when CreateKey creates a key, this setting determines the type of key generated: 1 for key exchange (encryption) keys, and 2 for digital signature keys. The default value is 1.

When CreateCertificate creates a new certificate and associated key, this setting determines the public key algorithm of the generated keys. Valid values are:

• RSA (default)
• DSA
• ECDSA_P256
• ECDSA_P384
• ECDSA_P521
• ECDSA_Secp256k1
• ECDSA_Secp224k1
• ECDSA_Secp192k1
• ECDSA_Secp160k1
• Ed25519
• Ed448

When CreateCertificate or IssueCertificate creates a new certificate, the signature algorithm used is specified by this setting. Possible values are:

• MD2
• MD5
• SHA1
• SHA256 (default)
• SHA384
• SHA512

This allows the Subject Alternative Names extension to be specified when creating or issuing a certificate via CreateCertificate or IssueCertificate. This setting only supports email, DNS, URI, and IPv4 addresses. Separate alternative names should be separated by commas. For example:

string altNames = "email:copy,dns:domain.com,dns.1:other.domain.com,uri:http://www.domain.com,ip:192.168.1.102"

This setting specifies the usage flags of the certificate created by calling CreateCertificate or IssueCertificate. If specified, the value is the binary or of one or more supported values. For instance a value of 12 or 0xC is the binary or of the Certificate Signing and Key Signing usage flags. Supported flags are:

This configuration setting can be used to change when a newly created certificate becomes valid. By default, the certificate is valid as soon as it is created. Set CertValidityOffset to the number of days that this starting period should be offset from the current day. This setting also accepts negative values for back-dating the validity of a certificate. The default value is 0.

This configuration setting determines the duration in days that a newly created certificate remains valid. The certificate becomes valid as soon as it is created, unless CertValidityOffset is set. The duration is not changed if CertValidityOffset is set; the certificate will still expire CertValidityTime days after the validity period begins. The default value is 365 days.

This setting returns the PKCS8 formatted private and public key pair of the key created when CreateKey is called. This is useful in scenarios where exporting the key for use in another environment is required.

The name of the Cryptographic Service Provider used to provide access to certificate signing operations.

This setting optionally specifies a PKCS8 formatted private key to use when calling GenerateCSR. When set, the keyName parameter of GenerateCSR is ignored and the key specified by this setting is used instead.

This setting controls whether the certificate exported as a string when ExportCertificate is called is encoded. If ExportFormat is set to PFX or P7B before calling ExportCertificate the exported certificate may be binary (EncodeExportedCert is False), or base64 encoded (EncodeExportedCert is True) to allow easier handling of the certificate data.

The default value is False.

When calling ImportCertificate if a matching certificate or a link to a matching certificate already exists in the Windows certificate store this setting governs what action will be taken. Possible values are:

When calling ImportCertificate, this setting controls the type of the certificate being specified in the first parameter.

This config can take one of the following values:

Note that this functionality is currently for Windows platforms only.

This setting specifies the JWK algorithm. It can be set before calling ExportCertificate (if ExportFormat is set to JWK) to control the key algorithm used to create the JWK. This setting will also be populated after loading a JWK file.

Valid values are:

• (empty string)
• HS256
• HS384
• HS512
• RS256
• RS384
• RS512
• EC256
• EC384
• EC512
• EC256K

When set to true, the component will attempt to build the X.509 certificate chain for the certificate currently selected by Cert. If successful, the x5c parameter will be added to the JWK. It can be set before calling ExportCertificate (if ExportFormat is set to JWK).

The default value is False.

This setting specifies the JWK key Id. It can be set before calling ExportCertificate (if ExportFormat is set to JWK). This setting will also be populated after loading a JWK file.

This setting specifies the intended key operations for the JWK. It can be set before calling ExportCertificate (if ExportFormat is set to JWK). This setting will also be populated after loading a JWK file.

This setting format is a JSON array. Examples: ["sign","verify"] or ["encrypt"].

This setting specifies the intended usage of the key. It can be set before calling ExportCertificate (if ExportFormat is set to JWK). This setting will also be populated after loading a JWK file.

Valid values are enc and sig.

This setting controls the format of PublicKey and PrivateKey. By default these fields hold PEM formatted public and private key data. When set to 1 (XML) the keys are stored in a XML format. This only affects the values returned by the component; the actual keys remain the same regardless of this setting. Possible values are:

• 0 (PEM - default)
• 1 (XML)

This setting controls the level of detail that is logged through the Log event. Possible values are:

If this is false (default), the component will throw an error if a duplicate key exists while generating a new keyset using CreateKey. If set to true, the component will replace a key if it already exists when generating new keys.

This allows Subject Alternative Names to be added to a Certificate Signing request. The setting only supports email, DNS, URI, and IPv4 addresses. Separate alternative names should be separated by commas. For example:

string altNames = "email:copy,dns:domain.com,dns.1:other.domain.com,uri:http://www.domain.com,ip:192.168.1.102"

This setting exposes the Public Key Algorithm object identifier (OID) value for the currently loaded Cert.

This setting exposes the Signature Algorithm object identifier (OID) value for the currently loaded Cert.

When queried, this setting will return a string containing information about the product's build.

In a GUI-based application, long-running blocking operations may cause the application to stop responding to input until the operation returns. The component will attempt to discover whether or not the application has a message loop and, if one is discovered, it will process events in that message loop during any such blocking operation.

In some non-GUI applications an invalid message loop may be discovered that will result in errant behavior. In these cases, setting GUIAvailable to false will ensure that the component does not attempt to process external events.

When queried, this setting will return a string containing information about the license this instance of a component is using. It will return the following information:

• Product: The product the license is for.
• Product Key: The key the license was generated from.
• License Source: Where the license was found (e.g. RuntimeLicense, License File).
• License Type: The type of license installed (e.g. Royalty Free, Single Server).

By default the component will use the system security libraries to perform cryptographic functions. When set to False calls to unmanaged code will be made. In certain environments this is not desirable. To use a completely managed security implementation set this setting to True. Setting this to True tells the component to use the internal implementation instead of using the system's security API.

Note: This setting is static. The value set is applicable to all components used in the application.

When this value is set the product's system DLL is no longer required as a reference, as all unmanaged code is stored in that file.