Prerequisites

What your app, the machine it runs on, and your development environment need.

The extensions for CertificateRequest, X509SignatureGenerator, and CopyWithPrivateKey require .NET Framework 4.7.2 or later, because that's where .NET introduces these types. On 4.6.2, issue certificates with X509CertificateBuilder instead. For all differences, see Target frameworks.

OpenSSL computes every post-quantum algorithm. The library doesn't ship it.

• Version: 3.5 or later. The library loads any OpenSSL 3 release (3.0 or later) and then asks the installation, algorithm by algorithm, whether it provides what's needed. The default provider offers ML-DSA and ML-KEM starting with 3.5, and Argon2id starting with 3.2. If an algorithm is missing, the library throws a CryptographicException that names the algorithm, the version, and the path. EnablePostQuantum already checks ML-DSA-65 and ML-KEM-768 at startup.
• Components: libcrypto covers every feature of this library.
• Architecture: must match the process. A 32-bit process needs a 32-bit OpenSSL build.
• File names: libcrypto-3-x64.dll (64-bit Windows), libcrypto-3.dll (32-bit Windows), libcrypto-3-arm64.dll (Windows on Arm), libcrypto.so.3 (Linux), libcrypto.3.dylib (macOS).

To point the library at your installation, see Configure OpenSSL.

• SDK: You need the .NET 10 SDK to build the library, because its source uses C# 14 language features. That's true even when your app targets .NET Framework.

• Reference: Add the library as a project reference:

  <ItemGroup>
    <ProjectReference Include="..\sys-sec-crypto\WKL.System.Security.Cryptography.Extensions.csproj" />
  </ItemGroup>

  For Blazor WebAssembly, reference WKL.System.Security.Cryptography.WASM\WKL.System.Security.Cryptography.WASM.csproj instead.

• Create your first hybrid certificate chain
• Configure OpenSSL
• Target frameworks