Issue pure ML-DSA certificates

You need a certification authority and certificates that use ML-DSA only, for example in a closed environment where every party verifies ML-DSA.

BSI TR-02102-1 recommends PQ signatures only in combination with a classical signature. That's why PostQuantum mode requires an exemption, which you set once when your app starts:

PostQuantumConfig.Exemptions |= PostQuantumExemptions.PurePostQuantum;

Root certificate:

var now = DateTimeOffset.UtcNow;
using var rootKey = MLDsaKey.Generate(MLDsaParameterSet.MLDsa65);
var rootRequest = new MLDsaX509SignatureGenerator(rootKey)
    .CreateCertificateRequest("CN=Contoso PQ Root CA");
rootRequest.CertificateExtensions.Add(new X509BasicConstraintsExtension(true, false, 0, true));
rootRequest.CertificateExtensions.Add(
    new X509KeyUsageExtension(X509KeyUsageFlags.KeyCertSign | X509KeyUsageFlags.CrlSign, true));
 
using var root = rootRequest.CreateSelfSigned(now, now.AddYears(10), CryptoMode.PostQuantum);

A signer certificate issued by the root certificate, followed by chain validation:

using var signerKey = MLDsaKey.Generate(MLDsaParameterSet.MLDsa65);
var signerRequest = new MLDsaX509SignatureGenerator(signerKey)
    .CreateCertificateRequest("CN=signer.example.com");
signerRequest.CertificateExtensions.Add(
    new X509KeyUsageExtension(X509KeyUsageFlags.DigitalSignature, true));
 
using var signer = signerRequest.Create(
    root, now, now.AddYears(1), RandomNumberGenerator.GetBytes(16), CryptoMode.PostQuantum);
signer.AttachPrivateMLDsaKey(signerKey);
 
using var chain = new X509Chain();
chain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
chain.ChainPolicy.CustomTrustStore.Add(root);
chain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
Console.WriteLine(chain.Build(signer, CryptoMode.PostQuantum));

On .NET Framework 4.6.2, issue the certificate with X509CertificateBuilder:

var builder = new X509CertificateBuilder(
    new X500DistinguishedName("CN=signer.example.com"), signerKey);
using var selfSigned = builder.CreateSelfSigned(now, now.AddYears(1), CryptoMode.PostQuantum);

• Associate the private key. A certificate issued with Create only knows the public key from the request. GetPrivateMLDsaKey returns null for it until you call AttachPrivateMLDsaKey. Only then can the certificate sign, issue, or be exported as a PFX file.
• HasPrivateKey stays false. The .NET property only knows classical keys. To check whether an ML-DSA key is present, call GetPrivateMLDsaKey.
• Without CryptoMode, .NET applies. rootRequest.CreateSelfSigned(notBefore, notAfter) without the argument binds to the .NET method. That method doesn't know the ML-DSA key and throws an InvalidOperationException.
• The exemption also applies to verification. Without PurePostQuantum, every operation in PostQuantum mode throws a CryptographicException, including X509Chain.Build. Every operation raises the PolicyDeviation event; see Post-quantum algorithm policy.
• Only verifiers that support ML-DSA. Software that doesn't know ML-DSA can't validate these certificates. For the transition, use hybrid certificates as shown in Create your first hybrid certificate chain.

• Post-quantum algorithm policy
• Formats of the post-quantum parts
• Keys and key storage
• The ML-DSA private key is missing