More cert validation.

Author: Cesar Blum Silveira

src/Kestrel/DefaultHttpsProvider.cs

@@ -4,6 +4,7 @@
 using System;
 using System.Collections.Generic;
 using System.Linq;
+using System.Security.Cryptography;
 using System.Security.Cryptography.X509Certificates;
 using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Server.Kestrel.Core;
@@ -22,13 +23,15 @@ public void ConfigureHttps(ListenOptions listenOptions)
 
         private static X509Certificate2 FindDevelopmentCertificate()
         {
+            // TODO: replace this with call to CertificateManager.FindCertificates(CertificatePurpose.HTTPS, StoreName.My, StoreLocation.CurrentUser, isValid: true)
+            // when that becomes available.
             using (var store = new X509Store(StoreName.My, StoreLocation.CurrentUser))
             {
                 store.Open(OpenFlags.ReadOnly);
 
                 var certificates = store.Certificates.OfType<X509Certificate2>();
                 var certificate = certificates
-                    .FirstOrDefault(c => HasOid(c, AspNetHttpsOid));
+                    .FirstOrDefault(c => HasOid(c, AspNetHttpsOid) && !IsExpired(c) /*&& HasPrivateKey(c)*/);
 
                 if (certificate == null)
                 {
@@ -46,6 +49,16 @@ private static bool HasOid(X509Certificate2 certificate, string oid) =>
                 .OfType<X509Extension>()
                 .Any(e => string.Equals(oid, e.Oid.Value, StringComparison.Ordinal));
 
+        private static bool IsExpired(X509Certificate2 certificate)
+        {
+            var now = DateTimeOffset.Now;
+            return now < certificate.NotBefore || now > certificate.NotAfter;
+        }
+
+        private static bool HasPrivateKey(X509Certificate2 certificate)
+            => (certificate.GetRSAPrivateKey() is RSACryptoServiceProvider rsaPrivateKey && rsaPrivateKey.CspKeyContainerInfo.Exportable)/* ||
+               (certificate.GetRSAPrivateKey() is RSACng cngPrivateKey && cngPrivateKey.CspKeyContainerInfo.Exportable)*/;
+
         private static void DisposeCertificates(IEnumerable<X509Certificate2> certificates)
         {
             foreach (var certificate in certificates)