Repository: dotnet/aspnetcore
File: src/Servers/Kestrel/Core/src/Internal/Certificates/CertificateConfigLoader.cs (C#)

Code before:

    private static X509Certificate2 LoadCertificateKey(X509Certificate2 certificate, string keyPath, string? password)
    {
        // OIDs for the certificate key types.
        const string RSAOid = "1.2.840.113549.1.1.1";
        const string DSAOid = "1.2.840.10040.4.1";
        const string ECDsaOid = "1.2.840.10045.2.1";

        const string MLDsa44Oid = "2.16.840.1.101.3.4.3.17";
        const string MLDsa65Oid = "2.16.840.1.101.3.4.3.18";
        const string MLDsa87Oid = "2.16.840.1.101.3.4.3.19";

        const string SlhDsaSha2_128sOid = "2.16.840.1.101.3.4.3.20";
        const string SlhDsaSha2_128fOid = "2.16.840.1.101.3.4.3.21";
        const string SlhDsaSha2_192sOid = "2.16.840.1.101.3.4.3.22";
        const string SlhDsaSha2_192fOid = "2.16.840.1.101.3.4.3.23";
        const string SlhDsaSha2_256sOid = "2.16.840.1.101.3.4.3.24";
        const string SlhDsaSha2_256fOid = "2.16.840.1.101.3.4.3.25";
        const string SlhDsaShake_128sOid = "2.16.840.1.101.3.4.3.26";
        const string SlhDsaShake_128fOid = "2.16.840.1.101.3.4.3.27";
        const string SlhDsaShake_192sOid = "2.16.840.1.101.3.4.3.28";
        const string SlhDsaShake_192fOid = "2.16.840.1.101.3.4.3.29";
        const string SlhDsaShake_256sOid = "2.16.840.1.101.3.4.3.30";
        const string SlhDsaShake_256fOid = "2.16.840.1.101.3.4.3.31";

        const string MLDsa44WithRSA2048PssPreHashSha256Oid = "2.16.840.1.114027.80.9.0";
        const string MLDsa44WithRSA2048Pkcs15PreHashSha256Oid = "2.16.840.1.114027.80.9.1";
        const string MLDsa44WithEd25519PreHashSha512Oid = "2.16.840.1.114027.80.9.2";
        const string MLDsa44WithECDsaP256PreHashSha256Oid = "2.16.840.1.114027.80.9.3";
        const string MLDsa65WithRSA3072PssPreHashSha512Oid = "2.16.840.1.114027.80.9.4";
        const string MLDsa65WithRSA3072Pkcs15PreHashSha512Oid = "2.16.840.1.114027.80.9.5";
        const string MLDsa65WithRSA4096PssPreHashSha512Oid = "2.16.840.1.114027.80.9.6";
        const string MLDsa65WithRSA4096Pkcs15PreHashSha512Oid = "2.16.840.1.114027.80.9.7";
        const string MLDsa65WithECDsaP256PreHashSha512Oid = "2.16.840.1.114027.80.9.8";
        const string MLDsa65WithECDsaP384PreHashSha512Oid = "2.16.840.1.114027.80.9.9";
        const string MLDsa65WithECDsaBrainpoolP256r1PreHashSha512Oid = "2.16.840.1.114027.80.9.10";
        const string MLDsa65WithEd25519PreHashSha512Oid = "2.16.840.1.114027.80.9.11";
        const string MLDsa87WithECDsaP384PreHashSha512Oid = "2.16.840.1.114027.80.9.12";
        const string MLDsa87WithECDsaBrainpoolP384r1PreHashSha512Oid = "2.16.840.1.114027.80.9.13";
        const string MLDsa87WithEd448PreHashShake256_512Oid = "2.16.840.1.114027.80.9.14";
        const string MLDsa87WithRSA3072PssPreHashSha512Oid = "2.16.840.1.114027.80.9.15";
        const string MLDsa87WithRSA4096PssPreHashSha512Oid = "2.16.840.1.114027.80.9.16";
        const string MLDsa87WithECDsaP521PreHashSha512Oid = "2.16.840.1.114027.80.9.17";

        // Duplication is required here because there are separate CopyWithPrivateKey methods for each algorithm.
        var keyText = File.ReadAllText(keyPath);
        switch (certificate.PublicKey.Oid.Value)
        {
            case RSAOid:
                {
                    using var rsa = RSA.Create();

Review comment (bug):
These seem wrong? Ref https://datatracker.ietf.org/doc/draft-ietf-lamps-pq-composite-sigs/
> `<CompSig>` is equal to 2.16.840.1.114027.80.9.1
> id-MLDSA44-RSA2048-PSS-SHA256|`<CompSig>`.0

That would equal 2.16.840.1.114027.80.9.1.0

Code after:

    private static X509Certificate2 LoadCertificateKey(X509Certificate2 certificate, string keyPath, string? password)
    {
        // OIDs for the certificate key types.
        const string RSAOid = "1.2.840.113549.1.1.1";
        const string DSAOid = "1.2.840.10040.4.1";
        const string ECDsaOid = "1.2.840.10045.2.1";

        const string MLDsa44Oid = "2.16.840.1.101.3.4.3.17";
        const string MLDsa65Oid = "2.16.840.1.101.3.4.3.18";
        const string MLDsa87Oid = "2.16.840.1.101.3.4.3.19";

        const string SlhDsaSha2_128sOid = "2.16.840.1.101.3.4.3.20";
        const string SlhDsaSha2_128fOid = "2.16.840.1.101.3.4.3.21";
        const string SlhDsaSha2_192sOid = "2.16.840.1.101.3.4.3.22";
        const string SlhDsaSha2_192fOid = "2.16.840.1.101.3.4.3.23";
        const string SlhDsaSha2_256sOid = "2.16.840.1.101.3.4.3.24";
        const string SlhDsaSha2_256fOid = "2.16.840.1.101.3.4.3.25";
        const string SlhDsaShake_128sOid = "2.16.840.1.101.3.4.3.26";
        const string SlhDsaShake_128fOid = "2.16.840.1.101.3.4.3.27";
        const string SlhDsaShake_192sOid = "2.16.840.1.101.3.4.3.28";
        const string SlhDsaShake_192fOid = "2.16.840.1.101.3.4.3.29";
        const string SlhDsaShake_256sOid = "2.16.840.1.101.3.4.3.30";
        const string SlhDsaShake_256fOid = "2.16.840.1.101.3.4.3.31";

        const string MLDsa44WithRSA2048PssPreHashSha256Oid = "2.16.840.1.114027.80.9.1.0";
        const string MLDsa44WithRSA2048Pkcs15PreHashSha256Oid = "2.16.840.1.114027.80.9.1.1";
        const string MLDsa44WithEd25519PreHashSha512Oid = "2.16.840.1.114027.80.9.1.2";
        const string MLDsa44WithECDsaP256PreHashSha256Oid = "2.16.840.1.114027.80.9.1.3";
        const string MLDsa65WithRSA3072PssPreHashSha512Oid = "2.16.840.1.114027.80.9.1.4";
        const string MLDsa65WithRSA3072Pkcs15PreHashSha512Oid = "2.16.840.1.114027.80.9.1.5";
        const string MLDsa65WithRSA4096PssPreHashSha512Oid = "2.16.840.1.114027.80.9.1.6";
        const string MLDsa65WithRSA4096Pkcs15PreHashSha512Oid = "2.16.840.1.114027.80.9.1.7";
        const string MLDsa65WithECDsaP256PreHashSha512Oid = "2.16.840.1.114027.80.9.1.8";
        const string MLDsa65WithECDsaP384PreHashSha512Oid = "2.16.840.1.114027.80.9.1.9";
        const string MLDsa65WithECDsaBrainpoolP256r1PreHashSha512Oid = "2.16.840.1.114027.80.9.1.10";
        const string MLDsa65WithEd25519PreHashSha512Oid = "2.16.840.1.114027.80.9.1.11";
        const string MLDsa87WithECDsaP384PreHashSha512Oid = "2.16.840.1.114027.80.9.1.12";
        const string MLDsa87WithECDsaBrainpoolP384r1PreHashSha512Oid = "2.16.840.1.114027.80.9.1.13";
        const string MLDsa87WithEd448PreHashShake256_512Oid = "2.16.840.1.114027.80.9.1.14";
        const string MLDsa87WithRSA3072PssPreHashSha512Oid = "2.16.840.1.114027.80.9.1.15";
        const string MLDsa87WithRSA4096PssPreHashSha512Oid = "2.16.840.1.114027.80.9.1.16";
        const string MLDsa87WithECDsaP521PreHashSha512Oid = "2.16.840.1.114027.80.9.1.17";

        // Duplication is required here because there are separate CopyWithPrivateKey methods for each algorithm.
        var keyText = File.ReadAllText(keyPath);
        switch (certificate.PublicKey.Oid.Value)
        {
            case RSAOid:
                {
                    using var rsa = RSA.Create();