Fixing X509Certificate2Collection.Export on Unix with multiple certs and private key

src/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.Unix/ExportProvider.cs

@@ -117,13 +117,15 @@ private byte[] ExportPfx(SafePasswordHandle password)
                             }
 
                             privateCert = cert;
+                            var certPal = (OpenSslX509CertificateReader)cert.Pal;
+                            privateCertHandle = certPal.SafeHandle;
+                            privateCertKeyHandle = certPal.PrivateKeyHandle;
                         }
                         else
                         {
                             PushHandle(cert.Handle, publicCerts);
                         }
 
-                        GC.KeepAlive(cert); // ensure cert's safe handle isn't finalized while raw handle is in use
                     }
                 }
 
@@ -138,11 +140,17 @@ private byte[] ExportPfx(SafePasswordHandle password)
                         throw Interop.Crypto.CreateOpenSslCryptographicException();
                     }
 
-                    return Interop.Crypto.OpenSslEncode(
+                    byte[] result = Interop.Crypto.OpenSslEncode(
                         Interop.Crypto.GetPkcs12DerSize,
                         Interop.Crypto.EncodePkcs12,
                         pkcs12);
+
+                    // ensure cert handles aren't finalized while the raw handles are in use
+                    GC.KeepAlive(_certs);
+                    return result;
                 }
+
+
             }
         }
 

src/System.Security.Cryptography.X509Certificates/tests/CollectionTests.cs

@@ -863,6 +863,32 @@ public static void ExportMultiplePrivateKeys()
             }
         }
 
+        [Fact]
+        public static void CanAddMultipleCertsWithSinglePrivateKey()
+        {
+            using (var oneWithKey = new X509Certificate2(TestData.PfxData, TestData.PfxDataPassword, X509KeyStorageFlags.Exportable | Cert.EphemeralIfPossible))
+            using (var twoWithoutKey = new X509Certificate2(TestData.ComplexNameInfoCert))
+            {
+                Assert.True(oneWithKey.HasPrivateKey);
+
+                var col = new X509Certificate2Collection
+                {
+                    oneWithKey,
+                    twoWithoutKey,
+                };
+
+                Assert.Equal(1, col.Cast<X509Certificate2>().Count(x => x.HasPrivateKey));
+                Assert.Equal(2, col.Count);
+
+                byte[] buffer = col.Export(X509ContentType.Pfx);
+
+                using (ImportedCollection newCollection = Cert.Import(buffer))
+                {
+                    Assert.Equal(2, newCollection.Collection.Count);
+                }
+            }
+        }
+
         [Fact]
         public static void X509CertificateCollectionCopyTo()
         {

src/System.Security.Cryptography.X509Certificates/tests/System.Security.Cryptography.X509Certificates.Tests.csproj

@@ -94,4 +94,4 @@
     <SupplementalTestData Include="$(PackagesDir)system.security.cryptography.x509certificates.testdata\1.0.2-prerelease\content\**\*.*" />
   </ItemGroup>
   <Import Project="$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildThisFileDirectory), dir.targets))\dir.targets" />
-</Project>
+</Project>