My TLS certificate check never worked on non-English Windows — and nothing failed

I maintain a .NET desktop app that launches third-party executables (yt-dlp, ffmpeg). Because those binaries do the actual network work, I added a set of preflight checks before ever starting a process: pinned SHA-256 hashes, Authenticode signature, ACLs on the folder, and TLS certificate pinning with SAN validation on the remote host.

The SAN check had been in place for months. It never worked.

I was comparing the hostname against X509Certificate2 extension text obtained through Format() — which returns a string localised by the OS. On an English Windows it read DNS Name=example.com. On my French one it read something else entirely, so the comparison silently never matched the way I assumed. No exception, no log, no failing test — the check just quietly did nothing useful. Fixed by decoding the SAN extension from ASN.1 directly, which is language-independent.

A few other things I learned building this out:

X509Certificate.CreateFromSignedFile is marked obsolete (SYSLIB0057) but is still the only BCL API that extracts the Authenticode signer of an already-signed PE. There's no direct replacement short of P/Invoking WinVerifyTrust or taking a third-party dependency. I suppress the warning with a comment explaining why, rather than pretending it's fine. Hash pinning alone is a TOCTOU hole. Checking the hash then launching the file leaves a window where it can be swapped. That's why the ACL check matters more than it looks: if the folder is writable by Everyone, your verification is theatre. I can't close the window entirely from managed code — I narrow it and say so. Where you run from is part of your threat model. Running from a network share, a temp folder, or the recycle bin means someone else may control your working directory. Cheap to check, easy to forget. I pulled all of it into a small package — pure functions, each check returns a bool with an optional out string? reason giving the exact rejection cause. No logging, no hidden side effects, nothing thrown behind your back. Targets net8.0-windows and net10.0-windows, MIT OR Apache-2.0.

dotnet add package SentinelGuard

Happy to answer questions about any of the checks — particularly the ASN.1 decoding, which was the fiddliest part.

Sentinel Guard