Ensure 3DES Exports are actually 3DES on all versions of Windows

[vcsjones]

Older Windows, namely Windows 8.1 and below, use RC2-40 when encrypting certificates in PKCS#12, so we cannot rely on the export being 3DES. This changes the export to re-encode if 3DES was explicitly asked for.

[Copilot]

PR Overview

This pull request refactors the PKCS#12 export logic to ensure that when 3DES is explicitly requested on older versions of Windows, the exported certificate is properly re‐encoded.

• Introduces a new helper method ExportPkcs12Core that consolidates export and re‐encoding logic.
• Adjusts the export paths for both AES and 3DES formats based on platform capabilities.

Reviewed Changes

File	Description
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/X509Certificates/StorePal.Windows.Export.cs	Refactored the export routines to call ExportPkcs12Core, simplifying the logic for handling both AES and 3DES re-encoding.

Copilot reviewed 1 out of 1 changed files in this pull request and generated no comments.

Comments suppressed due to low confidence (1)

src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/X509Certificates/StorePal.Windows.Export.cs:102

• [nitpick] Consider renaming ExportPkcs12Core to a more descriptive name (e.g. ExportAndReencodePkcs12) to clearly indicate its dual role in exporting and conditionally re-encoding PKCS#12 data.

private unsafe byte[] ExportPkcs12Core(Pkcs12ExportPbeParameters? exportParameters, SafePasswordHandle password)

Tip: If you use Visual Studio Code, you can request a review from Copilot before you push from the "Source Control" tab. Learn more

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.