---
title: "PKCertificateAuthentication"
description: "Namespace: Lacuna.Pki"
canonical: "https://docs.lacunasoftware.com/api/Lacuna.Pki/PKCertificateAuthentication"
locale: "pt-BR"
product: "PKI SDK"
last_updated: "2026-06-02"
---

# PKCertificateAuthentication

**Namespace:** `Lacuna.Pki`  
**Assembly:** `Lacuna.Pki`  
_Class_

Helper class to implement public-key certificate authentication.

```csharp
public class PKCertificateAuthentication
```

**Hierarquia:** [`object`](https://learn.microsoft.com/dotnet/api/system.object) → `PKCertificateAuthentication`

## Construtores

### `PKCertificateAuthentication(IAsyncNonceStore)`

```csharp
public PKCertificateAuthentication(IAsyncNonceStore asyncStore)
```

**Parâmetros**

| Nome | Tipo | Descrição |
|---|---|---|
| `asyncStore` | [`IAsyncNonceStore`](https://docs.lacunasoftware.com/api/Lacuna.Pki.Stores/IAsyncNonceStore) |  |

---

### `PKCertificateAuthentication(INonceStore)`

```csharp
public PKCertificateAuthentication(INonceStore store)
```

**Parâmetros**

| Nome | Tipo | Descrição |
|---|---|---|
| `store` | [`INonceStore`](https://docs.lacunasoftware.com/api/Lacuna.Pki.Stores/INonceStore) |  |

---

## Campos

### `DigestAlgorithm`

The signature algorithm that the client must use to sign the nonce.

```csharp
public static readonly DigestAlgorithm DigestAlgorithm
```

**Retorno**

[`DigestAlgorithm`](https://docs.lacunasoftware.com/api/Lacuna.Pki/DigestAlgorithm)

---

## Métodos

### `Complete(byte[], byte[], byte[], CertificateValidationOptions, out PKCertificate)`

Completes an authentication.

```csharp
public ValidationResults Complete(byte[] nonce, byte[] encodedCertificate, byte[] signature, CertificateValidationOptions certificateValidationOptions, out PKCertificate certificate)
```

**Parâmetros**

| Nome | Tipo | Descrição |
|---|---|---|
| `nonce` | [`byte[]`](https://learn.microsoft.com/dotnet/api/system.byte) | The nonce signed by the client. |
| `encodedCertificate` | [`byte[]`](https://learn.microsoft.com/dotnet/api/system.byte) | The client's certificate binary encoding. |
| `signature` | [`byte[]`](https://learn.microsoft.com/dotnet/api/system.byte) | The signature of the nonce. |
| `certificateValidationOptions` | [`CertificateValidationOptions`](https://docs.lacunasoftware.com/api/Lacuna.Pki/CertificateValidationOptions) | Certificate validation options to use during the client's certificate validation. |
| `certificate` | [`PKCertificate`](https://docs.lacunasoftware.com/api/Lacuna.Pki/PKCertificate) | The client's decoded certificate. If the authentication succeeds, this parameter is garanteed to be assigned to. If it fails, it may or may not be assigned to, depending on the stage on which the authentication failed. |

**Retorno**

[`ValidationResults`](https://docs.lacunasoftware.com/api/Lacuna.Pki/ValidationResults) — Whether the authentication succeeded or not, that is, if the client's certificate can be trusted according to the certificate validation options passed.

---

### `Complete(byte[], byte[], byte[], ITrustArbitrator, out PKCertificate)`

Completes an authentication.

```csharp
public ValidationResults Complete(byte[] nonce, byte[] encodedCertificate, byte[] signature, ITrustArbitrator trustArbitrator, out PKCertificate certificate)
```

**Parâmetros**

| Nome | Tipo | Descrição |
|---|---|---|
| `nonce` | [`byte[]`](https://learn.microsoft.com/dotnet/api/system.byte) | The nonce signed by the client. |
| `encodedCertificate` | [`byte[]`](https://learn.microsoft.com/dotnet/api/system.byte) | The client's certificate binary encoding. |
| `signature` | [`byte[]`](https://learn.microsoft.com/dotnet/api/system.byte) | The signature of the nonce. |
| `trustArbitrator` | [`ITrustArbitrator`](https://docs.lacunasoftware.com/api/Lacuna.Pki/ITrustArbitrator) | A trust arbitrator to determine if the certificate can be trusted. |
| `certificate` | [`PKCertificate`](https://docs.lacunasoftware.com/api/Lacuna.Pki/PKCertificate) | The client's decoded certificate. If the authentication succeeds, this parameter is garanteed to be assigned to. If it fails, it may or may not be assigned to, depending on the stage on which the authentication failed. |

**Retorno**

[`ValidationResults`](https://docs.lacunasoftware.com/api/Lacuna.Pki/ValidationResults) — Whether the authentication succeeded or not, that is, if the client's certificate can be trusted according to the trust arbitrator chosen.

---

### `CompleteAsync(byte[], byte[], byte[], CertificateValidationOptions, CancellationToken)`

```csharp
public Task<PKCertificateAuthenticationResult> CompleteAsync(byte[] nonce, byte[] encodedCertificate, byte[] signature, CertificateValidationOptions certificateValidationOptions, CancellationToken cancellationToken = default)
```

**Parâmetros**

| Nome | Tipo | Descrição |
|---|---|---|
| `nonce` | [`byte[]`](https://learn.microsoft.com/dotnet/api/system.byte) |  |
| `encodedCertificate` | [`byte[]`](https://learn.microsoft.com/dotnet/api/system.byte) |  |
| `signature` | [`byte[]`](https://learn.microsoft.com/dotnet/api/system.byte) |  |
| `certificateValidationOptions` | [`CertificateValidationOptions`](https://docs.lacunasoftware.com/api/Lacuna.Pki/CertificateValidationOptions) |  |
| `cancellationToken` | [`CancellationToken`](https://learn.microsoft.com/dotnet/api/system.threading.cancellationtoken) |  |

**Retorno**

[`Task<PKCertificateAuthenticationResult>`](https://learn.microsoft.com/dotnet/api/system.threading.tasks.task-1)

---

### `CompleteAsync(byte[], byte[], byte[], ITrustArbitrator, CancellationToken)`

```csharp
public Task<PKCertificateAuthenticationResult> CompleteAsync(byte[] nonce, byte[] encodedCertificate, byte[] signature, ITrustArbitrator trustArbitrator, CancellationToken cancellationToken = default)
```

**Parâmetros**

| Nome | Tipo | Descrição |
|---|---|---|
| `nonce` | [`byte[]`](https://learn.microsoft.com/dotnet/api/system.byte) |  |
| `encodedCertificate` | [`byte[]`](https://learn.microsoft.com/dotnet/api/system.byte) |  |
| `signature` | [`byte[]`](https://learn.microsoft.com/dotnet/api/system.byte) |  |
| `trustArbitrator` | [`ITrustArbitrator`](https://docs.lacunasoftware.com/api/Lacuna.Pki/ITrustArbitrator) |  |
| `cancellationToken` | [`CancellationToken`](https://learn.microsoft.com/dotnet/api/system.threading.cancellationtoken) |  |

**Retorno**

[`Task<PKCertificateAuthenticationResult>`](https://learn.microsoft.com/dotnet/api/system.threading.tasks.task-1)

---

### `Start()`

Starts an authentication, generating and storing a new cryptographic nonce.

```csharp
public byte[] Start()
```

**Retorno**

[`byte[]`](https://learn.microsoft.com/dotnet/api/system.byte) — The nonce (16-byte byte array) that the client must digitally sign.

---

### `StartAsync(CancellationToken)`

```csharp
public Task<byte[]> StartAsync(CancellationToken cancellationToken = default)
```

**Parâmetros**

| Nome | Tipo | Descrição |
|---|---|---|
| `cancellationToken` | [`CancellationToken`](https://learn.microsoft.com/dotnet/api/system.threading.cancellationtoken) |  |

**Retorno**

[`Task<byte[]>`](https://learn.microsoft.com/dotnet/api/system.threading.tasks.task-1)

---

## Membros herdados

[`ToString()`](https://learn.microsoft.com/dotnet/api/system.object.tostring), [`Equals(object)`](<https://learn.microsoft.com/dotnet/api/system.object.equals#system-object-equals(system-object)>), [`Equals(object, object)`](<https://learn.microsoft.com/dotnet/api/system.object.equals#system-object-equals(system-object-system-object)>), [`ReferenceEquals(object, object)`](https://learn.microsoft.com/dotnet/api/system.object.referenceequals), [`GetHashCode()`](https://learn.microsoft.com/dotnet/api/system.object.gethashcode), [`GetType()`](https://learn.microsoft.com/dotnet/api/system.object.gettype), [`MemberwiseClone()`](https://learn.microsoft.com/dotnet/api/system.object.memberwiseclone)