CertificateLoader.LoadFromStoreCert() doesn't work as expected

[njuzwr]

According to codes , the API should return the last expired cert if there're multiple certs found by cert subject name. But it doesn't.

foreach (var certificate in storeCertificates.Find(X509FindType.FindBySubjectName, subject, !allowInvalid)
    .OfType<X509Certificate2>()
    .Where(IsCertificateAllowedForServerAuth)
    .Where(DoesCertificateHaveAnAccessiblePrivateKey)
    .OrderByDescending(certificate => certificate.NotAfter))

The machine has two certs installed.

PS C:\Program Files\Microsoft\Exchange Test\FocusTestModules\ContactCleanupVxFocusTests> Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -match "auth.exchangelabs" } | fl


Subject      : CN=auth.exchangelabs.live-int.com, OU=Exchange, O=Microsoft, L=Redmond, S=Washington, C=US
Issuer       : CN=MS Passport Test Sub CA, DC=redmond, DC=corp, DC=microsoft, DC=com
Thumbprint   : 548F7596B54D143AC4F87A7D2DCC4E73B071CE19
FriendlyName : auth.exchangelabs.live-int.com
NotBefore    : 11/20/2009 10:14:04 PM
NotAfter     : 12/13/2031 2:26:07 PM
Extensions   : {System.Security.Cryptography.Oid, System.Security.Cryptography.Oid, System.Security.Cryptography.Oid,
               System.Security.Cryptography.Oid...}

Subject      : CN=auth.exchangelabs.live-int.com, OU=Exchange, O=Microsoft, L=Redmond, S=Washington, C=US
Issuer       : CN=auth.exchangelabs.live-int.com, OU=Exchange, O=Microsoft, L=Redmond, S=Washington, C=US
Thumbprint   : 028D50648D9514FC21E4322570A73522A0B1C83E
FriendlyName : auth.exchangelabs.live-int.com
NotBefore    : 2/6/2025 6:10:29 AM
NotAfter     : 3/10/2025 7:20:29 AM
Extensions   : {System.Security.Cryptography.Oid, System.Security.Cryptography.Oid, System.Security.Cryptography.Oid,
               System.Security.Cryptography.Oid}

But the API CertificateLoader.LoadFromStoreCert(certSubjectName, StoreName.My.ToString(), StoreLocation.LocalMachine, false); always return this one. 028D50648D9514FC21E4322570A73522A0B1C83E. However if I expand the LINQ expression to separate steps like this. It works fine.

                try
                {
                    store.Open(OpenFlags.ReadOnly);
                    storeCertificates = store.Certificates;

                    var certificates = storeCertificates.Find(X509FindType.FindBySubjectName, subject, !allowInvalid);
                    this.config.Logger.LogInfo(loggingContext, $"Found {certificates.Count} certificates with subject {subject} in store {storeName}.");
                    this.config.Logger.LogInfo(loggingContext, $"Found {string.Join(";", certificates.Select(c => c.Thumbprint).ToList())}.");

                    var validCertificates = certificates.OfType<X509Certificate2>().Where(this.IsCertificateAllowedForServerAuth);
                    this.config.Logger.LogInfo(loggingContext, $"Found valid {string.Join(";", validCertificates.Select(c => c.Thumbprint).ToList())}.");

                    var certificatesWithAccessiblePrivateKey = validCertificates.Where(this.DoesCertificateHaveAnAccessiblePrivateKey);
                    this.config.Logger.LogInfo(loggingContext, $"Found accessiable private key {string.Join(";", certificatesWithAccessiblePrivateKey.Select(c => c.Thumbprint).ToList())}.");

                    var orderedCertificates = certificatesWithAccessiblePrivateKey.OrderByDescending(certificate => certificate.NotAfter);
                    this.config.Logger.LogInfo(loggingContext, $"Found ordered {string.Join(";", orderedCertificates.Select(c => c.Thumbprint).ToList())}.");

                    foreach (var certificate in orderedCertificates)
                    {
                        // Pick the first one if there's no exact match as a fallback to substring default.
                        foundCertificate ??= certificate;

                        if (certificate.GetNameInfo(X509NameType.SimpleName, forIssuer: false).Equals(subject, StringComparison.InvariantCultureIgnoreCase))
                        {
                            foundCertificate = certificate;
                            break;
                        }
                    }

                    if (foundCertificate == null)
                    {
                        throw new InvalidOperationException("No certificate found");
                    }

                    return foundCertificate;
                }

Output logs:

Found 2 certificates with subject auth.exchangelabs.live-int.com in store My.
Found 548F7596B54D143AC4F87A7D2DCC4E73B071CE19;028D50648D9514FC21E4322570A73522A0B1C83E.
Found valid 548F7596B54D143AC4F87A7D2DCC4E73B071CE19;028D50648D9514FC21E4322570A73522A0B1C83E.
Found accessiable private key 548F7596B54D143AC4F87A7D2DCC4E73B071CE19;028D50648D9514FC21E4322570A73522A0B1C83E.
Found ordered 548F7596B54D143AC4F87A7D2DCC4E73B071CE19;028D50648D9514FC21E4322570A73522A0B1C83E.
Loaded cert 548F7596B54D143AC4F87A7D2DCC4E73B071CE19 by self codes

Loaded cert 028D50648D9514FC21E4322570A73522A0B1C83E by CertificateLoader

Unfortunately this happened only in our test environment but I can't reproduce this on my own dev machine.