diff --git a/CHANGELOG.md b/CHANGELOG.md index 82ae381..95ad961 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,9 @@ # Certificate Manager change log + +## 2020-11-21 version 1.0.6 +* Add support for all SubjectAlternativeName properties + ## 2020-11-21 * Updated packages, move to .NET 6 diff --git a/Documentation.md b/Documentation.md index 07f88e5..64d051a 100644 --- a/Documentation.md +++ b/Documentation.md @@ -19,7 +19,7 @@ Certificate Manager is a package which makes it easy to create certificates (cha Add the NuGet package to the your project file ``` - + ``` The NuGet packages uses dependency injection to setup. In a console application initialize the package as follows: diff --git a/README.md b/README.md index 71c71b1..ae4cf9d 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,7 @@ Add the NuGet package to the your project file ``` - + ``` The NuGet packages uses dependency injection to setup. In a console application initialize the package as follows: diff --git a/src/CertificateManager/CertificateManager.csproj b/src/CertificateManager/CertificateManager.csproj index f5d1be8..0e53fa6 100644 --- a/src/CertificateManager/CertificateManager.csproj +++ b/src/CertificateManager/CertificateManager.csproj @@ -12,10 +12,10 @@ certificate authentication mtls pfx cer pem cert crt bug fix Subject Key Identifier - 2020 damienbod + 2021 damienbod true damienbod - 1.0.5 + 1.0.6 true true snupkg diff --git a/src/CertificateManager/CertificateUtility.cs b/src/CertificateManager/CertificateUtility.cs index 1b97356..ad71266 100644 --- a/src/CertificateManager/CertificateUtility.cs +++ b/src/CertificateManager/CertificateUtility.cs @@ -41,16 +41,31 @@ public void AddSubjectAlternativeName(CertificateRequest request, SubjectAlterna } var sanBuilder = new SubjectAlternativeNameBuilder(); - foreach(var dnsName in subjectAlternativeName.DnsName) + foreach (var dnsName in subjectAlternativeName.DnsName) { sanBuilder.AddDnsName(dnsName); } - if(!string.IsNullOrEmpty(subjectAlternativeName.Email)) + if (!string.IsNullOrEmpty(subjectAlternativeName.Email)) { sanBuilder.AddEmailAddress(subjectAlternativeName.Email); } + if (subjectAlternativeName.IpAddress != null) + { + sanBuilder.AddIpAddress(subjectAlternativeName.IpAddress); + } + + if (!string.IsNullOrEmpty(subjectAlternativeName.UserPrincipalName)) + { + sanBuilder.AddUserPrincipalName(subjectAlternativeName.UserPrincipalName); + } + + if (subjectAlternativeName.Uri != null) + { + sanBuilder.AddUri(subjectAlternativeName.Uri); + } + var sanExtension = sanBuilder.Build(); request.CertificateExtensions.Add(sanExtension); } diff --git a/src/CertificateManager/CreateCertificates.cs b/src/CertificateManager/CreateCertificates.cs index 5f9f916..88971a7 100644 --- a/src/CertificateManager/CreateCertificates.cs +++ b/src/CertificateManager/CreateCertificates.cs @@ -69,15 +69,15 @@ public X509Certificate2 NewECDsaSelfSignedCertificate( SubjectAlternativeName subjectAlternativeName, OidCollection enhancedKeyUsages, X509KeyUsageFlags x509KeyUsageFlags, - CertificateRequest request) + CertificateRequest request) { X509Certificate2 generatedCertificate = SelfSignedConfiguration( - basicConstraints, - validityPeriod, - subjectAlternativeName, - enhancedKeyUsages, - x509KeyUsageFlags, + basicConstraints, + validityPeriod, + subjectAlternativeName, + enhancedKeyUsages, + x509KeyUsageFlags, request); return generatedCertificate; @@ -96,7 +96,7 @@ public X509Certificate2 NewRsaSelfSignedCertificate( var request = new CertificateRequest( _certificateUtility.CreateIssuerOrSubject(distinguishedName), rsa, - rsaConfiguration.HashAlgorithmName, + rsaConfiguration.HashAlgorithmName, rsaConfiguration.RSASignaturePadding); return NewRsaSelfSignedCertificate(basicConstraints, @@ -117,11 +117,11 @@ public X509Certificate2 NewRsaSelfSignedCertificate( { X509Certificate2 generatedCertificate = SelfSignedConfiguration( - basicConstraints, - validityPeriod, - subjectAlternativeName, - enhancedKeyUsages, - x509KeyUsageFlags, + basicConstraints, + validityPeriod, + subjectAlternativeName, + enhancedKeyUsages, + x509KeyUsageFlags, request); return generatedCertificate; @@ -174,12 +174,12 @@ public X509Certificate2 NewRsaChainedCertificate( } X509Certificate2 cert = ChainedConfiguration( - basicConstraints, - validityPeriod, - subjectAlternativeName, - signingCertificate, - enhancedKeyUsages, - x509KeyUsageFlags, + basicConstraints, + validityPeriod, + subjectAlternativeName, + signingCertificate, + enhancedKeyUsages, + x509KeyUsageFlags, request); if (rsa == null) @@ -239,17 +239,17 @@ public X509Certificate2 NewECDsaChainedCertificate( } X509Certificate2 cert = ChainedConfiguration( - basicConstraints, - validityPeriod, - subjectAlternativeName, - signingCertificate, - enhancedKeyUsages, - x509KeyUsageFlags, + basicConstraints, + validityPeriod, + subjectAlternativeName, + signingCertificate, + enhancedKeyUsages, + x509KeyUsageFlags, request); if (ecdsa == null) { return cert; - } + } else { return cert.CopyWithPrivateKey(ecdsa); @@ -283,7 +283,7 @@ private X509Certificate2 ChainedConfiguration(BasicConstraints basicConstraints, break; } } - + _certificateUtility.AddSubjectAlternativeName(request, subjectAlternativeName); // Enhanced key usages diff --git a/src/CertificateManager/CreateCertificatesClientServerAuth.cs b/src/CertificateManager/CreateCertificatesClientServerAuth.cs index aa04278..ccc7cc1 100644 --- a/src/CertificateManager/CreateCertificatesClientServerAuth.cs +++ b/src/CertificateManager/CreateCertificatesClientServerAuth.cs @@ -145,7 +145,8 @@ public X509Certificate2 NewDeviceVerificationCertificate( string deviceVerification, X509Certificate2 parentCertificateAuthority) { - var enhancedKeyUsages = new OidCollection { + var enhancedKeyUsages = new OidCollection + { }; var distinguishedName = new DistinguishedName @@ -250,7 +251,7 @@ public X509Certificate2 NewClientSelfSignedCertificate( ValidityPeriod validityPeriod, string dnsName) { - var enhancedKeyUsages = new OidCollection { + var enhancedKeyUsages = new OidCollection { OidLookup.ClientAuthentication }; @@ -289,7 +290,7 @@ private X509Certificate2 NewDeviceChainedCertificate( DistinguishedName distinguishedName, ValidityPeriod validityPeriod, string dnsName, - OidCollection enhancedKeyUsages, + OidCollection enhancedKeyUsages, X509Certificate2 parentCertificateAuthority) { var basicConstraints = new BasicConstraints diff --git a/src/CertificateManager/CreateCertificatesRsa.cs b/src/CertificateManager/CreateCertificatesRsa.cs index 80637a5..a1459dd 100644 --- a/src/CertificateManager/CreateCertificatesRsa.cs +++ b/src/CertificateManager/CreateCertificatesRsa.cs @@ -59,8 +59,11 @@ public X509Certificate2 CreateDevelopmentCertificate(string dnsName, int validit var certificate = _createCertificates.NewRsaSelfSignedCertificate( new DistinguishedName { CommonName = dnsName }, basicConstraints, - new ValidityPeriod { ValidFrom = DateTimeOffset.UtcNow, - ValidTo = DateTimeOffset.UtcNow.AddYears(validityPeriodInYears) }, + new ValidityPeriod + { + ValidFrom = DateTimeOffset.UtcNow, + ValidTo = DateTimeOffset.UtcNow.AddYears(validityPeriodInYears) + }, subjectAlternativeName, enhancedKeyUsages, x509KeyUsageFlags, diff --git a/src/CertificateManager/ImportExportCertificate.cs b/src/CertificateManager/ImportExportCertificate.cs index 8fb68e6..8a1a9b8 100644 --- a/src/CertificateManager/ImportExportCertificate.cs +++ b/src/CertificateManager/ImportExportCertificate.cs @@ -68,14 +68,14 @@ public string PemExportPfxFullCertificate(X509Certificate2 cert, string password StringBuilder builder = new StringBuilder(); builder.AppendLine(PemDecoder.GetBegin(PemTypes.CERTIFICATE)); - if(string.IsNullOrEmpty(password)) + if (string.IsNullOrEmpty(password)) { - builder.AppendLine(Convert.ToBase64String(cert.Export(X509ContentType.Pfx), + builder.AppendLine(Convert.ToBase64String(cert.Export(X509ContentType.Pfx), Base64FormattingOptions.InsertLineBreaks)); } else { - builder.AppendLine(Convert.ToBase64String(cert.Export(X509ContentType.Pfx, password), + builder.AppendLine(Convert.ToBase64String(cert.Export(X509ContentType.Pfx, password), Base64FormattingOptions.InsertLineBreaks)); } builder.AppendLine(PemDecoder.GetEnd(PemTypes.CERTIFICATE)); @@ -148,7 +148,7 @@ public string PemExportPublicKeyCertificate(X509Certificate2 certificate) StringBuilder builder = new StringBuilder(); builder.AppendLine(PemDecoder.GetBegin(PemTypes.CERTIFICATE)); builder.AppendLine(Convert.ToBase64String(deviceVerifyPublicKeyBytes, - Base64FormattingOptions.InsertLineBreaks)); + Base64FormattingOptions.InsertLineBreaks)); builder.AppendLine(PemDecoder.GetEnd(PemTypes.CERTIFICATE)); return builder.ToString(); } @@ -186,15 +186,15 @@ public AsymmetricAlgorithm PemImportPrivateKey(string pemCertificate) } public X509Certificate2 CreateCertificateWithPrivateKey( - X509Certificate2 certificate, - AsymmetricAlgorithm privateKey, + X509Certificate2 certificate, + AsymmetricAlgorithm privateKey, string password = null) { return PemDecoder.CreateCertificateWithPrivateKey(certificate, privateKey, password); } private byte[] CertificateToPfx(string password, - X509Certificate2 certificate, + X509Certificate2 certificate, X509Certificate2 signingCertificate, X509Certificate2Collection chain) { diff --git a/src/CertificateManager/Models/ECDsaConfiguration.cs b/src/CertificateManager/Models/ECDsaConfiguration.cs index 7fe5c3a..aa42e68 100644 --- a/src/CertificateManager/Models/ECDsaConfiguration.cs +++ b/src/CertificateManager/Models/ECDsaConfiguration.cs @@ -10,6 +10,6 @@ public class ECDsaConfiguration public int KeySize { get; set; } = 256; public HashAlgorithmName HashAlgorithmName { get; set; } = HashAlgorithmName.SHA256; - + } } diff --git a/src/CertificateManager/Models/RsaConfiguration.cs b/src/CertificateManager/Models/RsaConfiguration.cs index 7b61753..464bd86 100644 --- a/src/CertificateManager/Models/RsaConfiguration.cs +++ b/src/CertificateManager/Models/RsaConfiguration.cs @@ -15,6 +15,6 @@ public class RsaConfiguration public RSASignaturePadding RSASignaturePadding { get; set; } = RSASignaturePadding.Pkcs1; public HashAlgorithmName HashAlgorithmName { get; set; } = HashAlgorithmName.SHA256; - + } } diff --git a/src/CertificateManager/Models/SubjectAlternativeName.cs b/src/CertificateManager/Models/SubjectAlternativeName.cs index caca1d9..caa1a81 100644 --- a/src/CertificateManager/Models/SubjectAlternativeName.cs +++ b/src/CertificateManager/Models/SubjectAlternativeName.cs @@ -1,4 +1,6 @@ -using System.Collections.Generic; +using System; +using System.Collections.Generic; +using System.Net; namespace CertificateManager.Models { @@ -14,5 +16,16 @@ public class SubjectAlternativeName /// optional /// public string Email { get; set; } + + /// + /// optional + /// + public IPAddress IpAddress { get; set; } = null; + + /// + /// optional + /// + public string UserPrincipalName { get; set; } + public Uri Uri { get; set; } = null; } } diff --git a/src/CertificateManager/PemDecoder.cs b/src/CertificateManager/PemDecoder.cs index 835a833..98c9a07 100644 --- a/src/CertificateManager/PemDecoder.cs +++ b/src/CertificateManager/PemDecoder.cs @@ -127,8 +127,8 @@ AsymmetricAlgorithm RSAKey(ReadOnlySpan bytes) } public static X509Certificate2 CreateCertificateWithPrivateKey( - X509Certificate2 certificate, - AsymmetricAlgorithm privateKey, + X509Certificate2 certificate, + AsymmetricAlgorithm privateKey, string password = null) { var builder = new Pkcs12Builder(); diff --git a/src/CertificateManager/PemTypes.cs b/src/CertificateManager/PemTypes.cs index ce90dac..97d41af 100644 --- a/src/CertificateManager/PemTypes.cs +++ b/src/CertificateManager/PemTypes.cs @@ -77,6 +77,6 @@ public static class PemTypes public const string ENCRYPTED_PRIVATE_KEY = "ENCRYPTED PRIVATE KEY"; public static readonly string[] KnownTypes = new[] { RSA_PRIVATE_KEY, PRIVATE_KEY, ENCRYPTED_PRIVATE_KEY, EC_PRIVATE_KEY }; - + } } diff --git a/src/CertificateManagerTests/CertificateManagerTests.csproj b/src/CertificateManagerTests/CertificateManagerTests.csproj index 6448c25..f9a3aef 100644 --- a/src/CertificateManagerTests/CertificateManagerTests.csproj +++ b/src/CertificateManagerTests/CertificateManagerTests.csproj @@ -2,8 +2,15 @@ net6.0 + false + + + + 1701;1702;CA1416 + - false + + 1701;1702;CA1416 diff --git a/src/CertificateManagerTests/ClientServerAuthTests.cs b/src/CertificateManagerTests/ClientServerAuthTests.cs index 9650b0d..fa248c0 100644 --- a/src/CertificateManagerTests/ClientServerAuthTests.cs +++ b/src/CertificateManagerTests/ClientServerAuthTests.cs @@ -11,7 +11,7 @@ namespace CertificateManagerTests { public class ClientServerAuthTests { - private (X509Certificate2 root, X509Certificate2 intermediate, X509Certificate2 server, X509Certificate2 client) SetupCerts() + private static (X509Certificate2 root, X509Certificate2 intermediate, X509Certificate2 server, X509Certificate2 client) SetupCerts() { var serviceProvider = new ServiceCollection() .AddCertificateManager() @@ -61,7 +61,7 @@ public void ValidateSelfSigned() [Fact] public void ValidateSelfSignedValid() { - var (root, intermediate, server, client) = SetupCerts(); + var (root, _, _, _) = SetupCerts(); var x509ChainPolicy = BuildChainUtil.BuildChainPolicySelfSigned(root, true, true); var chain = new X509Chain diff --git a/src/CertificateManagerTests/DistinguishedNameTests.cs b/src/CertificateManagerTests/DistinguishedNameTests.cs index bca9178..e86272b 100644 --- a/src/CertificateManagerTests/DistinguishedNameTests.cs +++ b/src/CertificateManagerTests/DistinguishedNameTests.cs @@ -20,13 +20,14 @@ public void DnCompleteValid() var rootCaL1 = createClientServerAuthCerts.NewRootCertificate( - new DistinguishedName { - CommonName = "root dev", - Country = "IT", - Locality = "DD", - Organisation="SS", - OrganisationUnit="unit", - StateProvince= "yes" + new DistinguishedName + { + CommonName = "root dev", + Country = "IT", + Locality = "DD", + Organisation = "SS", + OrganisationUnit = "unit", + StateProvince = "yes" }, new ValidityPeriod { ValidFrom = DateTime.UtcNow, ValidTo = DateTime.UtcNow.AddYears(10) }, 3, "localhost"); diff --git a/src/CertificateManagerTests/DnsNameTests.cs b/src/CertificateManagerTests/DnsNameTests.cs index 9b581d0..9791f22 100644 --- a/src/CertificateManagerTests/DnsNameTests.cs +++ b/src/CertificateManagerTests/DnsNameTests.cs @@ -51,7 +51,7 @@ public void DnsNameInvalid() 3, "local _ host"); }); - + } } diff --git a/src/CertificateManagerTests/ImportExportTests.cs b/src/CertificateManagerTests/ImportExportTests.cs index 96192cf..0c6873e 100644 --- a/src/CertificateManagerTests/ImportExportTests.cs +++ b/src/CertificateManagerTests/ImportExportTests.cs @@ -106,20 +106,20 @@ public void ImportExportIncorrectPasswordCrtPem() .BuildServiceProvider(); var importExport = serviceProvider.GetService(); - var exception = Assert.Throws (() => - { - try - { - var crtPem = importExport.PemExportPfxFullCertificate(intermediate, "23HHHH456"); - var roundTripCertificate = importExport.PemImportCertificate(crtPem, "23456"); - } - catch(Exception ex) - { - // internal Internal.Cryptography.CryptoThrowHelper+WindowsCryptographicException : The specified network password is not correct. - Assert.Equal("The specified network password is not correct.", ex.Message); - throw new ArgumentException(); - } - }); + var exception = Assert.Throws(() => + { + try + { + var crtPem = importExport.PemExportPfxFullCertificate(intermediate, "23HHHH456"); + var roundTripCertificate = importExport.PemImportCertificate(crtPem, "23456"); + } + catch (Exception ex) + { + // internal Internal.Cryptography.CryptoThrowHelper+WindowsCryptographicException : The specified network password is not correct. + Assert.Equal("The specified network password is not correct.", ex.Message); + throw new ArgumentException(); + } + }); } @@ -179,7 +179,7 @@ public void ImportExportRsaPrivateKeyPublicKeyPairPem() var roundTripPublicKeyPem = importExport.PemImportCertificate(publicKeyPem); var roundTripRsaPrivateKeyPem = importExport.PemImportPrivateKey(rsaPrivateKeyPem); - var roundTripFullCert = + var roundTripFullCert = importExport.CreateCertificateWithPrivateKey(roundTripPublicKeyPem, roundTripRsaPrivateKeyPem, "1234"); Assert.Equal(rsaCert.Subject, roundTripPublicKeyPem.Subject); @@ -207,7 +207,7 @@ public void ImportExportECPrivateKeyPublicKeyPairPem() var roundTripFullCert = importExport.CreateCertificateWithPrivateKey( - roundTripPublicKeyPem, + roundTripPublicKeyPem, roundTripRsaPrivateKeyPem, "1234"); Assert.Equal(root.Subject, roundTripPublicKeyPem.Subject); @@ -235,7 +235,7 @@ public void ImportExportSingleChainedECPrivateKeyPublicKeyPairPem() var roundTripFullCert = importExport.CreateCertificateWithPrivateKey( - roundTripPublicKeyPem, + roundTripPublicKeyPem, roundTripRsaPrivateKeyPem); Assert.Equal(server.Subject, roundTripPublicKeyPem.Subject); diff --git a/src/CertificateManagerTests/RsaKeySizeTests.cs b/src/CertificateManagerTests/RsaKeySizeTests.cs index cef5f3e..4e3e6e0 100644 --- a/src/CertificateManagerTests/RsaKeySizeTests.cs +++ b/src/CertificateManagerTests/RsaKeySizeTests.cs @@ -25,8 +25,8 @@ public void CreateChainedCertificatesRsaKeySizeTest() var chained1024 = CreateRsaCertificateChained(cc, 1024, cert2048); var chained4096 = CreateRsaCertificateChained(cc, 4096, cert2048); - Assert.Equal(1024, chained1024.PrivateKey.KeySize); - Assert.Equal(4096, chained4096.PrivateKey.KeySize); + Assert.Equal(1024, chained1024.GetRSAPrivateKey().KeySize); + Assert.Equal(4096, chained4096.GetRSAPrivateKey().KeySize); } [Fact] @@ -38,10 +38,10 @@ public void CreateCertificatesRsaKeySizeTest() var ccRsa = serviceProvider.GetService(); var cert2048 = ccRsa.CreateDevelopmentCertificate("localhost", 2, 2048); - Assert.Equal(2048, cert2048.PrivateKey.KeySize); + Assert.Equal(2048, cert2048.GetRSAPrivateKey().KeySize); var cert1024 = ccRsa.CreateDevelopmentCertificate("localhost", 2); - Assert.Equal(1024, cert1024.PrivateKey.KeySize); + Assert.Equal(1024, cert1024.GetRSAPrivateKey().KeySize); } [Fact] @@ -54,10 +54,10 @@ public void RsaKeySizeTest() var cc = serviceProvider.GetService(); var cert2048 = CreateRsaCertificate(cc, 2048); - Assert.Equal(2048, cert2048.PrivateKey.KeySize); + Assert.Equal(2048, cert2048.GetRSAPrivateKey().KeySize); - var cert4096= CreateRsaCertificate(cc, 4096); - Assert.Equal(4096, cert4096.PrivateKey.KeySize); + var cert4096 = CreateRsaCertificate(cc, 4096); + Assert.Equal(4096, cert4096.GetRSAPrivateKey().KeySize); } public static X509Certificate2 CreateRsaCertificate(CreateCertificates createCertificates, int keySize) diff --git a/src/CertificateManagerTests/SubjectAlternativeNameTests.cs b/src/CertificateManagerTests/SubjectAlternativeNameTests.cs new file mode 100644 index 0000000..a23badd --- /dev/null +++ b/src/CertificateManagerTests/SubjectAlternativeNameTests.cs @@ -0,0 +1,126 @@ +using CertificateManager; +using CertificateManager.Models; +using Microsoft.Extensions.DependencyInjection; +using System; +using System.Collections.Generic; +using System.Net; +using System.Security.Cryptography; +using System.Security.Cryptography.X509Certificates; +using Xunit; + +namespace CertificateManagerTests +{ + public class SubjectAlternativeNameTests + { + [Fact] + public void SubjectAlternativeNameValidAll() + { + var serviceProvider = new ServiceCollection() + .AddCertificateManager() + .BuildServiceProvider(); + + var createCertificates = serviceProvider.GetService(); + + var testCertificate = CreateSubjectAlternativeNameDetails( + new SubjectAlternativeName + { + DnsName = new List { "testones", "testtwos" }, + IpAddress = new IPAddress(2414), + Uri = new Uri("https://damienbod.com"), + UserPrincipalName = "myNameIsBob", + Email = "mick@jones.be" + }, + createCertificates); + + foreach (X509Extension extension in testCertificate.Extensions) + { + if (extension.Oid.FriendlyName == "Subject Alternative Name") + { + var asndata = new AsnEncodedData(extension.Oid, extension.RawData); + var data = asndata.Format(false); + var expected = "DNS Name=testones, DNS Name=testtwos, RFC822 Name=mick@jones.be, IP Address=110.9.0.0, Other Name:Principal Name=myNameIsBob, URL=https://damienbod.com/"; + + Assert.Equal(expected, data); + return; + } + } + + throw new Exception("no SubjectAlternativeName found"); + } + + [Fact] + public void SubjectAlternativeNameValidSomeValues() + { + var serviceProvider = new ServiceCollection() + .AddCertificateManager() + .BuildServiceProvider(); + + var createCertificates = serviceProvider.GetService(); + + var testCertificate = CreateSubjectAlternativeNameDetails( + new SubjectAlternativeName + { + DnsName = new List { "testones" }, + IpAddress = new IPAddress(2414) + }, + createCertificates); + + foreach (X509Extension extension in testCertificate.Extensions) + { + if (extension.Oid.FriendlyName == "Subject Alternative Name") + { + var asndata = new AsnEncodedData(extension.Oid, extension.RawData); + var data = asndata.Format(false); + var expected = "DNS Name=testones, IP Address=110.9.0.0"; + + Assert.Equal(expected, data); + return; + } + } + + throw new Exception("no SubjectAlternativeName found"); + } + + public static X509Certificate2 CreateSubjectAlternativeNameDetails( + SubjectAlternativeName subjectAlternativeName, + CreateCertificates createCertificates) + { + var distinguishedName = new DistinguishedName + { + CommonName = "root dev", + Country = "IT", + Locality = "DD", + Organisation = "SS", + OrganisationUnit = "unit", + StateProvince = "yes" + }; + var enhancedKeyUsages = new OidCollection { + OidLookup.ClientAuthentication, + OidLookup.ServerAuthentication + }; + + var basicConstraints = new BasicConstraints + { + CertificateAuthority = true, + HasPathLengthConstraint = true, + PathLengthConstraint = 3, + Critical = true + }; + + var validityPeriod = new ValidityPeriod { ValidFrom = DateTime.UtcNow, ValidTo = DateTime.UtcNow.AddYears(10) }; + + var x509KeyUsageFlags = X509KeyUsageFlags.KeyCertSign; + + var rootCert = createCertificates.NewECDsaSelfSignedCertificate( + distinguishedName, + basicConstraints, + validityPeriod, + subjectAlternativeName, + enhancedKeyUsages, + x509KeyUsageFlags, + new ECDsaConfiguration()); + + return rootCert; + } + } +} diff --git a/src/CreateAngularVueJsDevelopmentCertificates/CreateAngularVueJsDevelopmentCertificates.csproj b/src/CreateAngularVueJsDevelopmentCertificates/CreateAngularVueJsDevelopmentCertificates.csproj index a94937c..9591cbd 100644 --- a/src/CreateAngularVueJsDevelopmentCertificates/CreateAngularVueJsDevelopmentCertificates.csproj +++ b/src/CreateAngularVueJsDevelopmentCertificates/CreateAngularVueJsDevelopmentCertificates.csproj @@ -3,14 +3,22 @@ Exe net6.0 - true - true - snupkg - - - - - + true + true + snupkg + + + + 1701;1702;CA1416 + + + + 1701;1702;CA1416 + + + + + diff --git a/src/CreateChainedCertsConsoleDemo/CreateChainedCertsConsoleDemo.csproj b/src/CreateChainedCertsConsoleDemo/CreateChainedCertsConsoleDemo.csproj index 467a3bb..553dec3 100644 --- a/src/CreateChainedCertsConsoleDemo/CreateChainedCertsConsoleDemo.csproj +++ b/src/CreateChainedCertsConsoleDemo/CreateChainedCertsConsoleDemo.csproj @@ -5,6 +5,14 @@ net6.0 + + 1701;1702;CA1416 + + + + 1701;1702;CA1416 + + diff --git a/src/CreateChainedCertsConsoleDemo/LowLevel/DeviceCertConfig.cs b/src/CreateChainedCertsConsoleDemo/LowLevel/DeviceCertConfig.cs index f74ba34..b1ccd35 100644 --- a/src/CreateChainedCertsConsoleDemo/LowLevel/DeviceCertConfig.cs +++ b/src/CreateChainedCertsConsoleDemo/LowLevel/DeviceCertConfig.cs @@ -38,7 +38,7 @@ public static class DeviceCertConfig } }; - public static X509KeyUsageFlags X509KeyUsageFlags = + public static X509KeyUsageFlags X509KeyUsageFlags = X509KeyUsageFlags.DigitalSignature | X509KeyUsageFlags.KeyEncipherment; } } diff --git a/src/CreateChainedCertsConsoleDemo/Program.cs b/src/CreateChainedCertsConsoleDemo/Program.cs index 74273e2..89f714c 100644 --- a/src/CreateChainedCertsConsoleDemo/Program.cs +++ b/src/CreateChainedCertsConsoleDemo/Program.cs @@ -30,7 +30,7 @@ static void Main(string[] args) var intermediateCaL2 = createClientServerAuthCerts.NewIntermediateChainedCertificate( new DistinguishedName { CommonName = "intermediate dev", Country = "FR" }, new ValidityPeriod { ValidFrom = DateTime.UtcNow, ValidTo = DateTime.UtcNow.AddYears(10) }, - 2, "localhost", rootCaL1); + 2, "localhost", rootCaL1); intermediateCaL2.FriendlyName = "developement Intermediate L2 certificate"; // Server, Client L3 chained from Intermediate L2 @@ -45,7 +45,7 @@ static void Main(string[] args) "localhost", intermediateCaL2); serverL3.FriendlyName = "developement server L3 certificate"; clientL3.FriendlyName = "developement client L3 certificate"; - + Console.WriteLine($"Created Client, Server L3 Certificates {clientL3.FriendlyName}"); string password = "1234"; diff --git a/src/CreateIdentityServer4Certificates/CreateIdentityServer4Certificates.csproj b/src/CreateIdentityServer4Certificates/CreateIdentityServer4Certificates.csproj index 323a890..5191fa5 100644 --- a/src/CreateIdentityServer4Certificates/CreateIdentityServer4Certificates.csproj +++ b/src/CreateIdentityServer4Certificates/CreateIdentityServer4Certificates.csproj @@ -3,14 +3,22 @@ Exe net6.0 - true - true - snupkg - - - - - + true + true + snupkg + + + + 1701;1702;CA1416 + + + + 1701;1702;CA1416 + + + + + diff --git a/src/CreateIdentityServer4Certificates/Program.cs b/src/CreateIdentityServer4Certificates/Program.cs index 25cf6bf..9298f78 100644 --- a/src/CreateIdentityServer4Certificates/Program.cs +++ b/src/CreateIdentityServer4Certificates/Program.cs @@ -77,7 +77,7 @@ public static X509Certificate2 CreateRsaCertificate(string dnsName, int validity enhancedKeyUsages, x509KeyUsageFlags, new RsaConfiguration - { + { KeySize = 2048, HashAlgorithmName = HashAlgorithmName.SHA512 }); diff --git a/src/CreateSelfSignedCertsConsoleDemo/CreateSelfSignedCertsConsoleDemo.csproj b/src/CreateSelfSignedCertsConsoleDemo/CreateSelfSignedCertsConsoleDemo.csproj index 467a3bb..553dec3 100644 --- a/src/CreateSelfSignedCertsConsoleDemo/CreateSelfSignedCertsConsoleDemo.csproj +++ b/src/CreateSelfSignedCertsConsoleDemo/CreateSelfSignedCertsConsoleDemo.csproj @@ -5,6 +5,14 @@ net6.0 + + 1701;1702;CA1416 + + + + 1701;1702;CA1416 + + diff --git a/src/CreateSelfSignedCertsConsoleDemo/Program.cs b/src/CreateSelfSignedCertsConsoleDemo/Program.cs index 00bdd8e..3e8e645 100644 --- a/src/CreateSelfSignedCertsConsoleDemo/Program.cs +++ b/src/CreateSelfSignedCertsConsoleDemo/Program.cs @@ -36,11 +36,11 @@ static void Main(string[] args) string password = "1234"; var importExportCertificate = serviceProvider.GetService(); - var serverCertInPfxBtyes = + var serverCertInPfxBtyes = importExportCertificate.ExportSelfSignedCertificatePfx(password, server); File.WriteAllBytes("server.pfx", serverCertInPfxBtyes); - var clientCertInPfxBtyes = + var clientCertInPfxBtyes = importExportCertificate.ExportSelfSignedCertificatePfx(password, client); File.WriteAllBytes("client.pfx", clientCertInPfxBtyes); diff --git a/src/IoTHubCreateChainedCerts/IoTHubCreateChainedCerts.csproj b/src/IoTHubCreateChainedCerts/IoTHubCreateChainedCerts.csproj index a94937c..9591cbd 100644 --- a/src/IoTHubCreateChainedCerts/IoTHubCreateChainedCerts.csproj +++ b/src/IoTHubCreateChainedCerts/IoTHubCreateChainedCerts.csproj @@ -3,14 +3,22 @@ Exe net6.0 - true - true - snupkg - - - - - + true + true + snupkg + + + + 1701;1702;CA1416 + + + + 1701;1702;CA1416 + + + + + diff --git a/src/IoTHubCreateDeviceCertificate/IoTHubCreateDeviceCertificate.csproj b/src/IoTHubCreateDeviceCertificate/IoTHubCreateDeviceCertificate.csproj index 6b43887..c6f2e65 100644 --- a/src/IoTHubCreateDeviceCertificate/IoTHubCreateDeviceCertificate.csproj +++ b/src/IoTHubCreateDeviceCertificate/IoTHubCreateDeviceCertificate.csproj @@ -6,6 +6,14 @@ true true snupkg + + + + 1701;1702;CA1416 + + + + 1701;1702;CA1416 diff --git a/src/IoTHubCreateDeviceCertificate/Program.cs b/src/IoTHubCreateDeviceCertificate/Program.cs index 06c3d90..8b24e1b 100644 --- a/src/IoTHubCreateDeviceCertificate/Program.cs +++ b/src/IoTHubCreateDeviceCertificate/Program.cs @@ -28,7 +28,7 @@ static void Main(string[] args) new ValidityPeriod { ValidFrom = DateTime.UtcNow, ValidTo = DateTime.UtcNow.AddYears(10) }, "testdevice01", intermediate); testDevice01.FriendlyName = "IoT device testDevice01"; - + string password = "1234"; var importExportCertificate = serviceProvider.GetService(); diff --git a/src/IoTHubVerifyCertificate/IoTHubVerifyCertificate.csproj b/src/IoTHubVerifyCertificate/IoTHubVerifyCertificate.csproj index 0744f9f..743ddc0 100644 --- a/src/IoTHubVerifyCertificate/IoTHubVerifyCertificate.csproj +++ b/src/IoTHubVerifyCertificate/IoTHubVerifyCertificate.csproj @@ -6,6 +6,14 @@ true true snupkg + + + + 1701;1702;CA1416 + + + + 1701;1702;CA1416