use also SslCertificateTrust when constructing CertificateContext#103372
Merged
wfurt merged 6 commits intodotnet:mainfrom Jun 25, 2024
Merged
use also SslCertificateTrust when constructing CertificateContext#103372wfurt merged 6 commits intodotnet:mainfrom
wfurt merged 6 commits intodotnet:mainfrom
Conversation
Contributor
|
Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones |
rzikm
reviewed
Jun 13, 2024
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamCertificateContext.cs
Outdated
Show resolved
Hide resolved
src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamNetworkStreamTest.cs
Show resolved
Hide resolved
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamCertificateContext.cs
Show resolved
Hide resolved
Member
|
@wfurt the |
This was referenced Jun 20, 2024
Open
simonrozsival
approved these changes
Jun 21, 2024
3 tasks
This was referenced Jun 24, 2024
Member
Author
why don't you do that as separate PR @simonrozsival . Maybe there will be more changes or more tests to enable...? |
simonrozsival
pushed a commit
to simonrozsival/runtime
that referenced
this pull request
Jul 8, 2024
…tnet#103372) * use also SslCertificateTrust when constructing CertificateContext * 'build * feedback
Merged
4 tasks
vitek-karas
added a commit
that referenced
this pull request
Jul 15, 2024
…CertificateContext (#104541) Backport of #103372 and #104016 to release/8.0-staging ## Customer Impact - [X] Customer reported (#100602) - [ ] Found internally Customers developing Android apps are currently unable to use mutual TLS authentication in certain cases as the `SslStreamCertificateContext.Create(...)` method will fail to build an X509Chain instance if the certificate isn't trusted by the OS due to the limitations of the Android platform. ## Regression - [ ] Yes - [X] No ## Testing Unit tests and manual testing on Android emulator. ## Risk Low. The change is mostly limited to Android where this API doesn't currently work in many cases. --------- Co-authored-by: Tomas Weinfurt <tweinfurt@yahoo.com> Co-authored-by: Vitek Karas <10670590+vitek-karas@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
there are two parts to this change.
When #54219 added support for
SslCertificateTrustit did impact only certificate validation but notSslStreamCertificateContext. Back in the day it was available only for servers so it was not probably big deal. (as the primary focus was on sending trusted CA list in the handshake). #80182 added support also for client (in 8.0) and that opened more options here IMHO. First part of this change will useTrustif provided to construct the chain for consistency.Second part is specific to Android. It seems like we have difficulties to construct the chain unless the root CA is trusted.
The part above should help, but to make it more consistent with other platforms I also added fall-back attempt to build chain if intermediate certificates are provided. This is not used for avaluating trust so I feel it should be OK to use it to get list of certificates to send.
contributes to #100602
I assume @simonrozsival will follow-up on the android and update tests as needed and he would provide more insight if needed.