IsolatedStorage to store rootcert.pfx instead of folder with EXE - would you like a PR?

[keyoti]

Hello, first this project is awesome, thanks.

Second, in my environment I can't store rootCert.pfx in the entry assembly location, so the code in CertificateManager doesn't work for me:

var fileName = Path.Combine(System.IO.Path.GetDirectoryName(System.Reflection.Assembly.GetEntryAssembly().Location), "rootCert.pfx");

instead I changed it to use IsolatedStorage.

In general I would think it's better to do it that way, would you like me to submit a pull request with this change?

[justcoding121]

You mean letting the user set the full path of pfx? That would be great.

[keyoti]

Not quite, the way I have it, it lives in the IsolatedStorage specific tor the user && assembly (the assem with the Titanium code). So it's kind of transparent to the library user. That means things like;

-All apps running under the same user will use the same certificate (is that OK?)
-Each user gets a different cert,

Our RapidSpell library stores the user's options in IsolatedStorage, and it works fine.

Here's the code I changed in CertificateManager

  using System.IO.IsolatedStorage;

GetRootCertificate becomes

internal X509Certificate2 GetRootCertificate()
        {
            //var fileName = Path.Combine(System.IO.Path.GetDirectoryName(System.Reflection.Assembly.GetEntryAssembly().Location), "rootCert.pfx");
            byte[] fileBytes;
            IsolatedStorageFile isoStore = IsolatedStorageFile.GetStore(IsolatedStorageScope.User | IsolatedStorageScope.Assembly, null, null);
            using (var streamReader = new BinaryReader(new IsolatedStorageFileStream("rootCert.pfx", FileMode.OpenOrCreate, FileAccess.Read, FileShare.Read, isoStore)))
            {
                fileBytes = streamReader.ReadBytes((int) streamReader.BaseStream.Length);
            }

                //if (File.Exists(fileName))
                if(fileBytes.Length>0)
                {
                    try
                    {
                        return new X509Certificate2(fileBytes/*fileName*/, string.Empty, X509KeyStorageFlags.Exportable);

                    }
                    catch (Exception e)
                    {
                        exceptionFunc(e);
                        return null;
                    }
                }
            return null;
        }

and CreateTrustedRootCertificate becomes

        internal bool CreateTrustedRootCertificate()
        {
            rootCertificate = GetRootCertificate();
            if (rootCertificate != null)
            {
                return true;
            }
            try
            {
                rootCertificate = CreateCertificate(RootCertificateName, true);
            }
            catch(Exception e)
            {
                exceptionFunc(e);
            }
            if (rootCertificate != null)
            {
                try
                {
                    //                 var fileName = Path.Combine(System.IO.Path.GetDirectoryName(System.Reflection.Assembly.GetEntryAssembly().Location), "rootCert.pfx");
                    //                 File.WriteAllBytes(fileName, rootCertificate.Export(X509ContentType.Pkcs12));
                    IsolatedStorageFile isoStore = IsolatedStorageFile.GetStore(IsolatedStorageScope.User | IsolatedStorageScope.Assembly, null, null);
                    using (BinaryWriter streamWriter = new BinaryWriter(new IsolatedStorageFileStream("rootCert.pfx", FileMode.Create, isoStore))) {
                        streamWriter.Write(rootCertificate.Export(X509ContentType.Pkcs12));
                    }
                    
                }
                catch (Exception e)
                {
                    exceptionFunc(e);
                }
            }
            return rootCertificate != null;
        }

I'm working on a fork, so I guess I have to make the change a clone of the main repo to do the PR

[justcoding121]

Hmm. That's something interesting, but I think is more of a specific use case.

I think letting the users specify the full path of the rootCert.pfx will give flexibility for developers to select it from whatever location they want including your use case.

[keyoti]

That's fine - you can't store in IsolatedStorage just by setting a path, but that's fine, it's not a huge change for people who do want to use Iso.Storage.

[justcoding121]

I think a better option would be to let user set the Certificate object directly instead of setting path. I will keep this open until that's done one day. That should let users pull it from local storage as well.

[honfika]

Why should we store it in a file?
X509Certificate2 can load it from byte[]

I think it would be enough to store it in memory, and maybe add a method which exports it if the user needs the file.

[honfika]

I'd like to implement this task with issue #149, too.
As you wrote, storing the Certificate object in a property CertificateManager + a public property to ProxyServer which gives it to the CertificateManager.
+Creating the certificate on demand for issue #149

[justcoding121]

@honfika I would love to see a PR for this.

So below two properties will be removed from ProxyServer class.

public string RootCertificateIssuerName { get; set; }
public string RootCertificateName { get; set; }

And a new property will be added

X509Certificate2 RootCertificate { get; set; }

And if the user do not set RootCertificate, then we will do the following.

1. we will check for "rootCert.pfx" in the current working directory first
2. If its not found, then we will create "rootCert.pfx" and save it in current working directory. The root certificate name will be "Titanium Root Certificate Authority" and issuer name will be "Titanium". This is so that we don't create new RootCertificates each time the proxy is started and RootCertificate is not set.
3. Next we will read the "rootCert.pfx" as our root certificate.

And finally we will Trust the loaded RootCertificate by checking below existing property. (Its true by default)

public bool TrustRootCertificate { get; set; }

[honfika]

"issuer name will be "Titanium""

Ok, but this property is currently not used in CertificateManager. Maybe it is a bug.
Just do not be suprised that it is also not used in my PR. Maybe later I'll add it to the ICertificateMaker.CreateCertificate interface method + implementations.

[justcoding121]

Fixed in @honfika latest PR.