Support Dynamic Client Certificate

[anrossi]

Describe the feature you'd like supported

Dynamic cert: The caller provides a callback that is invoked when the server asks for a certificate. The input is the issuers list (is there any other data available?) and the result is an optional certificate. (Compare to SslStream's callback).

[DemiMarie]

Describe the feature you'd like supported

Dynamic cert: The caller provides a callback that is invoked when the server asks for a certificate. The input is the issuers list (is there any other data available?) and the result is an optional certificate. (Compare to SslStream's callback).

The callback will often involve user interaction. Also, the user will often only have oracle access to the key.

[wfurt]

For the last comment, I think we should support QUIC_STATUS_PENDING to park the handshake and allow async lookup or UI thread to get what is needed.

[DemiMarie]

@wfurt Often, the actual signing will itself need to be async, too. Consider a key on a smart card, which is very slow.

[nibanks]

@wfurt could you please provide a bit more context and priority on this issue? I'm not sure about supporting this.

[wfurt]

This could have multiple parts (or levels of completeness): For SslStream and HTTP/1.1, HTTP/2 we let user to provide certificate via callback instead of specifying it upfront. So if Server asks for it and no certificate was provided so far, I think MsQuic should raise event and wait for certificate. That can be either valid handle or it can be null of client does not have (or wishes to send) certificate. This should be symmetric with server side e.g. we should be able to give you some answer or return QUIC_STATUS_PENDING and give the answer later. Ability to park would be nice but not necessary as LocalCertificateSelectionCallback is synchronous API.

Note that https://docs.microsoft.com/en-us/dotnet/api/system.net.security.localcertificateselectioncallback?view=net-6.0 also has acceptableIssuers. If the server provided list of CAs, we would populate the array with that list. This part is nice to have IMHO and was broken for while on all platforms but Windows.

This was marked as high priority because it is gap to previous HTTP versions.
cc: @rzikm @ManickaP