SecureSocket.initialize should be able to load in-memory certificate stores

[nex3]

Currently SecureSocket.initialize can only load certificate data from a file that's physically present on the filesystem. This makes it very awkward to configure SecureSocket, especially in programs distributed to third-party users. It would be preferable to be able to manipulate the certificate store in memory, especially for the relatively common use case of adding a few certificates to the store.

[madsager]

I agree that it would be handy to be able to add a couple of certificates to the default database in Dart code.

We were trying to avoid having to make certificate management available in dart:io because there are external tools available to manage databases. Shipping a dart program to users involves shipping the dart files already and shipping a custom database directory as a resource seems reasonable.

Having to get familiar with an external tool just to add a couple of certificates is painful though, so we should have a look at making that common case possible directly.

---

Set owner to @whesse.
Removed Type-Defect label.
Added Type-Enhancement, Accepted labels.

[whesse]

Added Started label.

[whesse]

It is more difficult to add a certificate with a corresponding private key, than it is to just add a certificate. So I'll start with just the code to add a certificate to the in-memory certificate store, from various certificate encodings.

[sgjesse]

Added this to the M6 milestone.

[sgjesse]

This was done in https://code.google.com/p/dart/source/detail?r=25610 (certificate) and https://code.google.com/p/dart/source/detail?r=26002 (certificate with private key).

However as the might cause issues when running multiple isolates as changes in one isolate will affect other isolates and could lead to unexpected results. This was removed again in https://code.google.com/p/dart/source/detail?r=26194.

For now use the NSS certutil program (https://developer.mozilla.org/en-US/docs/NSS_reference/NSS_tools_:_certutil) to manage the certificate database. certutil can be run from Dart as a separate process to set up the certificate database before SecureSocket.initialize is called.

---

Added AsDesigned label.

[nex3]

It also seems like a problem that multiple isolates share the same certificate store. I've filed issue #12491 to track that. Can we mark this blocked on that issue rather than marking it AsDesigned?

[sgjesse]

Currently NSS does not support initialization more that once, and the database is process wide. There might be some work on changing this, see https://wiki.mozilla.org/NSS_Library_Init.

---

Removed the owner.
Removed this from the M6 milestone.
Added this to the Later milestone.
Removed Priority-Medium label.
Added Priority-Low, Waiting labels.
Marked this as being blocked by #12491.

[kevmoo]

Removed Area-IO label.
Added Library-IO, Area-Library labels.

[kasperl]

Removed this from the Later milestone.
Added Oldschool-Milestone-Later label.

[kasperl]

Removed Oldschool-Milestone-Later label.

[whesse]

I am now working on adding SecurityContext.setTrustedCertificatesFromString , .setCertificateChainFromString, and .setPrivateKeyFromString, to supplement the existing methods (new in 1.13, with the shift to BoringSSL) that read these from files.

That will resolve this issue. The issue about separate stores for separate isolates is already solved by BoringSSL in 1.13.

[whesse]

This issue is not dead, and should be fixed when possible.

[mit-mit]

@zanderso what is the status?

[zanderso]

This was fixed by the above commit.