-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Implement ExportPkcs12 #112569
base: main
Are you sure you want to change the base?
Implement ExportPkcs12 #112569
Conversation
This comment was marked as off-topic.
This comment was marked as off-topic.
1 similar comment
This comment was marked as off-topic.
This comment was marked as off-topic.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
PR Overview
This pull request implements the ExportPkcs12 functionality for X509Certificate and X509Certificate2Collection and refactors several ASN.1 codec types and interop structures to share common code. Key changes include:
- Adding a new P/Invoke signature for PFXExportCertStoreEx and a corresponding struct for PKCS12_PBES2_EXPORT_PARAMS.
- Enhancing the PkcsHelpers with new helper methods for BER decoding and attribute normalization.
- Updating the visibility and namespace for types such as Pkcs12IntegrityMode and several ASN.1 types from the Pkcs to the Pkcs7 namespace.
- Introducing a new flag (PKCS12_EXPORT_PBES2_PARAMS) in the PFXExportFlags enum.
Changes
File | Description |
---|---|
src/libraries/Common/src/Interop/Windows/Crypt32/Interop.PFXExportCertStoreEx.cs | Added new P/Invoke signature for certificate export. |
src/libraries/Common/src/Interop/Windows/Crypt32/Interop.PKCS12_PBES2_EXPORT_PARAMS.cs | Introduced new struct for PBES2 export parameters. |
src/libraries/Common/src/Internal/Cryptography/PkcsHelpers.cs | Added new BER decoding helper and attribute set normalization method. |
src/libraries/Common/src/System/Security/Cryptography/Pkcs/Pkcs12IntegrityMode.cs | Adjusted visibility based on build configuration. |
src/libraries/Common/src/System/Security/Cryptography/Pkcs/Pkcs12Info.cs | Modified access level and removed unused using statement. |
src/libraries/Common/src/System/Security/Cryptography/Asn1/Pkcs7/*.xml.cs | Updated various ASN.1 types to use the Pkcs7 namespace. |
src/libraries/Common/src/Interop/Windows/Crypt32/Interop.PFXExportFlags.cs | Added export flag for PBES2 parameters. |
Copilot reviewed 61 out of 61 changed files in this pull request and generated no comments.
Tip: If you use Visual Studio Code, you can request a review from Copilot before you push from the "Source Control" tab. Learn more
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/Helpers.cs
Outdated
Show resolved
Hide resolved
...ty.Cryptography/src/System/Security/Cryptography/X509Certificates/StorePal.Windows.Export.cs
Show resolved
Hide resolved
...ty.Cryptography/src/System/Security/Cryptography/X509Certificates/StorePal.Windows.Export.cs
Show resolved
Hide resolved
...ty.Cryptography/src/System/Security/Cryptography/X509Certificates/StorePal.Windows.Export.cs
Show resolved
Hide resolved
...ty.Cryptography/src/System/Security/Cryptography/X509Certificates/StorePal.Windows.Export.cs
Show resolved
Hide resolved
...Cryptography/src/System/Security/Cryptography/X509Certificates/X509Certificate2Collection.cs
Outdated
Show resolved
Hide resolved
src/libraries/System.Security.Cryptography/tests/X509Certificates/ExportTests.cs
Show resolved
Hide resolved
src/libraries/System.Security.Cryptography/tests/X509Certificates/ExportTests.cs
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Couple of nits, but overall LGTM
This implements
ExportPkcs12
onX509Certificate
andX509Certificate2Collection
.Most of this pull request is minor shuffling to allow pulling
Pkcs12Info
and the related ASN.1 codecs in to Common.PbeParameters
.Pkcs12ExportPbeParameters
is mapped to the windows-equivalent.Pkcs12ExportPbeParameters
, will rely on the Win32 API, if it can.Pkcs12TripleDesSha1
is always exported byPFXExportCertStoreEx
.Pbes2Aes256Sha256
is exported byPFXExportCertStoreEx
withPKCS12_PBES2_EXPORT_PARAMS
, if it is available (Windows 10, 1709+).PKCS12_PBES2_EXPORT_PARAMS
is not available on the platform, it is exported asPkcs12TripleDesSha1
and re-created with Windows-equivalent parameters.PbeParamters
, will export viaPFXExportCertStoreEx
, preferring PBES2 if it is available. It is then re-encoded with the specifiedPbeParameters
.Closes #80314