Don't depend on Windows' SSL implementation #290
Comments
|
Unfortunately there seems to be no way around it. Not unless we stop using Microsoft's and Mono's Even µHttpSharp, that handles the HTTP protocol on its own, relies on .NET Core has a fully managed implementation of From a quick look, the .NET Core managed implementation seems to use OpenSSL. This brings up interesting questions about dependencies and deployment. I think a serious discussion about this is better left for after the release of EmbedIO v3. |
|
We can check also how Kestrel is handling this. |
|
You're right @geoperez, I forgot to mention Kestrel! But alas, it uses |
rdeago
changed the title
|
But how is Kestrel binding to the BTW this is an interesting way to load a default cert: |
|
The topic of address / port binding deserves a conversation of its own, but in short Kestrel does not use Besides, no matter how we load a certificate, Maybe, and that's a big maybe, we could try to build the Unix implementation of |
|
For future reference: a managed wrapper for OpenSSL exists. It requires the unmanaged OpenSSL libraries, of course, and it seems to be for .NET 2.0, but it may be a starting point. |
|
Mono also has managed TLS support using Google's BoringSSL. The latter is, in Google's own words, an OpenSSL fork "not intended for general use". I guess there has to be a reason why Mono uses it, other than thinking different without being Apple. Anyway, one more bit of food for thought, and one more pile of third-party code to look into as soon as we have both the time and courage. |
I don't think so? Isn't The GitHub search link shows only three result (at least as of today, GitHub only search on master branch), and they have nothing to do with Kestrel and SSL. µHttpSharpis a .NET Framework only project. System.Net.HttpListenerBoth .NET Framework and .NET Core use On .NET Core it use a managed implementation, HTTPS implemented by Reference: KestrelKestrel is using netshNetsh commands for HTTP writes:
I don't think it have anything to do with SSPI /
|
|
During test I also find out currently if SSL handshake failed for some reason, a common reason is client doesn't trust server's certificate, entire proof of concept code: openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes
openssl pkcs12 -inkey key.pem -in cert.pem -export -out cert.pfx// Program.cs
using System;
using System.Net;
using System.Threading.Tasks;
using Unosquare.Labs.EmbedIO;
using Unosquare.Labs.EmbedIO.Constants;
using Unosquare.Labs.EmbedIO.Modules;
namespace sslstreamtest
{
class Program
{
static async Task Main(string[] args)
{
var hl = new Unosquare.Net.HttpListener(new System.Security.Cryptography.X509Certificates.X509Certificate2("cert.pfx"));
var server = new WebServer(new string[]{"https://*:8899/"}, RoutingStrategy.Regex, hl);
await server.RunAsync();
}
}
}Request with curl without
|
|
@Genteure the problem with SSPI (which The idea was to try and recompile .NET COre's or Mono's TLS support for Linux to make it work on other systems (primarily Windows). Since OpenSSL has Windows binaries available (not sure about BoringSSL but I'd say yes, since it's used by Chrome) it should be possible to support secure connections without relying on SSPI. |
|
Can you write a example code to elaborate why SSPI would need to use Here's my POC, it runs on .NET Core Windows, without netsh. static async Task Main(string[] args)
{
var serverCert = new X509Certificate2("cert.pfx");
var sock = new Socket(SocketType.Stream, ProtocolType.Tcp);
sock.Bind(new IPEndPoint(IPAddress.Any, 8877));
sock.Listen(8);
while (true)
{
try
{
Socket accepted = await sock.AcceptAsync();
var ns = new NetworkStream(accepted, true);
var ss = new SslStream(ns);
var options = new SslServerAuthenticationOptions
{
CertificateRevocationCheckMode = X509RevocationMode.NoCheck,
ClientCertificateRequired = false,
RemoteCertificateValidationCallback =
(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors) =>
{
// check client certificate
return true;
},
ServerCertificateSelectionCallback =
(object sender, string hostName) =>
{
// check hostName
return serverCert;
}
};
await ss.AuthenticateAsServerAsync(options, default);
ss.Close();
ss.Dispose();
}
catch (Exception ex)
{
Console.WriteLine(ex);
}
}
} |
|
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. |
rdeago
added
area:http
|
Sorry - seems quite obvious but nevertheless I would like to make it clear that as of today (october 2019) it doesn't support https on mobile platforms? |
|
Nop, the support to HTTPS right now is only with Windows. |
|
ssl is part of windows (kerberos) auth - it belongs to the security team not the network team. If you want to work beyond windows you will need to grab some other code - or perhaps put the code into platform specific modules. |
|
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. |
Is your feature request related to a problem? Please describe.
I'm always frustrated when I want to expose https, netsh is really a mess. I embed a golang reverse proxy server to resolve this problem in production.
Describe the solution you'd like
Is there a better way to do this in CSharp?
The text was updated successfully, but these errors were encountered: