Skip to content

certificates added to user CertificateAuthority store are ignored by X509Chain.Build on macOS #48207

@wfurt

Description

@wfurt

This is subset of #48017 as the underlying issue seems different.
I basically have fragment like

    using (X509Store store = new X509Store(StoreName.CertificateAuthority, StoreLocation.CurrentUser))
    {
        // add chain certificate so we can construct chain since there is no way how to pass intermediates directly.
        store.Open(OpenFlags.ReadWrite);
        store.AddRange(clientChain);
        store.Close();
    }
    
    var chain = new X509Chain();
    ....
    bool chainStatus = chain.Build(clientCertificate);

It works on Linux & Windows but it fails consistently on macOS (10.15)
Interestingly, it works if I use StoreName.My instead.

It seems like that store does not have standard OS KeyChain mapping and that is reason why the chain does not build correctly. If that is true, it would be nice if we can feed reference to the keychain or it's collection automaticaly so validation and chain building works consistently across platforms.
In SslStream this primarily impacts cases with client certificates.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions