Skip to content

Commit 48da760

Browse files
amcaseyamcasey
committed
Also trust certificates in the Current User/Root store
A belt-and-suspenders approach for dotnet trust (i.e. in addition to OpenSSL trust) that has the notable advantage of not requiring any environment variables.
1 parent c89b7d4 commit 48da760

File tree

2 files changed

+144
-64
lines changed

2 files changed

+144
-64
lines changed

‎src/Shared/CertificateGeneration/CertificateManager.cs

Lines changed: 56 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -1090,11 +1090,11 @@ public sealed class CertificateManagerEventSource : EventSource
10901090
[Event(74, Level = EventLevel.Warning, Message = "The NSS database '{0}' provided via {1} does not exist.")]
10911091
internal void UnixNssDbDoesNotExist(string nssDb, string environmentVariable) => WriteEvent(74, nssDb, environmentVariable);
10921092

1093-
[Event(75, Level = EventLevel.Warning, Message = "The certificate is not trusted by OpenSSL. This will likely affect System.Net.Http.HttpClient.")]
1094-
internal void UnixNotTrustedByOpenSsl() => WriteEvent(75);
1093+
[Event(75, Level = EventLevel.Warning, Message = "The certificate is not trusted by .NET. This will likely affect System.Net.Http.HttpClient.")]
1094+
internal void UnixNotTrustedByDotnet() => WriteEvent(75);
10951095

1096-
[Event(76, Level = EventLevel.Warning, Message = "The certificate is not trusted by OpenSSL. Ensure that the {0} environment variable is set correctly. This will likely affect System.Net.Http.HttpClient.")]
1097-
internal void UnixNotTrustedByOpenSslVariableUnset(string envVarName) => WriteEvent(76, envVarName);
1096+
[Event(76, Level = EventLevel.Warning, Message = "The certificate is not trusted by OpenSSL. Ensure that the {0} environment variable is set correctly.")]
1097+
internal void UnixNotTrustedByOpenSsl(string envVarName) => WriteEvent(76, envVarName);
10981098

10991099
[Event(77, Level = EventLevel.Warning, Message = "The certificate is not trusted in the NSS database in '{0}'. This will likely affect the {1} family of browsers.")]
11001100
internal void UnixNotTrustedByNss(string path, string browser) => WriteEvent(77, path, browser);
@@ -1132,80 +1132,86 @@ public sealed class CertificateManagerEventSource : EventSource
11321132
"Manually rehashing may help. See https://aka.ms/dev-certs-trust for more information.")] // This should recommend manually running c_rehash.
11331133
internal void UnixOpenSslRehashException(string exceptionMessage) => WriteEvent(85, exceptionMessage);
11341134

1135-
[Event(86, Level = EventLevel.Warning, Message = "Clients that validate certificate trust using OpenSSL, including System.Net.Http.HttpClient, will not trust the certificate.")]
1136-
internal void UnixOpenSslTrustFailed() => WriteEvent(86);
1135+
[Event(86, Level = EventLevel.Warning, Message = "Failed to trust the certificate in .NET: {0}.")]
1136+
internal void UnixDotnetTrustException(string exceptionMessage) => WriteEvent(86, exceptionMessage);
11371137

1138-
[Event(87, Level = EventLevel.Verbose, Message = "Trusted the certificate in OpenSSL.")]
1139-
internal void UnixOpenSslTrustSucceeded() => WriteEvent(87);
1138+
[Event(87, Level = EventLevel.Warning, Message = "Clients that validate certificate trust using OpenSSL will not trust the certificate.")]
1139+
internal void UnixOpenSslTrustFailed() => WriteEvent(87);
11401140

1141-
[Event(88, Level = EventLevel.Warning, Message = "Failed to trust the certificate in the NSS database in '{0}'. This will likely affect the {1} family of browsers.")]
1142-
internal void UnixNssDbTrustFailed(string path, string browser) => WriteEvent(88, path, browser);
1141+
[Event(88, Level = EventLevel.Verbose, Message = "Trusted the certificate in OpenSSL.")]
1142+
internal void UnixOpenSslTrustSucceeded() => WriteEvent(88);
11431143

1144-
[Event(89, Level = EventLevel.Verbose, Message = "Trusted the certificate in the NSS database in '{0}'.")]
1145-
internal void UnixNssDbTrustSucceeded(string path) => WriteEvent(89, path);
1144+
[Event(89, Level = EventLevel.Warning, Message = "Failed to trust the certificate in the NSS database in '{0}'. This will likely affect the {1} family of browsers.")]
1145+
internal void UnixNssDbTrustFailed(string path, string browser) => WriteEvent(89, path, browser);
11461146

1147-
[Event(90, Level = EventLevel.Warning, Message = "Failed to untrust the certificate in OpenSSL.")]
1148-
internal void UnixOpenSslUntrustFailed() => WriteEvent(90);
1147+
[Event(90, Level = EventLevel.Verbose, Message = "Trusted the certificate in the NSS database in '{0}'.")]
1148+
internal void UnixNssDbTrustSucceeded(string path) => WriteEvent(90, path);
11491149

1150-
[Event(91, Level = EventLevel.Verbose, Message = "Untrusted the certificate in OpenSSL.")]
1151-
internal void UnixOpenSslUntrustSucceeded() => WriteEvent(91);
1150+
[Event(91, Level = EventLevel.Warning, Message = "Failed to untrust the certificate in .NET: {0}.")]
1151+
internal void UnixDotnetUntrustException(string exceptionMessage) => WriteEvent(91, exceptionMessage);
11521152

1153-
[Event(92, Level = EventLevel.Warning, Message = "Failed to remove the certificate from the NSS database in '{0}'.")]
1154-
internal void UnixNssDbUntrustFailed(string path) => WriteEvent(92, path);
1153+
[Event(92, Level = EventLevel.Warning, Message = "Failed to untrust the certificate in OpenSSL.")]
1154+
internal void UnixOpenSslUntrustFailed() => WriteEvent(92);
11551155

1156-
[Event(93, Level = EventLevel.Verbose, Message = "Removed the certificate from the NSS database in '{0}'.")]
1157-
internal void UnixNssDbUntrustSucceeded(string path) => WriteEvent(93, path);
1156+
[Event(93, Level = EventLevel.Verbose, Message = "Untrusted the certificate in OpenSSL.")]
1157+
internal void UnixOpenSslUntrustSucceeded() => WriteEvent(93);
11581158

1159-
[Event(94, Level = EventLevel.Warning, Message = "The certificate is only partially trusted - some clients will not accept it.")]
1160-
internal void UnixTrustPartiallySucceeded() => WriteEvent(94);
1159+
[Event(94, Level = EventLevel.Warning, Message = "Failed to remove the certificate from the NSS database in '{0}'.")]
1160+
internal void UnixNssDbUntrustFailed(string path) => WriteEvent(94, path);
11611161

1162-
[Event(95, Level = EventLevel.Warning, Message = "Failed to look up the certificate in the NSS database in '{0}': {1}.")]
1163-
internal void UnixNssDbCheckException(string path, string exceptionMessage) => WriteEvent(95, path, exceptionMessage);
1162+
[Event(95, Level = EventLevel.Verbose, Message = "Removed the certificate from the NSS database in '{0}'.")]
1163+
internal void UnixNssDbUntrustSucceeded(string path) => WriteEvent(95, path);
11641164

1165-
[Event(96, Level = EventLevel.Warning, Message = "Failed to add the certificate to the NSS database in '{0}': {1}.")]
1166-
internal void UnixNssDbAdditionException(string path, string exceptionMessage) => WriteEvent(96, path, exceptionMessage);
1165+
[Event(96, Level = EventLevel.Warning, Message = "The certificate is only partially trusted - some clients will not accept it.")]
1166+
internal void UnixTrustPartiallySucceeded() => WriteEvent(96);
11671167

1168-
[Event(97, Level = EventLevel.Warning, Message = "Failed to remove the certificate from the NSS database in '{0}': {1}.")]
1169-
internal void UnixNssDbRemovalException(string path, string exceptionMessage) => WriteEvent(97, path, exceptionMessage);
1168+
[Event(97, Level = EventLevel.Warning, Message = "Failed to look up the certificate in the NSS database in '{0}': {1}.")]
1169+
internal void UnixNssDbCheckException(string path, string exceptionMessage) => WriteEvent(97, path, exceptionMessage);
11701170

1171-
[Event(98, Level = EventLevel.Warning, Message = "Failed to find the Firefox profiles in directory '{0}': {1}.")]
1172-
internal void UnixFirefoxProfileEnumerationException(string firefoxDirectory, string message) => WriteEvent(98, firefoxDirectory, message);
1171+
[Event(98, Level = EventLevel.Warning, Message = "Failed to add the certificate to the NSS database in '{0}': {1}.")]
1172+
internal void UnixNssDbAdditionException(string path, string exceptionMessage) => WriteEvent(98, path, exceptionMessage);
11731173

1174-
[Event(99, Level = EventLevel.Verbose, Message = "No Firefox profiles found in directory '{0}'.")]
1175-
internal void UnixNoFirefoxProfilesFound(string firefoxDirectory) => WriteEvent(99, firefoxDirectory);
1174+
[Event(99, Level = EventLevel.Warning, Message = "Failed to remove the certificate from the NSS database in '{0}': {1}.")]
1175+
internal void UnixNssDbRemovalException(string path, string exceptionMessage) => WriteEvent(99, path, exceptionMessage);
11761176

1177-
[Event(100, Level = EventLevel.Warning, Message = "Failed to trust the certificate in the NSS database in '{0}'. This will likely affect the {1} family of browsers. " +
1177+
[Event(100, Level = EventLevel.Warning, Message = "Failed to find the Firefox profiles in directory '{0}': {1}.")]
1178+
internal void UnixFirefoxProfileEnumerationException(string firefoxDirectory, string message) => WriteEvent(100, firefoxDirectory, message);
1179+
1180+
[Event(101, Level = EventLevel.Verbose, Message = "No Firefox profiles found in directory '{0}'.")]
1181+
internal void UnixNoFirefoxProfilesFound(string firefoxDirectory) => WriteEvent(101, firefoxDirectory);
1182+
1183+
[Event(102, Level = EventLevel.Warning, Message = "Failed to trust the certificate in the NSS database in '{0}'. This will likely affect the {1} family of browsers. " +
11781184
"This likely indicates that the database already contains an entry for the certificate under a different name. Please remove it and try again.")]
1179-
internal void UnixNssDbTrustFailedWithProbableConflict(string path, string browser) => WriteEvent(100, path, browser);
1185+
internal void UnixNssDbTrustFailedWithProbableConflict(string path, string browser) => WriteEvent(102, path, browser);
11801186

11811187
// This may be annoying, since anyone setting the variable for un/trust will likely leave it set for --check.
11821188
// However, it seems important to warn users who set it specifically for --check.
1183-
[Event(101, Level = EventLevel.Warning, Message = "The {0} environment variable is set but will not be consumed while checking trust.")]
1184-
internal void UnixOpenSslCertificateDirectoryOverrideIgnored(string openSslCertDirectoryOverrideVariableName) => WriteEvent(101, openSslCertDirectoryOverrideVariableName);
1189+
[Event(103, Level = EventLevel.Warning, Message = "The {0} environment variable is set but will not be consumed while checking trust.")]
1190+
internal void UnixOpenSslCertificateDirectoryOverrideIgnored(string openSslCertDirectoryOverrideVariableName) => WriteEvent(103, openSslCertDirectoryOverrideVariableName);
11851191

1186-
[Event(102, Level = EventLevel.Warning, Message = "The {0} command is unavailable. It is required for updating certificate trust in OpenSSL, which is used by System.Net.Http.HttpClient.")]
1187-
internal void UnixMissingOpenSslCommand(string openSslCommand) => WriteEvent(102, openSslCommand);
1192+
[Event(104, Level = EventLevel.Warning, Message = "The {0} command is unavailable. It is required for updating certificate trust in OpenSSL.")]
1193+
internal void UnixMissingOpenSslCommand(string openSslCommand) => WriteEvent(104, openSslCommand);
11881194

1189-
[Event(103, Level = EventLevel.Warning, Message = "The {0} command is unavailable. It is required for querying and updating NSS databases, which are chiefly used to trust certificates in browsers.")]
1190-
internal void UnixMissingCertUtilCommand(string certUtilCommand) => WriteEvent(103, certUtilCommand);
1195+
[Event(105, Level = EventLevel.Warning, Message = "The {0} command is unavailable. It is required for querying and updating NSS databases, which are chiefly used to trust certificates in browsers.")]
1196+
internal void UnixMissingCertUtilCommand(string certUtilCommand) => WriteEvent(105, certUtilCommand);
11911197

1192-
[Event(104, Level = EventLevel.Verbose, Message = "Untrusting the certificate in OpenSSL was skipped since '{0}' does not exist.")]
1193-
internal void UnixOpenSslUntrustSkipped(string certPath) => WriteEvent(104, certPath);
1198+
[Event(106, Level = EventLevel.Verbose, Message = "Untrusting the certificate in OpenSSL was skipped since '{0}' does not exist.")]
1199+
internal void UnixOpenSslUntrustSkipped(string certPath) => WriteEvent(106, certPath);
11941200

1195-
[Event(105, Level = EventLevel.Warning, Message = "Failed to delete certificate file '{0}': {1}.")]
1196-
internal void UnixCertificateFileDeletionException(string certPath, string exceptionMessage) => WriteEvent(105, certPath, exceptionMessage);
1201+
[Event(107, Level = EventLevel.Warning, Message = "Failed to delete certificate file '{0}': {1}.")]
1202+
internal void UnixCertificateFileDeletionException(string certPath, string exceptionMessage) => WriteEvent(107, certPath, exceptionMessage);
11971203

1198-
[Event(106, Level = EventLevel.Error, Message = "Unable to export the certificate since '{0}' already exists. Please remove it.")]
1199-
internal void UnixCertificateAlreadyExists(string certPath) => WriteEvent(106, certPath);
1204+
[Event(108, Level = EventLevel.Error, Message = "Unable to export the certificate since '{0}' already exists. Please remove it.")]
1205+
internal void UnixNotOverwritingCertificate(string certPath) => WriteEvent(108, certPath);
12001206

1201-
[Event(107, Level = EventLevel.LogAlways, Message = "For OpenSSL trust to take effect, '{0}' must be listed in the {2} environment variable. " +
1207+
[Event(109, Level = EventLevel.LogAlways, Message = "For OpenSSL trust to take effect, '{0}' must be listed in the {2} environment variable. " +
12021208
"For example, `export SSL_CERT_DIR={0}:{1}`. " +
12031209
"See https://aka.ms/dev-certs-trust for more information.")]
1204-
internal void UnixSuggestSettingEnvironmentVariable(string certDir, string openSslDir, string envVarName) => WriteEvent(107, certDir, openSslDir, envVarName);
1210+
internal void UnixSuggestSettingEnvironmentVariable(string certDir, string openSslDir, string envVarName) => WriteEvent(109, certDir, openSslDir, envVarName);
12051211

1206-
[Event(108, Level = EventLevel.LogAlways, Message = "For OpenSSL trust to take effect, '{0}' must be listed in the {2} environment variable. " +
1212+
[Event(110, Level = EventLevel.LogAlways, Message = "For OpenSSL trust to take effect, '{0}' must be listed in the {2} environment variable. " +
12071213
"See https://aka.ms/dev-certs-trust for more information.")]
1208-
internal void UnixSuggestSettingEnvironmentVariableWithoutExample(string certDir, string envVarName) => WriteEvent(108, certDir, envVarName);
1214+
internal void UnixSuggestSettingEnvironmentVariableWithoutExample(string certDir, string envVarName) => WriteEvent(110, certDir, envVarName);
12091215
}
12101216

12111217
internal sealed class UserCancelledTrustException : Exception

0 commit comments

Comments
 (0)