protected X509Certificate2 CreateAndPutClientCertificate(string serverCertPath,
RavenServer.CertificateHolder serverCertificateHolder,
Dictionary <string, DatabaseAccess> permissions,
SecurityClearance clearance,
RavenServer server = null)
{
var clientCertificate = CertificateUtils.CreateSelfSignedClientCertificate("RavenTestsClient", serverCertificateHolder, out _);
var serverCertificate = new X509Certificate2(serverCertPath);
using (var store = GetDocumentStore(new Options
{
AdminCertificate = serverCertificate,
Server = server
}))
{
var requestExecutor = store.GetRequestExecutor();
using (requestExecutor.ContextPool.AllocateOperationContext(out JsonOperationContext context))
{
var command = new PutClientCertificateOperation("RavenTestsClient", clientCertificate, permissions, clearance)
.GetCommand(store.Conventions, context);
requestExecutor.Execute(command, context);
}
}
return(clientCertificate);
}
public static async Task <byte[]> GenerateCertificateInternal(CertificateDefinition certificate, ServerStore serverStore)
{
ValidateCertificateDefinition(certificate, serverStore);
if (serverStore.Server.Certificate?.Certificate == null)
{
var keys = new[]
{
RavenConfiguration.GetKey(x => x.Security.CertificatePath),
RavenConfiguration.GetKey(x => x.Security.CertificateExec)
};
throw new InvalidOperationException($"Cannot generate the client certificate '{certificate.Name}' because the server certificate is not loaded. " +
$"You can supply a server certificate by using the following configuration keys: {string.Join(", ", keys)}" +
"For a more detailed explanation please read about authentication and certificates in the RavenDB documentation.");
}
// this creates a client certificate which is signed by the current server certificate
var selfSignedCertificate = CertificateUtils.CreateSelfSignedClientCertificate(certificate.Name, serverStore.Server.Certificate, out var clientCertBytes);
var newCertDef = new CertificateDefinition
{
Name = certificate.Name,
// this does not include the private key, that is only for the client
Certificate = Convert.ToBase64String(selfSignedCertificate.Export(X509ContentType.Cert)),
Permissions = certificate.Permissions,
SecurityClearance = certificate.SecurityClearance,
Thumbprint = selfSignedCertificate.Thumbprint,
NotAfter = selfSignedCertificate.NotAfter
};
var res = await serverStore.PutValueInClusterAsync(new PutCertificateCommand(Constants.Certificates.Prefix + selfSignedCertificate.Thumbprint, newCertDef));
await serverStore.Cluster.WaitForIndexNotification(res.Index);
var ms = new MemoryStream();
using (var archive = new ZipArchive(ms, ZipArchiveMode.Create, true))
{
var certBytes = selfSignedCertificate.Export(X509ContentType.Pfx, certificate.Password);
var entry = archive.CreateEntry(certificate.Name + ".pfx");
// Structure of the external attributes field: https://unix.stackexchange.com/questions/14705/the-zip-formats-external-file-attribute/14727#14727
// The permissions go into the most significant 16 bits of an int
entry.ExternalAttributes = ((int)(FilePermissions.S_IRUSR | FilePermissions.S_IWUSR)) << 16;
using (var s = entry.Open())
s.Write(certBytes, 0, certBytes.Length);
WriteCertificateAsPem(certificate.Name, clientCertBytes, certificate.Password, archive);
}
return(ms.ToArray());
}
public async Task Generate()
{
// one of the first admin action is to create a certificate, so let
// us also use that to indicate that we are the seed node
ServerStore.EnsureNotPassive();
using (ServerStore.ContextPool.AllocateOperationContext(out TransactionOperationContext ctx))
{
var stream = TryGetRequestFormStream("Options") ?? RequestBodyStream();
var certificateJson = ctx.ReadForDisk(stream, "certificate-generation");
var certificate = JsonDeserializationServer.CertificateDefinition(certificateJson);
ValidateCertificate(certificate, ServerStore);
if (certificate.SecurityClearance == SecurityClearance.ClusterAdmin && IsClusterAdmin() == false)
{
var clientCert = (HttpContext.Features.Get <IHttpAuthenticationFeature>() as RavenServer.AuthenticateConnection)?.Certificate;
throw new InvalidOperationException($"Cannot generate the certificate '{certificate.Name}' with 'Cluster Admin' security clearance because the current client certificate being used has a lower clearance: {clientCert}");
}
if (Server.ClusterCertificateHolder?.Certificate == null)
{
throw new InvalidOperationException($"Cannot generate the client certificate '{certificate.Name}' becuase the server certificate is not loaded. " +
$"You can supply a server certificate by using the following configuration keys: " +
$"'{RavenConfiguration.GetKey(x => x.Security.CertificatePath)}'/'{RavenConfiguration.GetKey(x => x.Security.CertificateExec)}'/" +
$"'{RavenConfiguration.GetKey(x => x.Security.ClusterCertificatePath)}'/'{RavenConfiguration.GetKey(x => x.Security.ClusterCertificateExec)}'. " +
$"For a more detailed explanation please read about authentication and certificates in the RavenDB documentation.");
}
// this creates a client certificate which is signed by the current server certificate
var selfSignedCertificate = CertificateUtils.CreateSelfSignedClientCertificate(certificate.Name, Server.ClusterCertificateHolder);
var res = await ServerStore.PutValueInClusterAsync(new PutCertificateCommand(Constants.Certificates.Prefix + selfSignedCertificate.Thumbprint,
new CertificateDefinition
{
Name = certificate.Name,
// this does not include the private key, that is only for the client
Certificate = Convert.ToBase64String(selfSignedCertificate.Export(X509ContentType.Cert)),
Permissions = certificate.Permissions,
SecurityClearance = certificate.SecurityClearance,
Thumbprint = selfSignedCertificate.Thumbprint
}));
await ServerStore.Cluster.WaitForIndexNotification(res.Index);
HttpContext.Response.StatusCode = (int)HttpStatusCode.Created;
var contentDisposition = "attachment; filename=" + Uri.EscapeDataString(certificate.Name) + ".pfx";
HttpContext.Response.Headers["Content-Disposition"] = contentDisposition;
HttpContext.Response.ContentType = "binary/octet-stream";
var pfx = selfSignedCertificate.Export(X509ContentType.Pfx, certificate.Password);
HttpContext.Response.Body.Write(pfx, 0, pfx.Length);
}
}
private async Task <byte[]> GenerateCertificateInternal(TransactionOperationContext ctx, CertificateDefinition certificate)
{
ValidateCertificate(certificate, ServerStore);
if (certificate.SecurityClearance == SecurityClearance.ClusterAdmin && IsClusterAdmin() == false)
{
var clientCert = (HttpContext.Features.Get <IHttpAuthenticationFeature>() as RavenServer.AuthenticateConnection)?.Certificate;
var clientCertDef = ReadCertificateFromCluster(ctx, Constants.Certificates.Prefix + clientCert?.Thumbprint);
throw new InvalidOperationException($"Cannot generate the certificate '{certificate.Name}' with 'Cluster Admin' security clearance because the current client certificate being used has a lower clearance: {clientCertDef.SecurityClearance}");
}
if (Server.ClusterCertificateHolder?.Certificate == null)
{
var keys = new[]
{
RavenConfiguration.GetKey(x => x.Security.CertificatePath),
RavenConfiguration.GetKey(x => x.Security.CertificateExec),
RavenConfiguration.GetKey(x => x.Security.ClusterCertificatePath),
RavenConfiguration.GetKey(x => x.Security.ClusterCertificateExec)
};
throw new InvalidOperationException($"Cannot generate the client certificate '{certificate.Name}' becuase the server certificate is not loaded. " +
$"You can supply a server certificate by using the following configuration keys: {string.Join(", ", keys)}" +
"For a more detailed explanation please read about authentication and certificates in the RavenDB documentation.");
}
if (PlatformDetails.RunningOnPosix)
{
ValidateCaExistsInOsStores(certificate);
}
// this creates a client certificate which is signed by the current server certificate
var selfSignedCertificate = CertificateUtils.CreateSelfSignedClientCertificate(certificate.Name, Server.ClusterCertificateHolder);
var res = await ServerStore.PutValueInClusterAsync(new PutCertificateCommand(Constants.Certificates.Prefix + selfSignedCertificate.Thumbprint,
new CertificateDefinition
{
Name = certificate.Name,
// this does not include the private key, that is only for the client
Certificate = Convert.ToBase64String(selfSignedCertificate.Export(X509ContentType.Cert)),
Permissions = certificate.Permissions,
SecurityClearance = certificate.SecurityClearance,
Thumbprint = selfSignedCertificate.Thumbprint
}));
await ServerStore.Cluster.WaitForIndexNotification(res.Index);
return(selfSignedCertificate.Export(X509ContentType.Pfx, certificate.Password));
}
protected TestCertificatesHolder GenerateAndSaveSelfSignedCertificate(bool createNew = false)
{
var selfSignedCertificatePaths = _selfSignedCertificates;
if (selfSignedCertificatePaths != null && createNew == false)
{
return(ReturnCertificatesHolder(selfSignedCertificatePaths));
}
lock (typeof(TestBase))
{
selfSignedCertificatePaths = _selfSignedCertificates;
if (selfSignedCertificatePaths == null || createNew)
{
_selfSignedCertificates = selfSignedCertificatePaths = Generate();
}
return(ReturnCertificatesHolder(selfSignedCertificatePaths));
}
TestCertificatesHolder ReturnCertificatesHolder(TestCertificatesHolder certificates)
{
return(new TestCertificatesHolder(certificates, GetTempFileName));
}
TestCertificatesHolder Generate()
{
var log = new StringBuilder();
byte[] certBytes;
try
{
certBytes = CertificateUtils.CreateSelfSignedTestCertificate(Environment.MachineName, "RavenTestsServer", log);
}
catch (Exception e)
{
throw new CryptographicException($"Unable to generate the test certificate for the machine '{Environment.MachineName}'. Log: {log}", e);
}
X509Certificate2 serverCertificate;
try
{
serverCertificate = new X509Certificate2(certBytes, (string)null, X509KeyStorageFlags.MachineKeySet);
}
catch (Exception e)
{
throw new CryptographicException($"Unable to load the test certificate for the machine '{Environment.MachineName}'. Log: {log}", e);
}
if (certBytes.Length == 0)
{
throw new CryptographicException($"Test certificate length is 0 bytes. Machine: '{Environment.MachineName}', Log: {log}");
}
string serverCertificatePath = null;
try
{
serverCertificatePath = Path.GetTempFileName();
File.WriteAllBytes(serverCertificatePath, certBytes);
}
catch (Exception e)
{
throw new InvalidOperationException("Failed to write the test certificate to a temp file." +
$"tempFileName = {serverCertificatePath}" +
$"certBytes.Length = {certBytes.Length}" +
$"MachineName = {Environment.MachineName}.", e);
}
GlobalPathsToDelete.Add(serverCertificatePath);
SecretProtection.ValidatePrivateKey(serverCertificatePath, null, certBytes, out var pk);
var clientCertificate1Path = GenerateClientCertificate(1, serverCertificate, pk);
var clientCertificate2Path = GenerateClientCertificate(2, serverCertificate, pk);
var clientCertificate3Path = GenerateClientCertificate(3, serverCertificate, pk);
return(new TestCertificatesHolder(serverCertificatePath, clientCertificate1Path, clientCertificate2Path, clientCertificate3Path));
}
string GenerateClientCertificate(int index, X509Certificate2 serverCertificate, Org.BouncyCastle.Pkcs.AsymmetricKeyEntry pk)
{
CertificateUtils.CreateSelfSignedClientCertificate(
$"{Environment.MachineName}_CC_{index}",
new RavenServer.CertificateHolder
{
Certificate = serverCertificate,
PrivateKey = pk
},
out var certBytes, DateTime.UtcNow.Date.AddYears(5));
string clientCertificatePath = null;
try
{
clientCertificatePath = Path.GetTempFileName();
File.WriteAllBytes(clientCertificatePath, certBytes);
}
catch (Exception e)
{
throw new InvalidOperationException("Failed to write the test certificate to a temp file." +
$"tempFileName = {clientCertificatePath}" +
$"certBytes.Length = {certBytes.Length}" +
$"MachineName = {Environment.MachineName}.", e);
}
GlobalPathsToDelete.Add(clientCertificatePath);
return(clientCertificatePath);
}
}
private async Task <byte[]> GenerateCertificateInternal(TransactionOperationContext ctx, CertificateDefinition certificate)
{
ValidateCertificate(certificate, ServerStore);
if (certificate.SecurityClearance == SecurityClearance.ClusterAdmin && IsClusterAdmin() == false)
{
var clientCert = (HttpContext.Features.Get <IHttpAuthenticationFeature>() as RavenServer.AuthenticateConnection)?.Certificate;
throw new InvalidOperationException($"Cannot generate the certificate '{certificate.Name}' with 'Cluster Admin' security clearance because the current client certificate being used has a lower clearance: {clientCert}");
}
if (Server.ClusterCertificateHolder?.Certificate == null)
{
throw new InvalidOperationException($"Cannot generate the client certificate '{certificate.Name}' becuase the server certificate is not loaded. " +
$"You can supply a server certificate by using the following configuration keys: " +
$"'{RavenConfiguration.GetKey(x => x.Security.CertificatePath)}'/'{RavenConfiguration.GetKey(x => x.Security.CertificateExec)}'/" +
$"'{RavenConfiguration.GetKey(x => x.Security.ClusterCertificatePath)}'/'{RavenConfiguration.GetKey(x => x.Security.ClusterCertificateExec)}'. " +
$"For a more detailed explanation please read about authentication and certificates in the RavenDB documentation.");
}
if (PlatformDetails.RunningOnPosix)
{
// For the client certificate to work properly, we need that the issuer (our server certificate) will be registered in the trusted root store.
// In Linux, when using SslStream AuthenticateAsServer, the server sends the list of allowed CAs to the client. So the client's CA must be in the list. See RavenDB-8524
using (var machineRootStore = new X509Store(StoreName.Root, StoreLocation.LocalMachine, OpenFlags.ReadOnly))
using (var machineCaStore = new X509Store(StoreName.CertificateAuthority, StoreLocation.LocalMachine, OpenFlags.ReadOnly))
using (var userRootStore = new X509Store(StoreName.Root, StoreLocation.CurrentUser, OpenFlags.ReadOnly))
using (var userCaStore = new X509Store(StoreName.CertificateAuthority, StoreLocation.CurrentUser, OpenFlags.ReadOnly))
{
// workaround for lack of cert store inheritance RavenDB-8904
if (machineCaStore.Certificates.Contains(Server.ClusterCertificateHolder.Certificate) == false &&
machineRootStore.Certificates.Contains(Server.ClusterCertificateHolder.Certificate) == false &&
userCaStore.Certificates.Contains(Server.ClusterCertificateHolder.Certificate) == false &&
userRootStore.Certificates.Contains(Server.ClusterCertificateHolder.Certificate) == false)
{
throw new InvalidOperationException($"Cannot generate the client certificate '{certificate.Name}'. " +
$"First, you must register the server certificate '{Server.ClusterCertificateHolder.Certificate.FriendlyName}' in the trusted root store, on the server machine." +
$"The server certificate is located in one of the following locations: {ServerStore.Configuration.Security.CertificatePath ?? " "} / {ServerStore.Configuration.Security.ClusterCertificatePath ?? " "} / {ServerStore.Configuration.Security.CertificateExec ?? " "} / {ServerStore.Configuration.Security.ClusterCertificateExec ?? " "}." +
"This step is required because you are using a self-signed server certificate.");
}
}
}
// this creates a client certificate which is signed by the current server certificate
var selfSignedCertificate = CertificateUtils.CreateSelfSignedClientCertificate(certificate.Name, Server.ClusterCertificateHolder);
var res = await ServerStore.PutValueInClusterAsync(new PutCertificateCommand(Constants.Certificates.Prefix + selfSignedCertificate.Thumbprint,
new CertificateDefinition
{
Name = certificate.Name,
// this does not include the private key, that is only for the client
Certificate = Convert.ToBase64String(selfSignedCertificate.Export(X509ContentType.Cert)),
Permissions = certificate.Permissions,
SecurityClearance = certificate.SecurityClearance,
Thumbprint = selfSignedCertificate.Thumbprint
}));
await ServerStore.Cluster.WaitForIndexNotification(res.Index);
return(selfSignedCertificate.Export(X509ContentType.Pfx, certificate.Password));
}
private async Task <byte[]> GenerateCertificateInternal(TransactionOperationContext ctx, CertificateDefinition certificate)
{
ValidateCertificate(certificate, ServerStore);
if (certificate.SecurityClearance == SecurityClearance.ClusterAdmin && IsClusterAdmin() == false)
{
var clientCert = (HttpContext.Features.Get <IHttpAuthenticationFeature>() as RavenServer.AuthenticateConnection)?.Certificate;
var clientCertDef = ReadCertificateFromCluster(ctx, Constants.Certificates.Prefix + clientCert?.Thumbprint);
throw new InvalidOperationException($"Cannot generate the certificate '{certificate.Name}' with 'Cluster Admin' security clearance because the current client certificate being used has a lower clearance: {clientCertDef.SecurityClearance}");
}
if (Server.Certificate?.Certificate == null)
{
var keys = new[]
{
RavenConfiguration.GetKey(x => x.Security.CertificatePath),
RavenConfiguration.GetKey(x => x.Security.CertificateExec)
};
throw new InvalidOperationException($"Cannot generate the client certificate '{certificate.Name}' becuase the server certificate is not loaded. " +
$"You can supply a server certificate by using the following configuration keys: {string.Join(", ", keys)}" +
"For a more detailed explanation please read about authentication and certificates in the RavenDB documentation.");
}
// this creates a client certificate which is signed by the current server certificate
var selfSignedCertificate = CertificateUtils.CreateSelfSignedClientCertificate(certificate.Name, Server.Certificate, out var clientCertBytes);
var newCertDef = new CertificateDefinition
{
Name = certificate.Name,
// this does not include the private key, that is only for the client
Certificate = Convert.ToBase64String(selfSignedCertificate.Export(X509ContentType.Cert)),
Permissions = certificate.Permissions,
SecurityClearance = certificate.SecurityClearance,
Thumbprint = selfSignedCertificate.Thumbprint,
NotAfter = selfSignedCertificate.NotAfter
};
var res = await ServerStore.PutValueInClusterAsync(new PutCertificateCommand(Constants.Certificates.Prefix + selfSignedCertificate.Thumbprint, newCertDef));
await ServerStore.Cluster.WaitForIndexNotification(res.Index);
var ms = new MemoryStream();
using (var archive = new ZipArchive(ms, ZipArchiveMode.Create, true))
{
var certBytes = selfSignedCertificate.Export(X509ContentType.Pfx, certificate.Password);
var entry = archive.CreateEntry(certificate.Name + ".pfx");
using (var s = entry.Open())
s.Write(certBytes, 0, certBytes.Length);
entry = archive.CreateEntry(certificate.Name + ".pem");
using (var s = entry.Open())
{
WriteCertificateAsPem(clientCertBytes, certificate.Password, s);
}
}
return(ms.ToArray());
}
private async Task <byte[]> GenerateCertificateInternal(TransactionOperationContext ctx, CertificateDefinition certificate)
{
ValidateCertificate(certificate, ServerStore);
if (certificate.SecurityClearance == SecurityClearance.ClusterAdmin && IsClusterAdmin() == false)
{
var clientCert = (HttpContext.Features.Get <IHttpAuthenticationFeature>() as RavenServer.AuthenticateConnection)?.Certificate;
throw new InvalidOperationException($"Cannot generate the certificate '{certificate.Name}' with 'Cluster Admin' security clearance because the current client certificate being used has a lower clearance: {clientCert}");
}
if (Server.ClusterCertificateHolder?.Certificate == null)
{
var keys = new[]
{
RavenConfiguration.GetKey(x => x.Security.CertificatePath),
RavenConfiguration.GetKey(x => x.Security.CertificateExec),
RavenConfiguration.GetKey(x => x.Security.ClusterCertificatePath),
RavenConfiguration.GetKey(x => x.Security.ClusterCertificateExec)
};
throw new InvalidOperationException($"Cannot generate the client certificate '{certificate.Name}' becuase the server certificate is not loaded. " +
$"You can supply a server certificate by using the following configuration keys: {keys}" +
"For a more detailed explanation please read about authentication and certificates in the RavenDB documentation.");
}
if (PlatformDetails.RunningOnPosix)
{
// Implementation of SslStream AuthenticateAsServer is different in Linux. See RavenDB-8524
// A list of allowed CAs is sent from the server to the client. The handshake will fail if the client's CA is not in that list. This list is taken from the root and certificate authority stores of the OS.
// In this workaround we make sure that the CA (who signed the server cert, which in turn signed the client cert) is registered in one of the OS stores.
var chain = new X509Chain
{
ChainPolicy =
{
RevocationMode = X509RevocationMode.NoCheck,
RevocationFlag = X509RevocationFlag.ExcludeRoot,
VerificationFlags = X509VerificationFlags.AllowUnknownCertificateAuthority,
VerificationTime = DateTime.UtcNow,
UrlRetrievalTimeout = new TimeSpan(0, 0, 0)
}
};
if (chain.Build(Server.ClusterCertificateHolder.Certificate) == false)
{
throw new InvalidOperationException($"Cannot generate the client certificate '{certificate.Name}'. The server certificate chain is broken, admin assistance required.");
}
var rootCert = GetRootCertificate(chain);
if (rootCert == null)
{
throw new InvalidOperationException($"Cannot generate the client certificate '{certificate.Name}'. The server certificate chain is broken, admin assistance required.");
}
using (var machineRootStore = new X509Store(StoreName.Root, StoreLocation.LocalMachine, OpenFlags.ReadOnly))
using (var machineCaStore = new X509Store(StoreName.CertificateAuthority, StoreLocation.LocalMachine, OpenFlags.ReadOnly))
using (var userRootStore = new X509Store(StoreName.Root, StoreLocation.CurrentUser, OpenFlags.ReadOnly))
using (var userCaStore = new X509Store(StoreName.CertificateAuthority, StoreLocation.CurrentUser, OpenFlags.ReadOnly))
{
// workaround for lack of cert store inheritance RavenDB-8904
if (machineCaStore.Certificates.Contains(rootCert) == false &&
machineRootStore.Certificates.Contains(rootCert) == false &&
userCaStore.Certificates.Contains(rootCert) == false &&
userRootStore.Certificates.Contains(rootCert) == false)
{
var path = new[]
{
ServerStore.Configuration.Security.CertificatePath,
ServerStore.Configuration.Security.ClusterCertificatePath,
ServerStore.Configuration.Security.CertificateExec,
ServerStore.Configuration.Security.ClusterCertificateExec
}.FirstOrDefault(File.Exists) ?? "no path defined";
throw new InvalidOperationException($"Cannot generate the client certificate '{certificate.Name}'. " +
$"First, you must register the CA of the server certificate '{Server.ClusterCertificateHolder.Certificate.SubjectName.Name}' in the trusted root store, on the server machine." +
$"The server certificate is located in: '{path}'" +
"This step is required because you are using a self-signed server certificate.");
}
}
}
// this creates a client certificate which is signed by the current server certificate
var selfSignedCertificate = CertificateUtils.CreateSelfSignedClientCertificate(certificate.Name, Server.ClusterCertificateHolder);
var res = await ServerStore.PutValueInClusterAsync(new PutCertificateCommand(Constants.Certificates.Prefix + selfSignedCertificate.Thumbprint,
new CertificateDefinition
{
Name = certificate.Name,
// this does not include the private key, that is only for the client
Certificate = Convert.ToBase64String(selfSignedCertificate.Export(X509ContentType.Cert)),
Permissions = certificate.Permissions,
SecurityClearance = certificate.SecurityClearance,
Thumbprint = selfSignedCertificate.Thumbprint
}));
await ServerStore.Cluster.WaitForIndexNotification(res.Index);
return(selfSignedCertificate.Export(X509ContentType.Pfx, certificate.Password));
}
public TestCertificatesHolder GenerateAndSaveSelfSignedCertificate(bool createNew = false, [CallerMemberName] string caller = null)
{
if (createNew)
{
return(ReturnCertificatesHolder(Generate(caller, Interlocked.Increment(ref Counter))));
}
var selfSignedCertificates = SelfSignedCertificates;
if (selfSignedCertificates != null)
{
return(ReturnCertificatesHolder(selfSignedCertificates));
}
lock (typeof(TestBase))
{
selfSignedCertificates = SelfSignedCertificates;
if (selfSignedCertificates == null)
{
SelfSignedCertificates = selfSignedCertificates = Generate(caller);
}
return(ReturnCertificatesHolder(selfSignedCertificates));
}
TestCertificatesHolder ReturnCertificatesHolder(TestCertificatesHolder certificates)
{
return(new TestCertificatesHolder(certificates, _parent.GetTempFileName));
}
TestCertificatesHolder Generate(string caller, int gen = 0)
{
var log = new StringBuilder();
byte[] certBytes;
string serverCertificatePath = null;
serverCertificatePath = Path.Combine(Path.GetTempPath(), $"Server-{gen}-{RavenVersionAttribute.Instance.Build}-{DateTime.Today:yyyy-MM-dd}.pfx");
if (File.Exists(serverCertificatePath) == false)
{
try
{
certBytes = CertificateUtils.CreateSelfSignedTestCertificate(Environment.MachineName, "RavenTestsServer", log);
}
catch (Exception e)
{
throw new CryptographicException($"Unable to generate the test certificate for the machine '{Environment.MachineName}'. Log: {log}", e);
}
if (certBytes.Length == 0)
{
throw new CryptographicException($"Test certificate length is 0 bytes. Machine: '{Environment.MachineName}', Log: {log}");
}
try
{
File.WriteAllBytes(serverCertificatePath, certBytes);
}
catch (Exception e)
{
throw new InvalidOperationException("Failed to write the test certificate to a temp file." +
$"tempFileName = {serverCertificatePath}" +
$"certBytes.Length = {certBytes.Length}" +
$"MachineName = {Environment.MachineName}.", e);
}
}
else
{
certBytes = File.ReadAllBytes(serverCertificatePath);
}
X509Certificate2 serverCertificate;
try
{
serverCertificate = new X509Certificate2(certBytes, (string)null, X509KeyStorageFlags.MachineKeySet);
}
catch (Exception e)
{
throw new CryptographicException($"Unable to load the test certificate for the machine '{Environment.MachineName}'. Log: {log}", e);
}
SecretProtection.ValidatePrivateKey(serverCertificatePath, null, certBytes, out var pk);
SecretProtection.ValidateKeyUsages(serverCertificatePath, serverCertificate, validateKeyUsages: true);
var clientCertificate1Path = GenerateClientCertificate(1, serverCertificate, pk);
var clientCertificate2Path = GenerateClientCertificate(2, serverCertificate, pk);
var clientCertificate3Path = GenerateClientCertificate(3, serverCertificate, pk);
return(new TestCertificatesHolder(serverCertificatePath, clientCertificate1Path, clientCertificate2Path, clientCertificate3Path));
}
string GenerateClientCertificate(int index, X509Certificate2 serverCertificate, Org.BouncyCastle.Pkcs.AsymmetricKeyEntry pk)
{
string name = $"{Environment.MachineName}_CC_{RavenVersionAttribute.Instance.Build}_{index}_{DateTime.Today:yyyy-MM-dd}";
string clientCertificatePath = Path.Combine(Path.GetTempPath(), name + ".pfx");
if (File.Exists(clientCertificatePath) == false)
{
CertificateUtils.CreateSelfSignedClientCertificate(
name,
new RavenServer.CertificateHolder
{
Certificate = serverCertificate,
PrivateKey = pk
},
out var certBytes, DateTime.UtcNow.Date.AddYears(5));
try
{
File.WriteAllBytes(clientCertificatePath, certBytes);
}
catch (Exception e)
{
throw new InvalidOperationException("Failed to write the test certificate to a temp file." +
$"tempFileName = {clientCertificatePath}" +
$"certBytes.Length = {certBytes.Length}" +
$"MachineName = {Environment.MachineName}.", e);
}
}
return(clientCertificatePath);
}
}