internal static bool VerifyWithExtraRoots(
this X509Chain chain,
X509Certificate certificate,
X509Certificate2Collection extraRoots)
{
chain.ChainPolicy.ExtraStore.AddRange(extraRoots);
if (chain.Build(new X509Certificate2(certificate)))
return true;
else
{
// .NET returns UntrustedRoot status flag if the certificate is not in
// the SYSTEM trust store. Check if it's the only problem with the chain.
var onlySystemUntrusted =
chain.ChainStatus.Length == 1 &&
chain.ChainStatus[0].Status == X509ChainStatusFlags.UntrustedRoot;
// Sanity check that indeed that is the only problem with the root
// certificate.
var rootCert = chain.ChainElements[chain.ChainElements.Count - 1];
var rootOnlySystemUntrusted =
rootCert.ChainElementStatus.Length == 1 &&
rootCert.ChainElementStatus[0].Status
== X509ChainStatusFlags.UntrustedRoot;
// Double check it's indeed one of the extra roots we've been given.
var rootIsUserTrusted = extraRoots.Contains(rootCert.Certificate);
return
onlySystemUntrusted && rootOnlySystemUntrusted && rootIsUserTrusted;
}
}
internal static X509Certificate2Collection FindCandidates(
X509Certificate2 leaf,
X509Certificate2Collection extraStore)
{
X509Certificate2Collection candidates = new X509Certificate2Collection();
Queue<X509Certificate2> toProcess = new Queue<X509Certificate2>();
toProcess.Enqueue(leaf);
using (var rootStore = new X509Store(StoreName.Root, StoreLocation.LocalMachine))
using (var intermediateStore = new X509Store(StoreName.CertificateAuthority, StoreLocation.LocalMachine))
{
rootStore.Open(OpenFlags.ReadOnly);
intermediateStore.Open(OpenFlags.ReadOnly);
X509Certificate2Collection rootCerts = rootStore.Certificates;
X509Certificate2Collection intermediateCerts = intermediateStore.Certificates;
X509Certificate2Collection[] storesToCheck =
{
extraStore,
intermediateCerts,
rootCerts,
};
while (toProcess.Count > 0)
{
X509Certificate2 current = toProcess.Dequeue();
if (!candidates.Contains(current))
{
candidates.Add(current);
}
X509Certificate2Collection results = FindIssuer(
current,
storesToCheck);
if (results != null)
{
foreach (X509Certificate2 result in results)
{
if (!candidates.Contains(result))
{
toProcess.Enqueue(result);
}
}
}
}
}
return candidates;
}