Class HardenedTls

Namespace

EncDotNet.S100.Collections.Net

Assembly

EncDotNet.S100.Collections.dll

Server-certificate validation layered over the operating system's: the platform's decision stands, and a chain it accepts is still refused when it carries a distrusted key or is revoked.

public static class HardenedTls

Inheritance

object

HardenedTls

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

.NET's own defaults check neither: SocketsHttpHandler leaves CertificateRevocationCheckMode at NoCheck, and on Linux trust comes from the distribution's CA bundle, which can lag a CA compromise by days. Revocation is soft-fail: an unreachable responder never blocks a download, but a CA that has published a revocation is heard.

Methods

CheckRevocation(X509Certificate2, IEnumerable<X509Certificate2>, TimeSpan)

Builds certificate's chain against the system trust store with online revocation checking, and reports what it found. A chain that reaches a distrusted key through any path is reported Revoked.

public static TlsRevocationStatus CheckRevocation(X509Certificate2 certificate, IEnumerable<X509Certificate2> presented, TimeSpan timeout)

Parameters

certificate X509Certificate2

The end-entity certificate.

presented IEnumerable<X509Certificate2>

Intermediates the server sent, to help build the chain.

timeout TimeSpan

The most time spent fetching revocation data.

Returns

TlsRevocationStatus

CreateHandler(HardenedTlsOptions?)

A handler for general HTTPS clients (feeds, catalogues, downloads, update checks) that validates server certificates with Validate(X509Certificate2?, X509Chain?, SslPolicyErrors, HardenedTlsOptions?).

public static SocketsHttpHandler CreateHandler(HardenedTlsOptions? options = null)

Parameters

options HardenedTlsOptions

Returns

SocketsHttpHandler

Validate(X509Certificate2?, X509Chain?, SslPolicyErrors, HardenedTlsOptions?)

Whether to allow a server certificate: the platform found nothing wrong (errors is None), no certificate in the chain carries a distrusted key, and (when CheckRevocation) none is revoked.

public static bool Validate(X509Certificate2? certificate, X509Chain? chain, SslPolicyErrors errors, HardenedTlsOptions? options = null)

Parameters

certificate X509Certificate2

chain X509Chain

errors SslPolicyErrors

options HardenedTlsOptions

Returns

bool