Table of Contents

Class SecomServerTrust

Namespace
EncDotNet.S100.Collections.Secom
Assembly
EncDotNet.S100.Collections.dll

Trusts TLS server certificates issued under SecomTrustAnchors for SECOM requests (issue #829), and presents each request's own MCP identity to services that ask for a client certificate (#832, #883). Many SECOM services present Maritime Connectivity Platform (MCP) server certificates, whose roots are not in operating-system trust stores, so the handshake fails before SECOM is asked.

public sealed class SecomServerTrust
Inheritance
SecomServerTrust
Inherited Members

Remarks

Use CreateHandler() only for SECOM traffic: it widens trust for the client it is given to and nothing else. A connection is allowed when the operating system trusts it, or when it rejects it because of the chain and the chain reaches a trust anchor, with every certificate in its validity period, and the certificate names the host.

The host name is never skipped. For an anchor-trusted certificate it is checked here, the same way on every platform: against the DNS names in the subject alternative name (a wildcard covers one left-most label), else IP addresses, and — only when the certificate lists no DNS names — the subject common name. MCP device certificates (AMSA's, for one) carry the host only in the common name, with the MRN as the sole alternative name. A certificate the operating system trusts but that names another host is refused.

Given a SecomRevocation, an anchor-trusted chain is also checked against its CAs' CRLs (#833): a revoked certificate is refused, and one whose revocation cannot be checked is allowed with Revocation saying so. Certificates the operating system trusts are checked online through the platform (SystemTls), soft-fail, since .NET leaves that off by default.

A chain carrying a distrusted key is refused as Revoked on every path, even one the operating system still trusts.

Identities (#883): the host registers the identities it holds with SetIdentity(string, SecomClientIdentity?), and names one DefaultIdentityId. Each SECOM source's Identity setting is resolved with Resolve(string?) when the source is read, and every request is tagged with the identity it presents (PresentIdentity(HttpRequestMessage, SecomClientIdentity?)). The handlers keep one connection pool per identity, and present the request's identity only, and only when the service asks for a client certificate. An untagged request presents none. Nothing here ever tries another identity when one is refused: each attempt would disclose an MRN to the provider.

Constructors

SecomServerTrust(SecomTrustAnchors?, TimeProvider?, SecomRevocation?)

Creates a validator trusting anchors.

public SecomServerTrust(SecomTrustAnchors? anchors = null, TimeProvider? timeProvider = null, SecomRevocation? revocation = null)

Parameters

anchors SecomTrustAnchors

The anchors server certificates may chain to; by default BuiltIn.

timeProvider TimeProvider

The clock validity periods are judged by.

revocation SecomRevocation

Checks anchor-trusted chains for revocation; null skips the check.

Fields

IdentityOption

The request option PresentIdentity(HttpRequestMessage, SecomClientIdentity?) sets: the identity a request presents.

public static readonly HttpRequestOptionsKey<SecomClientIdentity?> IdentityOption

Field Value

HttpRequestOptionsKey<SecomClientIdentity>

Properties

Anchors

The anchors server certificates may chain to. A host may replace them (e.g. when the user turns a built-in root off or adds one, #845): decisions recorded under the previous anchors are forgotten, and handlers make new connections from their next request.

public SecomTrustAnchors Anchors { get; set; }

Property Value

SecomTrustAnchors

DefaultIdentityId

The reference id of the default identity, which sources set to Default present; null when there is none. It may name an identity that is not registered (yet): such sources then present none. Setting it raises IdentitiesChanged when it changes.

public string? DefaultIdentityId { get; set; }

Property Value

string

EnvelopeSignatureReference

The SECOM digitalSignatureReference SECOM 2.0 request envelopes are signed with (#838), e.g. ecdsa-384-sha2; null (the default) follows the identity's key. A service checks a search envelope with the algorithm it is configured for, so this may need matching to it.

public string? EnvelopeSignatureReference { get; set; }

Property Value

string

Identities

The identities registered with SetIdentity(string, SecomClientIdentity?), by reference id.

public IReadOnlyDictionary<string, SecomClientIdentity> Identities { get; }

Property Value

IReadOnlyDictionary<string, SecomClientIdentity>

Identity

The default identity, when one is set and registered.

public SecomClientIdentity? Identity { get; }

Property Value

SecomClientIdentity

Revocation

Checks anchor-trusted chains for revocation, when set.

public SecomRevocation? Revocation { get; }

Property Value

SecomRevocation

SystemTls

How certificates the operating system trusts are checked further: by default, revocation online through the platform (CRL or OCSP), soft-fail. MCP-anchored chains use Revocation instead.

public HardenedTlsOptions SystemTls { get; set; }

Property Value

HardenedTlsOptions

Methods

CheckIdentityRevocation(bool)

Checks every registered identity against its CAs' CRLs (#845). A revoked identity is removed at once (sources that resolved to it present none) and IdentityRevoked is raised.

public IReadOnlyDictionary<string, SecomRevocationResult> CheckIdentityRevocation(bool fetch = true)

Parameters

fetch bool

True to fetch CRLs that are missing or due; false to judge only from CRLs already held (CacheOnly).

Returns

IReadOnlyDictionary<string, SecomRevocationResult>

The result for each identity checked, by reference id; NotChecked for every identity when there is no Revocation, and for one that chains to none of Anchors.

CreateHandler()

A handler for an HttpClient used only for SECOM requests: it validates server certificates with Validate(string, X509Certificate2?, X509Chain?, SslPolicyErrors) and presents each request's identity (PresentIdentity(HttpRequestMessage, SecomClientIdentity?)) to a service that asks for a client certificate.

public HttpMessageHandler CreateHandler()

Returns

HttpMessageHandler

CreateSigner()

A signer with the default identity (Identity), or null when there is none.

public SecomEnvelopeSigner? CreateSigner()

Returns

SecomEnvelopeSigner

Exceptions

InvalidDataException

The identity cannot sign with EnvelopeSignatureReference.

CreateSigner(SecomClientIdentity?)

A signer for SECOM 2.0 request envelopes with identity, or null for none.

public SecomEnvelopeSigner? CreateSigner(SecomClientIdentity? identity)

Parameters

identity SecomClientIdentity

Returns

SecomEnvelopeSigner

Exceptions

InvalidDataException

The identity cannot sign with EnvelopeSignatureReference.

HandshakeFor(string, SecomClientIdentity?)

What the last TLS handshake with host that presented identity (or, with null, none) showed: whether the server asked for a client certificate, and which issuers it said it accepts. null when no connection has been made that way through a handler from this instance.

public SecomHandshake? HandshakeFor(string host, SecomClientIdentity? identity)

Parameters

host string
identity SecomClientIdentity

Returns

SecomHandshake

NamesHost(X509Certificate2, string)

Whether certificate names host: a DNS name in its subject alternative name (a wildcard covers one left-most label), an IP address there for an IP host, or — only when it lists no DNS names — its subject common name, matched exactly.

public static bool NamesHost(X509Certificate2 certificate, string host)

Parameters

certificate X509Certificate2
host string

Returns

bool

PresentIdentity(HttpRequestMessage, SecomClientIdentity?)

Tags request with the identity it presents through a handler from CreateHandler(): null for none.

public static void PresentIdentity(HttpRequestMessage request, SecomClientIdentity? identity)

Parameters

request HttpRequestMessage
identity SecomClientIdentity

Resolve(string?)

Resolves a source's Identity setting to the identity it presents now: Default (or null) to the default identity, none when no default is set; None to none; a reference id to that identity, or none when it is not registered. Anything else is none.

public SecomResolvedIdentity Resolve(string? setting)

Parameters

setting string

Returns

SecomResolvedIdentity

ResultFor(string)

The last decision about host's certificate, if a connection has been made to it through a handler from this instance.

public SecomServerTrustResult? ResultFor(string host)

Parameters

host string

Returns

SecomServerTrustResult

SetIdentity(SecomClientIdentity?)

Makes identity the default, registered under its reference id, or (with null) leaves no default: for a host that holds one identity at a time (s100 mcp serve, --secom-identity).

public void SetIdentity(SecomClientIdentity? identity)

Parameters

identity SecomClientIdentity

SetIdentity(string, SecomClientIdentity?)

Registers identity under id, replacing any identity registered there, or (with null) removes it. Requests tagged with a replaced or removed identity still connect with it; sources resolve to the new one from their next read. An identity removed or replaced is not disposed: its owner may still hold it.

public void SetIdentity(string id, SecomClientIdentity? identity)

Parameters

id string

The reference id, e.g. sc-ident:4f9c2a7e.

identity SecomClientIdentity

The identity, or null to remove it.

Validate(string, X509Certificate2?, X509Chain?, SslPolicyErrors)

Decides whether to allow a TLS connection to host, and records the decision.

public SecomServerTrustResult Validate(string host, X509Certificate2? certificate, X509Chain? chain, SslPolicyErrors errors)

Parameters

host string

The host the request was made to.

certificate X509Certificate2

The server's certificate.

chain X509Chain

The chain the platform built, holding the certificates the server presented.

errors SslPolicyErrors

What the platform found wrong.

Returns

SecomServerTrustResult

Events

AnchorsChanged

Raised after Anchors is replaced.

public event EventHandler? AnchorsChanged

Event Type

EventHandler

IdentitiesChanged

Raised when an identity is registered, replaced or removed, or the default changes.

public event EventHandler<SecomIdentitiesChangedEventArgs>? IdentitiesChanged

Event Type

EventHandler<SecomIdentitiesChangedEventArgs>

IdentityRevoked

Raised when CheckIdentityRevocation(bool) finds a registered identity revoked and removes it.

public event EventHandler<SecomIdentityRevokedEventArgs>? IdentityRevoked

Event Type

EventHandler<SecomIdentityRevokedEventArgs>
Edit this page