Table of Contents

Class SecomTrustAnchors

Namespace
EncDotNet.S100.Collections.Secom
Assembly
EncDotNet.S100.Collections.dll

The roots SECOM data signers are trusted against (issue #823), plus any intermediate CA certificates needed to reach them. SECOM signers hold Maritime Connectivity Platform (MCP) certificates, whose roots are not in operating-system trust stores, and services send the signer certificate without its chain.

public sealed class SecomTrustAnchors
Inheritance
SecomTrustAnchors
Inherited Members

Remarks

BuiltIn trusts the MCP MCC instance. Hosts add their own roots with With(SecomTrustAnchor, IEnumerable<X509Certificate2>?). Revocation is checked separately, by SecomRevocation (#833).

Constructors

SecomTrustAnchors(IEnumerable<SecomTrustAnchor>, IEnumerable<X509Certificate2>?)

Creates a set of trust anchors.

public SecomTrustAnchors(IEnumerable<SecomTrustAnchor> roots, IEnumerable<X509Certificate2>? intermediates = null)

Parameters

roots IEnumerable<SecomTrustAnchor>

The trusted roots.

intermediates IEnumerable<X509Certificate2>

CA certificates that may sit between a signer and a root.

Properties

BuiltIn

The roots built into this library: the MCP MCC instance's CA chain (named "MCP MCC"). The source and fingerprints are recorded in Secom/TrustAnchors/README.md.

public static SecomTrustAnchors BuiltIn { get; }

Property Value

SecomTrustAnchors

Intermediates

CA certificates that may sit between a signer and a root.

public IReadOnlyList<X509Certificate2> Intermediates { get; }

Property Value

IReadOnlyList<X509Certificate2>

None

No trusted roots: every signer is reported as not trusted.

public static SecomTrustAnchors None { get; }

Property Value

SecomTrustAnchors

Roots

The trusted roots.

public IReadOnlyList<SecomTrustAnchor> Roots { get; }

Property Value

IReadOnlyList<SecomTrustAnchor>

Methods

FindAnchor(X509Certificate2, IEnumerable<X509Certificate2>, string?)

Whether signer chains to one of these roots, using the certificates the object carried and Intermediates. Expiry is ignored here (it is reported separately, so old objects stay attributable to their signer).

public string? FindAnchor(X509Certificate2 signer, IEnumerable<X509Certificate2> carried, string? statedThumbprint)

Parameters

signer X509Certificate2

The signer certificate.

carried IEnumerable<X509Certificate2>

Further certificates the object carried.

statedThumbprint string

The object's publicRootCertificateThumbprint, if any. It must name a CA in the chain: services state the root or, as DMA's does, the issuing intermediate, by SHA-1 or SHA-256.

Returns

string

The name of the root reached, or null when the signer is not trusted.

FindServerAnchor(X509Certificate2, IEnumerable<X509Certificate2>, DateTimeOffset)

Whether a TLS server certificate chains to one of these roots (#829), using the certificates the server presented and Intermediates. Unlike a signer, a server must be within its validity period, as must every CA above it.

public (string? Anchor, bool Expired) FindServerAnchor(X509Certificate2 server, IEnumerable<X509Certificate2> presented, DateTimeOffset at)

Parameters

server X509Certificate2

The server's certificate.

presented IEnumerable<X509Certificate2>

Further certificates the server presented.

at DateTimeOffset

The time validity is judged at.

Returns

(string Anchor, bool Expired)

The name of the root reached (null when the chain reaches none), and whether a certificate in that chain is outside its validity period at at.

FromPem(string, string)

Reads a PEM bundle as trust anchors named name: self-signed certificates become roots, the rest intermediates.

public static SecomTrustAnchors FromPem(string name, string pem)

Parameters

name string
pem string

Returns

SecomTrustAnchors

Exceptions

FormatException

A certificate block is not base64.

CryptographicException

A block is not a certificate.

With(SecomTrustAnchor, IEnumerable<X509Certificate2>?)

This set plus root and its intermediates.

public SecomTrustAnchors With(SecomTrustAnchor root, IEnumerable<X509Certificate2>? intermediates = null)

Parameters

root SecomTrustAnchor
intermediates IEnumerable<X509Certificate2>

Returns

SecomTrustAnchors