diff --git a/SampleApplications/SDK/Opc.Ua.Configuration/ApplicationInstance.cs b/SampleApplications/SDK/Opc.Ua.Configuration/ApplicationInstance.cs index 02c1fae93e..bdea696f8b 100644 --- a/SampleApplications/SDK/Opc.Ua.Configuration/ApplicationInstance.cs +++ b/SampleApplications/SDK/Opc.Ua.Configuration/ApplicationInstance.cs @@ -720,9 +720,6 @@ namespace Opc.Ua.Configuration } } - // configure access to the executable, the configuration file and the private key. - await ConfigureFileAccess(configuration); - // update configuration file. ConfigUtils.UpdateConfigurationLocation(InstallConfig.ExecutableFile, InstallConfig.ConfigurationFile); @@ -1513,124 +1510,6 @@ namespace Opc.Ua.Configuration Utils.Trace(e, "Could not add certificate to trusted peer store. StorePath={0}", storePath); } } - - /// - /// Gets the access rules to use for the application. - /// - private List GetAccessRules() - { - List rules = new List(); - - // check for rules specified in the installer configuration. - bool hasAdmin = false; - - if (InstallConfig.AccessRules != null) - { - for (int ii = 0; ii < InstallConfig.AccessRules.Count; ii++) - { - ApplicationAccessRule rule = InstallConfig.AccessRules[ii]; - - if (rule.Right == ApplicationAccessRight.Configure && rule.RuleType == AccessControlType.Allow) - { - hasAdmin = true; - break; - } - } - - rules = InstallConfig.AccessRules; - } - - // provide some default rules. - if (rules.Count == 0) - { - // give user run access. - ApplicationAccessRule rule = new ApplicationAccessRule(); - rule.RuleType = AccessControlType.Allow; - rule.Right = ApplicationAccessRight.Run; - rule.IdentityName = WellKnownSids.Users; - rules.Add(rule); - - // ensure service can access. - if (InstallConfig.InstallAsService) - { - rule = new ApplicationAccessRule(); - rule.RuleType = AccessControlType.Allow; - rule.Right = ApplicationAccessRight.Run; - rule.IdentityName = WellKnownSids.NetworkService; - rules.Add(rule); - - rule = new ApplicationAccessRule(); - rule.RuleType = AccessControlType.Allow; - rule.Right = ApplicationAccessRight.Run; - rule.IdentityName = WellKnownSids.LocalService; - rules.Add(rule); - } - } - - // ensure someone can change the configuration later. - if (!hasAdmin) - { - ApplicationAccessRule rule = new ApplicationAccessRule(); - rule.RuleType = AccessControlType.Allow; - rule.Right = ApplicationAccessRight.Configure; - rule.IdentityName = WellKnownSids.Administrators; - rules.Add(rule); - } - - return rules; - } - - /// - /// Configures access to the executable, the configuration file and the private key. - /// - private async Task ConfigureFileAccess(ApplicationConfiguration configuration) - { - Utils.Trace(Utils.TraceMasks.Information, "Configuring file access."); - - List rules = GetAccessRules(); - - // apply access rules to the excutable file. - try - { - if (InstallConfig.SetExecutableFilePermissions) - { - ApplicationAccessRule.SetAccessRules(InstallConfig.ExecutableFile, rules, true); - } - } - catch (Exception e) - { - Utils.Trace(e, "Could not set executable file permissions."); - } - - // apply access rules to the configuration file. - try - { - if (InstallConfig.SetConfigurationFilePermisions) - { - ApplicationAccessRule.SetAccessRules(configuration.SourceFilePath, rules, true); - } - } - catch (Exception e) - { - Utils.Trace(e, "Could not set configuration file permissions."); - } - - // apply access rules to the private key file. - try - { - X509Certificate2 certificate = await configuration.SecurityConfiguration.ApplicationCertificate.Find(true); - - if (certificate != null) - { - ICertificateStore store = configuration.SecurityConfiguration.ApplicationCertificate.OpenStore(); - store.SetAccessRules(certificate.Thumbprint, rules, true); - } - } - catch (Exception e) - { - Utils.Trace(e, "Could not set private key file permissions."); - } - } #endregion #region Private Fields diff --git a/SampleApplications/Samples/Client.Net4/Opc.Ua.SampleClient.Config.xml b/SampleApplications/Samples/Client.Net4/Opc.Ua.SampleClient.Config.xml index e773694e93..3f366d10d6 100644 --- a/SampleApplications/Samples/Client.Net4/Opc.Ua.SampleClient.Config.xml +++ b/SampleApplications/Samples/Client.Net4/Opc.Ua.SampleClient.Config.xml @@ -21,18 +21,9 @@ - - - - Directory - - - %CommonApplicationData%\OPC Foundation\CertificateStores\MachineDefault - + + X509Store + CurrentUser\UA_MachineDefault - Opc.Ua.SampleClient - - - urn:localhost:OPCFoundation:SampleClient - - - http://opcfoundation.org/UA/SampleClient/ - - - ClientAndServer_2 - - - - - - - - - Directory - - - %LocalFolder%\OPC Foundation\CertificateStores\MachineDefault - - - - Opc.Ua.SampleClient - - - - - - - - - Directory - %LocalFolder%\OPC Foundation\CertificateStores\UA Certificate Authorities - - - - - Directory - %LocalFolder%\OPC Foundation\CertificateStores\UA Applications - - - - 32 - - - - Directory - %LocalFolder%\OPC Foundation\CertificateStores\RejectedCertificates - - - - - - - - - - - 120000 - - - 1048576 - - - 4194304 - - - 65535 - - - 4194304 - - - 65535 - - - 300000 - - - 3600000 - - - - - - - - - opc.tcp://localhost:61210/UA/SampleClient - - - - - - - - - - SignAndEncrypt_3 - http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15 - 4 - - - Sign_2 - http://opcfoundation.org/UA/SecurityPolicy#Basic256 - 2 - - - None_1 - http://opcfoundation.org/UA/SecurityPolicy#None - 0 - - - Sign_2 - http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15 - 1 - - - SignAndEncrypt_3 - http://opcfoundation.org/UA/SecurityPolicy#Basic256 - 5 - - - Sign_2 - http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256 - 3 - - - SignAndEncrypt_3 - http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256 - 6 - - - - 5 - 100 - 2000 - - - - - - Anonymous_0 - http://opcfoundation.org/UA/SecurityPolicy#None - - - - - UserName_1 - - http://opcfoundation.org/UA/SecurityPolicy#Basic256 - - - - - Certificate_2 - - http://opcfoundation.org/UA/SecurityPolicy#Basic256 - - - - - - true - - - 100 - - - 10000 - - - 3600000 - - - 10 - - - 10 - - - 100 - - - 600000 - - - 100 - - - 3600000 - - - 100 - - - 3600000 - - - 100 - - - 100 - - - 1000 - - - 1000 - - - - - - - - opc.tcp://localhost:4840 - - opc.tcp://localhost:4840 - DiscoveryServer_3 - - opc.tcp://localhost:4840 - - - SignAndEncrypt_3 - - - 1 - - - - 0 - - - Opc.Ua.Server.nodes.xml - - - 10000 - - - - - - - 600000 - - - - opc.tcp://{0}:4840/UADiscovery - http://{0}:52601/UADiscovery - http://{0}/UADiscovery/Default.svc - - - - - - - Opc.Ua.SampleClient.Endpoints.xml - - - 10000 - - - - - - - - - UInt32 - 100 - UInt32 - - - Double - 100 - Double - - - - - - - - - - %LocalFolder%\Logs\Opc.Ua.SampleClient.log.txt - true - - - - 513 - - - - - - - - - - - - - true - + + + + Opc.Ua.SampleClient + + + urn:localhost:OPCFoundation:SampleClient + + + http://opcfoundation.org/UA/SampleClient/ + + + ClientAndServer_2 + + + + + + + X509Store + CurrentUser\UA_MachineDefault + + + Opc.Ua.SampleClient + + + + + + + + + Directory + %LocalFolder%\OPC Foundation\CertificateStores\UA Certificate Authorities + + + + + Directory + %LocalFolder%\OPC Foundation\CertificateStores\UA Applications + + + + 32 + + + + Directory + %LocalFolder%\OPC Foundation\CertificateStores\RejectedCertificates + + + + + + + + + + + 120000 + + + 1048576 + + + 4194304 + + + 65535 + + + 4194304 + + + 65535 + + + 300000 + + + 3600000 + + + + + + + + + opc.tcp://localhost:61210/UA/SampleClient + + + + + + + + + + SignAndEncrypt_3 + http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15 + 4 + + + Sign_2 + http://opcfoundation.org/UA/SecurityPolicy#Basic256 + 2 + + + None_1 + http://opcfoundation.org/UA/SecurityPolicy#None + 0 + + + Sign_2 + http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15 + 1 + + + SignAndEncrypt_3 + http://opcfoundation.org/UA/SecurityPolicy#Basic256 + 5 + + + Sign_2 + http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256 + 3 + + + SignAndEncrypt_3 + http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256 + 6 + + + + 5 + 100 + 2000 + + + + + + Anonymous_0 + http://opcfoundation.org/UA/SecurityPolicy#None + + + + + UserName_1 + + http://opcfoundation.org/UA/SecurityPolicy#Basic256 + + + + + Certificate_2 + + http://opcfoundation.org/UA/SecurityPolicy#Basic256 + + + + + + true + + + 100 + + + 10000 + + + 3600000 + + + 10 + + + 10 + + + 100 + + + 600000 + + + 100 + + + 3600000 + + + 100 + + + 3600000 + + + 100 + + + 100 + + + 1000 + + + 1000 + + + + + + + + opc.tcp://localhost:4840 + + opc.tcp://localhost:4840 + DiscoveryServer_3 + + opc.tcp://localhost:4840 + + + SignAndEncrypt_3 + + + 1 + + + + 0 + + + Opc.Ua.Server.nodes.xml + + + 10000 + + + + + + + 600000 + + + + opc.tcp://{0}:4840/UADiscovery + http://{0}:52601/UADiscovery + http://{0}/UADiscovery/Default.svc + + + + + + + Opc.Ua.SampleClient.Endpoints.xml + + + 10000 + + + + + + + + + UInt32 + 100 + UInt32 + + + Double + 100 + Double + + + + + + + + + + %LocalFolder%\Logs\Opc.Ua.SampleClient.log.txt + true + + + + 513 + + + + + + + + + + + + + true + \ No newline at end of file diff --git a/SampleApplications/Samples/ClientControls.Net4/Configuration/CertificateListCtrl.cs b/SampleApplications/Samples/ClientControls.Net4/Configuration/CertificateListCtrl.cs index bfe8470b21..615c1bdefd 100644 --- a/SampleApplications/Samples/ClientControls.Net4/Configuration/CertificateListCtrl.cs +++ b/SampleApplications/Samples/ClientControls.Net4/Configuration/CertificateListCtrl.cs @@ -350,27 +350,6 @@ namespace Opc.Ua.Client.Controls else { listItem.SubItems[2].Text = "No"; - - if (m_storeId != null) - { - ICertificateStore store = m_storeId.OpenStore(); - - try - { - if (store.GetPrivateKeyFilePath(certificate.Thumbprint) != null) - { - listItem.SubItems[2].Text = "Yes (No Access)"; - } - } - catch (Exception e) - { - listItem.SubItems[2].Text = e.Message; - } - finally - { - store.Close(); - } - } } // look up domains. diff --git a/SampleApplications/Samples/ClientControls.Net4/Configuration/CertificateStoreCtrl.cs b/SampleApplications/Samples/ClientControls.Net4/Configuration/CertificateStoreCtrl.cs index d412921705..e3ad4d2730 100644 --- a/SampleApplications/Samples/ClientControls.Net4/Configuration/CertificateStoreCtrl.cs +++ b/SampleApplications/Samples/ClientControls.Net4/Configuration/CertificateStoreCtrl.cs @@ -56,7 +56,7 @@ namespace Opc.Ua.Client.Controls InitializeComponent(); StoreTypeCB.Items.Add(CertificateStoreType.Directory); - StoreTypeCB.Items.Add(CertificateStoreType.Windows); + StoreTypeCB.Items.Add(CertificateStoreType.X509Store); StoreTypeCB.SelectedIndex = 0; } #endregion @@ -170,7 +170,7 @@ namespace Opc.Ua.Client.Controls stores.Add(Path.DirectorySeparatorChar + "OPC Foundation" + Path.DirectorySeparatorChar + "CertificateStores" + Path.DirectorySeparatorChar + "RejectedCertificates"); } - if (CertificateStoreType.Windows == storeType) + if (CertificateStoreType.X509Store == storeType) { stores.Add("LocalMachine\\My"); stores.Add("LocalMachine\\UA Applications"); @@ -244,7 +244,7 @@ namespace Opc.Ua.Client.Controls storePath = dialog.SelectedPath; } - if (storeType == CertificateStoreType.Windows) + if (storeType == CertificateStoreType.X509Store) { CertificateStoreIdentifier store = new CertificateStoreTreeDlg().ShowDialog(null); diff --git a/SampleApplications/Samples/ClientControls.Net4/Configuration/CertificateStoreTreeCtrl.cs b/SampleApplications/Samples/ClientControls.Net4/Configuration/CertificateStoreTreeCtrl.cs index 1f48802db6..66f9e3c457 100644 --- a/SampleApplications/Samples/ClientControls.Net4/Configuration/CertificateStoreTreeCtrl.cs +++ b/SampleApplications/Samples/ClientControls.Net4/Configuration/CertificateStoreTreeCtrl.cs @@ -28,8 +28,6 @@ * ======================================================================*/ using System; -using System.Collections.Generic; -using System.ComponentModel; using System.Drawing; using System.Text; using System.Windows.Forms; @@ -38,12 +36,6 @@ using System.Xml; using System.Runtime.Serialization; using System.Reflection; using System.Security.Cryptography.X509Certificates; -using System.ServiceProcess; -using System.Management; -using System.Management.Instrumentation; -using System.Runtime.InteropServices; -using Opc.Ua.Configuration; -using System.Threading.Tasks; namespace Opc.Ua.Client.Controls { diff --git a/SampleApplications/Samples/NetCoreConsoleClient/Program.cs b/SampleApplications/Samples/NetCoreConsoleClient/Program.cs index 0a0c4924aa..c7158523cf 100644 --- a/SampleApplications/Samples/NetCoreConsoleClient/Program.cs +++ b/SampleApplications/Samples/NetCoreConsoleClient/Program.cs @@ -57,8 +57,8 @@ namespace NetCoreConsoleClient { ApplicationCertificate = new CertificateIdentifier { - StoreType = "Directory", - StorePath = "OPC Foundation/CertificateStores/MachineDefault", + StoreType = "X509Store", + StorePath = "CurrentUser\\UA_MachineDefault", SubjectName = "UA Core Sample Client" }, TrustedPeerCertificates = new CertificateTrustList diff --git a/SampleApplications/Samples/NetCoreConsoleServer/Opc.Ua.SampleServer.Config.xml b/SampleApplications/Samples/NetCoreConsoleServer/Opc.Ua.SampleServer.Config.xml index 536a4418a0..b185c3cfa4 100644 --- a/SampleApplications/Samples/NetCoreConsoleServer/Opc.Ua.SampleServer.Config.xml +++ b/SampleApplications/Samples/NetCoreConsoleServer/Opc.Ua.SampleServer.Config.xml @@ -13,8 +13,8 @@ - Directory - OPC Foundation/CertificateStores/MachineDefault + X509Store + CurrentUser\UA_MachineDefault UA Core Sample Server @@ -42,8 +42,7 @@ - - + 600000 @@ -193,7 +192,7 @@ - + 519 diff --git a/SampleApplications/Samples/Server.Net4/Opc.Ua.SampleServer.Config.xml b/SampleApplications/Samples/Server.Net4/Opc.Ua.SampleServer.Config.xml index d2e4743a3a..32e87403b0 100644 --- a/SampleApplications/Samples/Server.Net4/Opc.Ua.SampleServer.Config.xml +++ b/SampleApplications/Samples/Server.Net4/Opc.Ua.SampleServer.Config.xml @@ -13,8 +13,8 @@ - Directory - %CommonApplicationData%\OPC Foundation\CertificateStores\MachineDefault + X509Store + CurrentUser\UA_MachineDefault UA Sample Server diff --git a/SampleApplications/Samples/Server/Opc.Ua.SampleServer.Config.xml b/SampleApplications/Samples/Server/Opc.Ua.SampleServer.Config.xml index 7a6f7a8256..5a83c82143 100644 --- a/SampleApplications/Samples/Server/Opc.Ua.SampleServer.Config.xml +++ b/SampleApplications/Samples/Server/Opc.Ua.SampleServer.Config.xml @@ -1,208 +1,208 @@ - - - Opc.Ua.SampleServer - urn:localhost:OPCFoundation:SampleServer - http://opcfoundation.org/UA/SampleServer - Server_0 - - - - - - Directory - %LocalFolder%\OPC Foundation\CertificateStores\MachineDefault - Opc.Ua.SampleServer - - - - - Directory - %LocalFolder%\OPC Foundation\CertificateStores\UA Certificate Authorities - - - - - Directory - %LocalFolder%\OPC Foundation\CertificateStores\UA Applications - - - - - Directory - %LocalFolder%\OPC Foundation\CertificateStores\RejectedCertificates - - - - - - - - - 600000 - 1048576 - 4194304 - 65535 - 4194304 - 65535 - 300000 - 3600000 - - - - - opc.tcp://localhost:51210/UA/SampleServer - - - - - - - - SignAndEncrypt_3 - http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15 - 4 - - - Sign_2 - http://opcfoundation.org/UA/SecurityPolicy#Basic256 - 2 - - - None_1 - http://opcfoundation.org/UA/SecurityPolicy#None - 0 - - - Sign_2 - http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15 - 1 - - - SignAndEncrypt_3 - http://opcfoundation.org/UA/SecurityPolicy#Basic256 - 5 - - - Sign_2 - http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256 - 3 - - - SignAndEncrypt_3 - http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256 - 6 - - - - 5 - 100 - 2000 - - - - - - Anonymous_0 - http://opcfoundation.org/UA/SecurityPolicy#None - - - - - UserName_1 - - http://opcfoundation.org/UA/SecurityPolicy#Basic256 - - - - - Certificate_2 - - http://opcfoundation.org/UA/SecurityPolicy#Basic256 - - - - true - 100 - 10000 - 3600000 - 10 - 10 - 100 - 600000 - 100 - 3600000 - 50 - 3600000 - 100 - 100 - 1000 - 1000 - - 0 - Opc.Ua.Server.nodes.xml - - - - - - - - UInt32 - 100 - UInt32 - - - Double - 100 - Double - - - - - - - - %LocalFolder%\Logs\Opc.Ua.SampleServer.log.txt - true - - - - 513 - - - - - - - - - - - - true - + + + Opc.Ua.SampleServer + urn:localhost:OPCFoundation:SampleServer + http://opcfoundation.org/UA/SampleServer + Server_0 + + + + + + X509Store + CurrentUser\UA_MachineDefault + Opc.Ua.SampleServer + + + + + Directory + %LocalFolder%\OPC Foundation\CertificateStores\UA Certificate Authorities + + + + + Directory + %LocalFolder%\OPC Foundation\CertificateStores\UA Applications + + + + + Directory + %LocalFolder%\OPC Foundation\CertificateStores\RejectedCertificates + + + + + + + + + 600000 + 1048576 + 4194304 + 65535 + 4194304 + 65535 + 300000 + 3600000 + + + + + opc.tcp://localhost:51210/UA/SampleServer + + + + + + + + SignAndEncrypt_3 + http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15 + 4 + + + Sign_2 + http://opcfoundation.org/UA/SecurityPolicy#Basic256 + 2 + + + None_1 + http://opcfoundation.org/UA/SecurityPolicy#None + 0 + + + Sign_2 + http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15 + 1 + + + SignAndEncrypt_3 + http://opcfoundation.org/UA/SecurityPolicy#Basic256 + 5 + + + Sign_2 + http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256 + 3 + + + SignAndEncrypt_3 + http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256 + 6 + + + + 5 + 100 + 2000 + + + + + + Anonymous_0 + http://opcfoundation.org/UA/SecurityPolicy#None + + + + + UserName_1 + + http://opcfoundation.org/UA/SecurityPolicy#Basic256 + + + + + Certificate_2 + + http://opcfoundation.org/UA/SecurityPolicy#Basic256 + + + + true + 100 + 10000 + 3600000 + 10 + 10 + 100 + 600000 + 100 + 3600000 + 50 + 3600000 + 100 + 100 + 1000 + 1000 + + 0 + Opc.Ua.Server.nodes.xml + + + + + + + + UInt32 + 100 + UInt32 + + + Double + 100 + Double + + + + + + + + %LocalFolder%\Logs\Opc.Ua.SampleServer.log.txt + true + + + + 513 + + + + + + + + + + + + true + \ No newline at end of file diff --git a/Stack/Opc.Ua.Core/Schema/ApplicationConfiguration.cs b/Stack/Opc.Ua.Core/Schema/ApplicationConfiguration.cs index fdc7ae81ba..155872ad73 100644 --- a/Stack/Opc.Ua.Core/Schema/ApplicationConfiguration.cs +++ b/Stack/Opc.Ua.Core/Schema/ApplicationConfiguration.cs @@ -1921,7 +1921,7 @@ namespace Opc.Ua /// The type of certificate store. /// /// - /// If the StoreName is not empty, the CertificateStoreType.Windows is returned, otherwise the StoreType is returned. + /// If the StoreName is not empty, the CertificateStoreType.X509Store is returned, otherwise the StoreType is returned. /// [DataMember(IsRequired = false, EmitDefaultValue = false, Order = 0)] public string StoreType @@ -1930,7 +1930,7 @@ namespace Opc.Ua { if (!String.IsNullOrEmpty(m_storeName)) { - return CertificateStoreType.Windows; + return CertificateStoreType.X509Store; } return m_storeType; @@ -1978,7 +1978,7 @@ namespace Opc.Ua { if (m_storePath.StartsWith("LocalMachine", StringComparison.CurrentCultureIgnoreCase) || m_storePath.StartsWith("CurrentUser", StringComparison.CurrentCultureIgnoreCase)) { - m_storeType = CertificateStoreType.Windows; + m_storeType = CertificateStoreType.X509Store; } else { @@ -2190,7 +2190,7 @@ namespace Opc.Ua { if (!String.IsNullOrEmpty(m_storeName)) { - return CertificateStoreType.Windows; + return CertificateStoreType.X509Store; } return m_storeType; @@ -2234,7 +2234,7 @@ namespace Opc.Ua { if (m_storePath.StartsWith("LocalMachine", StringComparison.CurrentCultureIgnoreCase) || m_storePath.StartsWith("CurrentUser", StringComparison.CurrentCultureIgnoreCase)) { - m_storeType = CertificateStoreType.Windows; + m_storeType = CertificateStoreType.X509Store; } else { diff --git a/Stack/Opc.Ua.Core/Schema/SecuredApplicationHelpers.cs b/Stack/Opc.Ua.Core/Schema/SecuredApplicationHelpers.cs index b69bc6d6fe..f420ea73bb 100644 --- a/Stack/Opc.Ua.Core/Schema/SecuredApplicationHelpers.cs +++ b/Stack/Opc.Ua.Core/Schema/SecuredApplicationHelpers.cs @@ -461,18 +461,8 @@ namespace Opc.Ua.Security Opc.Ua.CertificateIdentifier output = SecuredApplication.FromCertificateIdentifier(this); return output.OpenStore(); } - - /// - /// Gets the private key file path. - /// - public async Task GetPrivateKeyFilePath() - { - Opc.Ua.CertificateIdentifier output = SecuredApplication.FromCertificateIdentifier(this); - return await output.GetPrivateKeyFilePath(); - } } - - + /// /// An identifier for a certificate store. /// diff --git a/Stack/Opc.Ua.Core/Security/AccessControl/ApplicationAccessRule.cs b/Stack/Opc.Ua.Core/Security/AccessControl/ApplicationAccessRule.cs deleted file mode 100644 index 51e52f6763..0000000000 --- a/Stack/Opc.Ua.Core/Security/AccessControl/ApplicationAccessRule.cs +++ /dev/null @@ -1,41 +0,0 @@ -/* Copyright (c) 1996-2016, OPC Foundation. All rights reserved. - The source code in this file is covered under a dual-license scenario: - - RCL: for OPC Foundation members in good-standing - - GPL V2: everybody else - RCL license terms accompanied with this source code. See http://opcfoundation.org/License/RCL/1.00/ - GNU General Public License as published by the Free Software Foundation; - version 2 of the License are accompanied with this source code. See http://opcfoundation.org/License/GPLv2 - This source code is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. -*/ - -using System; -using System.Collections.Generic; -using System.IO; - -namespace Opc.Ua -{ - /// - /// An access rule for an application. - /// - public partial class ApplicationAccessRule - { - /// Gets the application access rules implied by the access rights to the file. - /// - public static IList GetAccessRules(String filePath) - { - // combine the access rules into a set of abstract application rules. - List accessRules = new List(); - - return accessRules; - } - - /// - /// Gets the application access rules implied by the access rights to the file. - /// - public static void SetAccessRules(String filePath, IList accessRules, bool replaceExisting) - { - } - } -} diff --git a/Stack/Opc.Ua.Core/Security/AccessControl/HttpAccessRule.cs b/Stack/Opc.Ua.Core/Security/AccessControl/HttpAccessRule.cs deleted file mode 100644 index e542b5c617..0000000000 --- a/Stack/Opc.Ua.Core/Security/AccessControl/HttpAccessRule.cs +++ /dev/null @@ -1,216 +0,0 @@ -/* Copyright (c) 1996-2016, OPC Foundation. All rights reserved. - The source code in this file is covered under a dual-license scenario: - - RCL: for OPC Foundation members in good-standing - - GPL V2: everybody else - RCL license terms accompanied with this source code. See http://opcfoundation.org/License/RCL/1.00/ - GNU General Public License as published by the Free Software Foundation; - version 2 of the License are accompanied with this source code. See http://opcfoundation.org/License/GPLv2 - This source code is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. -*/ - -using System; -using System.Collections.Generic; -using System.Runtime.InteropServices; -using System.Runtime.Serialization; -using System.Text; -using System.Net; -using System.Security.Cryptography.X509Certificates; - -namespace Opc.Ua.Configuration -{ - /// - /// An access rule for an HTTP URL used by a WCF service. - /// - [DataContract(Namespace=Namespaces.OpcUaConfig)] - public class HttpAccessRule - { - const Int16 AF_INET = 2; - const Int16 AF_INET6 = 23; - } - - #region AccessControlEntity Class - /// - /// A class that stores the components of ACE within a DACL. - /// - public class AccessControlEntity - { - /// - /// The access type granted by the ACE. - /// - public string AccessType - { - get { return m_accessType; } - set { m_accessType = value; } - } - - /// - /// Any flags associated with the ACE. - /// - [System.Diagnostics.CodeAnalysis.SuppressMessage("Microsoft.Naming", "CA1726:UsePreferredTerms", MessageId = "Flags")] - public string Flags - { - get { return m_flags; } - set { m_flags = value; } - } - - /// - /// The rights allowed/restricted by the ACE. - /// - public string Rights - { - get { return m_rights; } - set { m_rights = value; } - } - - /// - /// The object associated with the ACE. - /// - public string ObjectGuid - { - get { return m_objectGuid; } - set { m_objectGuid = value; } - } - - /// - /// The inherited object associated with the ACE. - /// - public string InheritObjectGuid - { - get { return m_inheritObjectGuid; } - set { m_inheritObjectGuid = value; } - } - - /// - /// The SID for the account which is affected by the ACE. - /// - public string AccountSid - { - get { return m_accountSid; } - set { m_accountSid = value; } - } - - /// - /// Extracts a list of ACEs from a SDDL string. - /// - public static IList Parse(string sddl) - { - List entities = new List(); - - if (!sddl.StartsWith("D:", StringComparison.Ordinal)) - { - throw new ArgumentException(Utils.Format("Could not parse SDDL string: {0}", sddl)); - } - - sddl = sddl.Substring(2, sddl.Length-2); - - string[] aces = sddl.Split('(', ')'); - - for (int ii = 0; ii < aces.Length; ii++) - { - if (String.IsNullOrEmpty(aces[ii])) - { - continue; - } - - AccessControlEntity entity = new AccessControlEntity(); - entity.Initialize(aces[ii]); - entities.Add(entity); - } - - return entities; - } - - /// - /// Extracts a single ACE from a SDDL string fragment. - /// - public void Initialize(string sddl) - { - string[] fields = sddl.Split(';'); - - if (fields.Length != 6) - { - throw new ArgumentException(Utils.Format("Could not parse SDDL ACE string: {0}", sddl)); - } - - m_accessType = fields[0]; - m_flags = fields[1]; - m_rights = fields[2]; - m_objectGuid = fields[3]; - m_inheritObjectGuid = fields[4]; - m_accountSid = fields[5]; - } - - private string m_accessType; - private string m_flags; - private string m_rights; - private string m_objectGuid; - private string m_inheritObjectGuid; - private string m_accountSid; - } - #endregion - - #region SslCertificateBinding Class - /// - /// Stores the details of an SSL certification configuration binding. - /// - public class SslCertificateBinding - { - /// - /// The IP Address. - /// - public IPAddress IPAddress { get; set; } - - /// - /// The port number. - /// - public ushort Port { get; set; } - - /// - /// The certificate thumbprint. - /// - public string Thumbprint { get; set; } - - /// - /// The application id. - /// - public Guid ApplicationId { get; set; } - - /// - /// The names of the store to use. - /// - public string StoreName { get; set; } - - /// - /// The default revocation check mode. - /// - public uint DefaultCertCheckMode { get; set; } - - /// - /// The default revocation freshness time. - /// - public int DefaultRevocationFreshnessTime { get; set; } - - /// - /// The default revocation URL timeout. - /// - public int DefaultRevocationUrlRetrievalTimeout { get; set; } - - /// - /// The default certificate trust list identifier. - /// - public string DefaultSslCtlIdentifier { get; set; } - - /// - /// The default certificate trust list store. - /// - public string DefaultSslCtlStoreName { get; set; } - - /// - /// The default flags. - /// - public uint DefaultFlags { get; set; } - } - #endregion -} diff --git a/Stack/Opc.Ua.Core/Security/Certificates/CertificateFactory.cs b/Stack/Opc.Ua.Core/Security/Certificates/CertificateFactory.cs index 7e941dc4be..16b9996312 100644 --- a/Stack/Opc.Ua.Core/Security/Certificates/CertificateFactory.cs +++ b/Stack/Opc.Ua.Core/Security/Certificates/CertificateFactory.cs @@ -183,12 +183,6 @@ namespace Opc.Ua bool isCA, X509Certificate2 issuerCAKeyCert) { - if (!String.IsNullOrEmpty(storeType) && - storeType != CertificateStoreType.Directory) - { - throw new NotSupportedException("Cannot create a certificate for a non directory store."); - } - if (issuerCAKeyCert != null) { if (!issuerCAKeyCert.HasPrivateKey) @@ -312,15 +306,23 @@ namespace Opc.Ua if (!String.IsNullOrEmpty(storePath)) { ICertificateStore store = null; - if (storeType == CertificateStoreType.Directory) + if (storeType == CertificateStoreType.X509Store) { - using (store = new DirectoryCertificateStore()) - { - store.Open(storePath); - store.Add(certificate); - store.Close(); - } + store = new X509CertificateStore(); } + else if (storeType == CertificateStoreType.Directory) + { + store = new DirectoryCertificateStore(); + } + else + { + throw new ArgumentException("Invalid store type"); + } + + store.Open(storePath); + store.Add(certificate); + store.Close(); + store.Dispose(); } // note: this cert has a private key! diff --git a/Stack/Opc.Ua.Core/Security/Certificates/CertificateIdentifier.cs b/Stack/Opc.Ua.Core/Security/Certificates/CertificateIdentifier.cs index 753521bebd..9958b14a5b 100644 --- a/Stack/Opc.Ua.Core/Security/Certificates/CertificateIdentifier.cs +++ b/Stack/Opc.Ua.Core/Security/Certificates/CertificateIdentifier.cs @@ -12,7 +12,6 @@ using System; using System.Collections.Generic; -using System.Runtime.Serialization; using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates; using System.Text; @@ -471,31 +470,6 @@ namespace Opc.Ua store.Open(this.StorePath); return store; } - - /// - /// Gets the private key file path. - /// - public async Task GetPrivateKeyFilePath() - { - X509Certificate2 certificate = await Find(false); - - if (certificate == null) - { - return null; - } - - ICertificateStore store = CertificateStoreIdentifier.CreateStore(this.StoreType); - - try - { - store.Open(this.StorePath); - return store.GetPrivateKeyFilePath(certificate.Thumbprint); - } - finally - { - store.Close(); - } - } #endregion #region Private Methods @@ -737,83 +711,6 @@ namespace Opc.Ua return null; } - /// - /// Whether the store supports access control. - /// - public bool SupportsAccessControl - { - get { return false; } - } - - /// - /// Returns the access rules that are currently applied to the store. - /// - /// The list of access rules. - public IList GetAccessRules() - { - throw new NotImplementedException(); - } - - /// - /// Sets the access rules that are currently applied to the store. - /// - /// The rules. - /// if set to true the existing access rules are replaced. - public void SetAccessRules(IList rules, bool replaceExisting) - { - throw new NotImplementedException(); - } - - /// - /// Whether the store supports access control on certificates. - /// - public bool SupportsCertificateAccessControl - { - get { return false; } - } - /// - /// Whether the store supports private keys. - /// - /// - public bool SupportsPrivateKeys - { - get { return false; } - } - - /// - /// Returns the file containing the private key for the specified certificate. - /// - public string GetPrivateKeyFilePath(string thumbprint) - { - return null; - } - - /// - /// Returns the access rules that are currently applied to the certficate's private key. - /// - /// The thumbprint. - /// The access rules. - public IList GetAccessRules(string thumbprint) - { - throw new NotImplementedException(); - } - - /// - /// Sets the access rules that are currently applied to the certficate's private key. - /// - /// The thumbprint. - /// The rules. - /// if set to true the existing access rules are replaced. - public void SetAccessRules(string thumbprint, IList rules, bool replaceExisting) - { - throw new NotImplementedException(); - } - - /// - /// Whether the store support CRLs. - /// - public bool SupportsCRLs { get { return false; } } - /// /// Checks if issuer has revoked the certificate. /// @@ -821,13 +718,13 @@ namespace Opc.Ua { return StatusCodes.BadNotSupported; } - + /// /// Returns the CRLs in the store. /// public List EnumerateCRLs() { - return new List(); + throw new ServiceResultException(StatusCodes.BadNotSupported); } /// @@ -835,9 +732,9 @@ namespace Opc.Ua /// public List EnumerateCRLs(X509Certificate2 issuer) { - return new List(); - } - + throw new ServiceResultException(StatusCodes.BadNotSupported); + } + /// /// Adds a CRL to the store. /// diff --git a/Stack/Opc.Ua.Core/Security/Certificates/CertificateStoreIdentifier.cs b/Stack/Opc.Ua.Core/Security/Certificates/CertificateStoreIdentifier.cs index eebb1bd112..267dab72cc 100644 --- a/Stack/Opc.Ua.Core/Security/Certificates/CertificateStoreIdentifier.cs +++ b/Stack/Opc.Ua.Core/Security/Certificates/CertificateStoreIdentifier.cs @@ -98,22 +98,22 @@ namespace Opc.Ua if (storePath.StartsWith("LocalMachine\\", StringComparison.OrdinalIgnoreCase)) { - return CertificateStoreType.Windows; + return CertificateStoreType.X509Store; } if (storePath.StartsWith("CurrentUser\\", StringComparison.OrdinalIgnoreCase)) { - return CertificateStoreType.Windows; + return CertificateStoreType.X509Store; } if (storePath.StartsWith("User\\", StringComparison.OrdinalIgnoreCase)) { - return CertificateStoreType.Windows; + return CertificateStoreType.X509Store; } if (storePath.StartsWith("Service\\", StringComparison.OrdinalIgnoreCase)) { - return CertificateStoreType.Windows; + return CertificateStoreType.X509Store; } return CertificateStoreType.Directory; @@ -133,6 +133,11 @@ namespace Opc.Ua switch (storeType) { + case CertificateStoreType.X509Store: + { + store = new X509CertificateStore(); + break; + } case CertificateStoreType.Directory: { store = new DirectoryCertificateStore(); @@ -175,7 +180,7 @@ namespace Opc.Ua /// /// A windows certificate store. /// - public const string Windows = "Windows"; + public const string X509Store = "X509Store"; /// /// A directory certificate store. diff --git a/Stack/Opc.Ua.Core/Security/Certificates/DirectoryCertificateStore.cs b/Stack/Opc.Ua.Core/Security/Certificates/DirectoryCertificateStore.cs index 367900d989..44adee556b 100644 --- a/Stack/Opc.Ua.Core/Security/Certificates/DirectoryCertificateStore.cs +++ b/Stack/Opc.Ua.Core/Security/Certificates/DirectoryCertificateStore.cs @@ -72,7 +72,7 @@ namespace Opc.Ua /// /// true if [no private keys]; otherwise, false. /// - public bool NoPrivateKeys { get; set; } + private bool NoPrivateKeys { get; set; } #endregion #region ICertificateStore Members @@ -164,6 +164,7 @@ namespace Opc.Ua m_lastDirectoryCheck = DateTime.MinValue; } + return Task.CompletedTask; } @@ -224,167 +225,6 @@ namespace Opc.Ua } } - /// - public bool SupportsAccessControl - { - get { return true; } - } - - /// - public IList GetAccessRules() - { - lock (m_lock) - { - return ApplicationAccessRule.GetAccessRules(m_certificateSubdir.FullName); - } - } - - /// - public void SetAccessRules(IList rules, bool replaceExisting) - { - lock (m_lock) - { - ApplicationAccessRule.SetAccessRules(m_certificateSubdir.FullName, rules, replaceExisting); - - if (String.Compare(m_certificateSubdir.FullName, m_privateKeySubdir.FullName, StringComparison.OrdinalIgnoreCase) != 0) - { - ApplicationAccessRule.SetAccessRules(m_privateKeySubdir.FullName, rules, replaceExisting); - } - } - } - - /// - public bool SupportsCertificateAccessControl - { - get - { - return true; - } - } - - /// - public bool SupportsPrivateKeys - { - get - { - return true; - } - } - - /// - public string GetPublicKeyFilePath(string thumbprint) - { - Entry entry = Find(thumbprint); - - if (entry == null) - { - return null; - } - - if (entry.CertificateFile == null || !entry.CertificateFile.Exists) - { - return null; - } - - return entry.CertificateFile.FullName; - } - - /// - public string GetPrivateKeyFilePath(string thumbprint) - { - Entry entry = Find(thumbprint); - - if (entry == null) - { - return null; - } - - if (entry.PrivateKeyFile == null || !entry.PrivateKeyFile.Exists) - { - return null; - } - - return entry.PrivateKeyFile.FullName; - } - - /// - /// Gets the CRL file paths. - /// - /// The certificate thumbprint. - /// - public string[] GetCrlFilePaths(string thumbprint) - { - List filePaths = new List(); - - Entry entry = Find(thumbprint); - - DirectoryInfo info = new DirectoryInfo(this.Directory.FullName + Path.DirectorySeparatorChar + "crl"); - - foreach (FileInfo file in info.GetFiles("*.crl")) - { - X509CRL crl = null; - - try - { - crl = new X509CRL(file.FullName); - } - catch (Exception e) - { - Utils.Trace(e, "Could not parse CRL file."); - continue; - } - - if (!Utils.CompareDistinguishedName(crl.Issuer, entry.Certificate.Subject)) - { - continue; - } - - filePaths.Add(file.FullName); - } - - return filePaths.ToArray(); - } - - /// - public IList GetAccessRules(string thumbprint) - { - lock (m_lock) - { - Entry entry = Find(thumbprint); - - if (entry == null) - { - throw new ArgumentException("Certificate does not exist in store."); - } - - if (entry.PrivateKeyFile == null || !entry.PrivateKeyFile.Exists) - { - throw new ArgumentException("Certificate does not have a private key in the store."); - } - - return ApplicationAccessRule.GetAccessRules(entry.PrivateKeyFile.FullName); - } - } - - /// - public void SetAccessRules(string thumbprint, IList rules, bool replaceExisting) - { - lock (m_lock) - { - Entry entry = Find(thumbprint); - - if (entry == null) - { - throw new ArgumentException("Certificate does not exist in store."); - } - - if (entry.PrivateKeyFile != null && entry.PrivateKeyFile.Exists) - { - ApplicationAccessRule.SetAccessRules(entry.PrivateKeyFile.FullName, rules, replaceExisting); - } - } - } - /// /// Loads the private key from a PFX file in the certificate store. /// @@ -472,11 +312,6 @@ namespace Opc.Ua return null; } - /// - /// Whether the store support CRLs. - /// - public bool SupportsCRLs { get { return true; } } - /// /// Checks if issuer has revoked the certificate. /// @@ -640,7 +475,7 @@ namespace Opc.Ua StringBuilder builder = new StringBuilder(); builder.Append(m_directory.FullName); - + builder.Append(Path.DirectorySeparatorChar + "crl" + Path.DirectorySeparatorChar); builder.Append(GetFileName(issuer)); builder.Append(".crl"); @@ -689,9 +524,9 @@ namespace Opc.Ua return false; } -#endregion + #endregion -#region Private Methods + #region Private Methods /// /// Reads the current contents of the directory from disk. /// diff --git a/Stack/Opc.Ua.Core/Security/Certificates/ICertificateStore.cs b/Stack/Opc.Ua.Core/Security/Certificates/ICertificateStore.cs index 7d5e3fd07b..eaf4261190 100644 --- a/Stack/Opc.Ua.Core/Security/Certificates/ICertificateStore.cs +++ b/Stack/Opc.Ua.Core/Security/Certificates/ICertificateStore.cs @@ -17,10 +17,10 @@ using System.Threading.Tasks; namespace Opc.Ua { - /// + /// /// An abstract interface to certficate stores. /// - public interface ICertificateStore : IDisposable + public interface ICertificateStore : IDisposable { /// /// Opens the store at the specified location. @@ -61,64 +61,11 @@ namespace Opc.Ua /// The matching certificate Task FindByThumbprint(string thumbprint); - /// - /// Whether the store supports access control. - /// - bool SupportsAccessControl { get; } - - /// - /// Returns the access rules that are currently applied to the store. - /// - /// The list of access rules. - IList GetAccessRules(); - - /// - /// Sets the access rules that are currently applied to the store. - /// - /// The rules. - /// if set to true the existing access rules are replaced. - void SetAccessRules(IList rules, bool replaceExisting); - - /// - /// Whether the store supports access control on certificates. - /// - bool SupportsCertificateAccessControl { get; } - /// Whether the store supports private keys. - /// - bool SupportsPrivateKeys { get; } - - /// - /// Returns the file containing the private key for the specified certificate. - /// - /// The thumbprint. - /// The full file path. Null if the certificate does not exist or the private key does not exist. - string GetPrivateKeyFilePath(string thumbprint); - - /// - /// Returns the access rules that are currently applied to the certficate's private key. - /// - /// The thumbprint. - /// The access rules. - IList GetAccessRules(string thumbprint); - - /// - /// Sets the access rules that are currently applied to the certficate's private key. - /// - /// The thumbprint. - /// The rules. - /// if set to true the existing access rules are replaced. - void SetAccessRules(string thumbprint, IList rules, bool replaceExisting); - - /// - /// Whether the store supports CRLs. - /// - bool SupportsCRLs { get; } - /// /// Checks if issuer has revoked the certificate. /// StatusCode IsRevoked(X509Certificate2 issuer, X509Certificate2 certificate); - + /// /// Returns the CRLs in the store. /// diff --git a/Stack/Opc.Ua.Core/Security/Certificates/X509CertificateStore.cs b/Stack/Opc.Ua.Core/Security/Certificates/X509CertificateStore.cs new file mode 100644 index 0000000000..0dedf9820a --- /dev/null +++ b/Stack/Opc.Ua.Core/Security/Certificates/X509CertificateStore.cs @@ -0,0 +1,210 @@ +/* Copyright (c) 1996-2016, OPC Foundation. All rights reserved. + + The source code in this file is covered under a dual-license scenario: + - RCL: for OPC Foundation members in good-standing + - GPL V2: everybody else + + RCL license terms accompanied with this source code. See http://opcfoundation.org/License/RCL/1.00/ + + GNU General Public License as published by the Free Software Foundation; + version 2 of the License are accompanied with this source code. See http://opcfoundation.org/License/GPLv2 + + This source code is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +*/ + +using System; +using System.Collections.Generic; +using System.IO; +using System.Security.Cryptography.X509Certificates; +using System.Threading.Tasks; + +namespace Opc.Ua +{ + /// + /// Provides access to a simple file based certificate store. + /// + public class X509CertificateStore : ICertificateStore + { + public X509CertificateStore() + { + m_store = null; + } + + public void Dispose() + { + Dispose(true); + } + + protected virtual void Dispose(bool disposing) + { + if (disposing) + { + Close(); + } + } + + /// + /// + /// Syntax: StoreLocation\StoreName + /// Examples: + /// LocalMachine\My + /// CurrentUser\Trust + /// + public void Open(string path) + { + if (path == null) throw new ArgumentNullException("path"); + + path = path.Trim(); + + if (string.IsNullOrEmpty(path)) + { + throw ServiceResultException.Create( + StatusCodes.BadUnexpectedError, + "Store Location cannot be empty."); + } + + // extract store name. + int index = path.IndexOf('\\'); + if (index == -1) + { + throw ServiceResultException.Create( + StatusCodes.BadUnexpectedError, + "Path does not specify a store name. Path={0}", + path); + } + + // extract store location. + string storeLocation = path.Substring(0, index); + StoreLocation selectedLocation = StoreLocation.CurrentUser; + bool found = false; + foreach (StoreLocation availableLocation in (StoreLocation[])Enum.GetValues(typeof(StoreLocation))) + { + if (availableLocation.ToString() == storeLocation) + { + selectedLocation = availableLocation; + found = true; + } + } + if (found == false) + { + throw ServiceResultException.Create( + StatusCodes.BadUnexpectedError, + "Store location specified not available.\r\nStore location={0}", + storeLocation); + } + + string storeName = path.Substring(index + 1); + m_store = new X509Store(storeName, selectedLocation); + m_store.Open(OpenFlags.ReadWrite); + } + + public void Close() + { + if (m_store != null) + { + m_store.Dispose(); + m_store = null; + } + } + + public Task Enumerate() + { + if (m_store == null) + { + throw new NullReferenceException("Store null. Call Open() on the store first!"); + } + + X509Certificate2Collection certificates = new X509Certificate2Collection(); + + certificates.AddRange(m_store.Certificates); + + return Task.FromResult(certificates); + } + + /// + public Task Add(X509Certificate2 certificate) + { + if (m_store == null) + { + throw new NullReferenceException("Store null. Call Open() on the store first!"); + } + + if (certificate == null) throw new ArgumentNullException("certificate"); + + if (!m_store.Certificates.Contains(certificate)) + { + m_store.Add(certificate); + Utils.Trace(Utils.TraceMasks.Information, "Added cert {0} to X509Store {1}.", certificate.ToString(), m_store.Name); + } + + return Task.CompletedTask; + } + + public Task Delete(string thumbprint) + { + if (m_store == null) + { + throw new NullReferenceException("Store null. Call Open() on the store first!"); + } + + foreach (X509Certificate2 certificate in m_store.Certificates) + { + if (certificate.Thumbprint == thumbprint) + { + m_store.Certificates.Remove(certificate); + } + } + + return Task.FromResult(true); + } + + public Task FindByThumbprint(string thumbprint) + { + if (m_store == null) + { + throw new NullReferenceException("Store null. Call Open() on the store first!"); + } + + X509Certificate2Collection collection = new X509Certificate2Collection(); + + foreach (X509Certificate2 certificate in m_store.Certificates) + { + if (certificate.Thumbprint == thumbprint) + { + collection.Add(certificate); + } + } + + return Task.FromResult(collection); + } + + public StatusCode IsRevoked(X509Certificate2 issuer, X509Certificate2 certificate) + { + throw new ServiceResultException(StatusCodes.BadNotSupported); + } + + public List EnumerateCRLs() + { + throw new ServiceResultException(StatusCodes.BadNotSupported); + } + + public List EnumerateCRLs(X509Certificate2 issuer) + { + throw new ServiceResultException(StatusCodes.BadNotSupported); + } + + public void AddCRL(X509CRL crl) + { + throw new ServiceResultException(StatusCodes.BadNotSupported); + } + + public bool DeleteCRL(X509CRL crl) + { + throw new ServiceResultException(StatusCodes.BadNotSupported); + } + + private X509Store m_store; + } +} diff --git a/Stack/Opc.Ua.Core/Security/Constants/SecurityConstants.cs b/Stack/Opc.Ua.Core/Security/Constants/SecurityConstants.cs index 2e9b24bcc1..11a7b2a966 100644 --- a/Stack/Opc.Ua.Core/Security/Constants/SecurityConstants.cs +++ b/Stack/Opc.Ua.Core/Security/Constants/SecurityConstants.cs @@ -12,48 +12,6 @@ namespace Opc.Ua { - /// - /// Constants that identify certificate store locations. - /// - public static class StoreLocations - { - /// - /// The store assigned to the current user. - /// - public const string CurrentUser = "CurrentUser"; - - /// - /// The store assigned to the local machine. - /// - public const string LocalMachine = "LocalMachine"; - } - - /// - /// Constants that identify certificate store names. - /// - public static class StoreNames - { - /// - /// The store used for personal certificates. - /// - public const string Personal = "My"; - - /// - /// The store used for UA application certificates. - /// - public const string Applications = "UA Applications"; - - /// - /// The store used for UA certificate authorities certificates. - /// - public const string CertificateAuthorities = "UA Certificate Authorities"; - - /// - /// The store used for trusted root certificate authorities. - /// - public const string Root = "Root"; - } - /// /// Defines constants for key security policies. ///