From e99745aa41b7541f2a7d45c5d282284d06046932 Mon Sep 17 00:00:00 2001 From: Martin Regen Date: Mon, 10 Jul 2017 15:16:56 +0200 Subject: [PATCH 1/3] fix Security Certificyte Validation / test 010 NotSignatureValid is only returned on Windows, add the additional verification to be sure on all platforms. --- .../Certificates/CertificateValidator.cs | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/Stack/Opc.Ua.Core/Security/Certificates/CertificateValidator.cs b/Stack/Opc.Ua.Core/Security/Certificates/CertificateValidator.cs index 872a80959f..11cc7b83d9 100644 --- a/Stack/Opc.Ua.Core/Security/Certificates/CertificateValidator.cs +++ b/Stack/Opc.Ua.Core/Security/Certificates/CertificateValidator.cs @@ -817,6 +817,17 @@ namespace Opc.Ua case X509ChainStatusFlags.UntrustedRoot: { + // check if a self signed cert is valid + if (id.Certificate != null && Utils.CompareDistinguishedName(id.Certificate.Subject, id.Certificate.Subject)) + { + // NotSignatureValid status is only returned on Windows, + // we have to verify the cert integrity on other platforms + if (!IsSignatureValid(id.Certificate)) + { + goto case X509ChainStatusFlags.NotSignatureValid; + } + } + // ignore this error because the root check is done // by looking the certificate up in the trusted issuer stores passed to the validator. // the ChainStatus uses the Windows trusted issuer stores. @@ -915,6 +926,22 @@ namespace Opc.Ua oid.Value == "1.3.14.3.2.13" || // sha1DSA oid.Value == "1.3.14.3.2.27"; // dsaSHA1 } + /// + /// Returns if a self signed certificate is properly signed. + /// + private static bool IsSignatureValid(X509Certificate2 cert) + { + Org.BouncyCastle.X509.X509Certificate bcCert = new Org.BouncyCastle.X509.X509CertificateParser().ReadCertificate(cert.RawData); + try + { + bcCert.Verify(bcCert.GetPublicKey()); + } + catch + { + return false; + } + return true; + } #endregion #region WcfValidatorWrapper Class From 851fcd5fe0d3ef542e80638572ed38b1fad717ff Mon Sep 17 00:00:00 2001 From: Martin Regen Date: Mon, 10 Jul 2017 16:14:42 +0200 Subject: [PATCH 2/3] Only test if cert is not issuer --- .../Opc.Ua.Core/Security/Certificates/CertificateValidator.cs | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Stack/Opc.Ua.Core/Security/Certificates/CertificateValidator.cs b/Stack/Opc.Ua.Core/Security/Certificates/CertificateValidator.cs index 11cc7b83d9..3ead23a102 100644 --- a/Stack/Opc.Ua.Core/Security/Certificates/CertificateValidator.cs +++ b/Stack/Opc.Ua.Core/Security/Certificates/CertificateValidator.cs @@ -818,7 +818,8 @@ namespace Opc.Ua case X509ChainStatusFlags.UntrustedRoot: { // check if a self signed cert is valid - if (id.Certificate != null && Utils.CompareDistinguishedName(id.Certificate.Subject, id.Certificate.Subject)) + if (issuer == null && !isIssuer && + id.Certificate != null && Utils.CompareDistinguishedName(id.Certificate.Subject, id.Certificate.Subject)) { // NotSignatureValid status is only returned on Windows, // we have to verify the cert integrity on other platforms From 3770bc5344f7cdb8e3d279408729a757baf3b72a Mon Sep 17 00:00:00 2001 From: Martin Regen Date: Tue, 11 Jul 2017 10:36:13 +0200 Subject: [PATCH 3/3] improve comment --- .../Security/Certificates/CertificateValidator.cs | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Stack/Opc.Ua.Core/Security/Certificates/CertificateValidator.cs b/Stack/Opc.Ua.Core/Security/Certificates/CertificateValidator.cs index 3ead23a102..7a37804be3 100644 --- a/Stack/Opc.Ua.Core/Security/Certificates/CertificateValidator.cs +++ b/Stack/Opc.Ua.Core/Security/Certificates/CertificateValidator.cs @@ -817,12 +817,12 @@ namespace Opc.Ua case X509ChainStatusFlags.UntrustedRoot: { - // check if a self signed cert is valid + // self signed cert signature validation + // .Net Core ChainStatus returns NotSignatureValid only on Windows, + // so we have to do the extra cert signature check on all platforms if (issuer == null && !isIssuer && id.Certificate != null && Utils.CompareDistinguishedName(id.Certificate.Subject, id.Certificate.Subject)) { - // NotSignatureValid status is only returned on Windows, - // we have to verify the cert integrity on other platforms if (!IsSignatureValid(id.Certificate)) { goto case X509ChainStatusFlags.NotSignatureValid; @@ -831,7 +831,7 @@ namespace Opc.Ua // ignore this error because the root check is done // by looking the certificate up in the trusted issuer stores passed to the validator. - // the ChainStatus uses the Windows trusted issuer stores. + // the ChainStatus uses the trusted issuer stores. break; }