dmariogatto / certificate-transparency

Certificate Transparency ported to C# for .NET

Certificate Transparency for .NET

C# .NET port of,

• certificate-transparency-java
• babylonhealth/certificate-transparency-android

    Install-Package Cats.CertificateTransparency

Blog Post

The library is designed to be dependency injection friendly, every service class has a matching interface. However, to get things up and running quickly there is also a static Instance class which will construct lazy singletons for both ILogListService and CertificateTransparencyVerifier.

If you want to provide a custom list of included and excluded domains to these static instances you must first call Instance.InitDomains. By default validation will be enabled for all TLS secured domains.

Instance.InitDomains(new [] { "*.google.com", "microsoft.com" }, new [] { "nuget.org" });

Examples

Plain old .NET Framework

var client = new HttpClient(new HttpClientHandler()
{
    ServerCertificateCustomValidationCallback = (request, certificate, chain, sslPolicyErrors) =>
    {
        var certificateChain = chain.ChainElements.OfType<X509ChainElement>().Select(i => i.Certificate).ToList();
        var certificateVerifier = Cats.CertificateTransparency.Instance.CertificateTransparencyVerifier;
        var ctValueTask = certificateVerifier.IsValidAsync(request.RequestUri.Host, certificateChain, CancellationToken.None);

        var ctResult = ctValueTask.IsCompleted
            ? ctValueTask.Result
            : ctValueTask.AsTask().Result;

        return ctResult.IsValid;
    }
});

Xamarin Android

bool VerifyCtResult(string hostname, IList<DotNetX509Certificate> certificateChain, CtVerificationResult result)
{
    // any extra checks or logging you might want to add
    return result.IsValid;
}

// optionally pass in a function to manually handle the transparency result
var httpHandler = new Cats.CertificateTransparency.CatsAndroidClientHandler(VerifyCtResult);
var client = new HttpClient(httpHandler);

Xamarin iOS

There is currently no platform specific implementation for iOS. Certificate transparency is already enabled since iOS 12.1.1, however, it can be disabled per domain via a property list setting NSRequiresCertificateTransparency.

If you are keen you could use the CertificateVerifier to build your own HttpClientHandler, similar to the included Android implementation.

Contributions

Any contributions are welcome! Especially extra test cases!

certificate-transparency's Issues

issue with CATS unable to validate certificates when google log file is not available

Hi @dmariogatto,

currently my app is blocked from making any http call because CATS can't get the below url to validate the certificate

https://www.gstatic.com/ct/log_list/v2/log_list.json

there is a newer version v3 available that the library can update to.
https://www.gstatic.com/ct/log_list/v3/log_list.json

at the time of writing, google took down the v2 document and cause clients to fail.
as temp solution, file is back up now but for permanent solution, can the library define both and have interface for clients to select between v2 and v3?

Thanks

Support custom HttpClient (for proxy auth)

Hello!

The library fails to work in an environment where internet access is only available via an authenticated proxy. While HttpClient does detect the system proxy it does not detect the required authentication credentials.

For example, that's the HttpClient I use in my app:

    var systemProxy = HttpClient.DefaultProxy.GetProxy(new(MyAppClient.BaseUrl)) ;
    if(systemProxy != null && _httpClientHandler.Proxy == null && _httpClientHandler.SupportsProxy)
    {
        _httpClientHandler.UseProxy = true;
        _httpClientHandler.Proxy = HttpClient.DefaultProxy;
        _httpClientHandler.DefaultProxyCredentials = CredentialCache.DefaultNetworkCredentials;
    }
    _httpClient = new(_httpClientHandler);

I don't need any proxy auto-configuration from this library, but I'd be great if at least GoogleLogListApi could support another constructor to which I could supply my own HttpClient. Then I could create my own Instance class and continue using that. Would that be a change you're willing to implement?

Thanks!

Getting Valid Response even though connected to MITM Proxy server and installed their root certificate.

I am using
https://mitmproxy.org/ to recreate the MITM attack.
I followed all the steps mentioned but this certificate transparency library always responds true. I can share the logid if required.