lethek / fluentcertificates

FluentCertificates is a library using the Immutable Fluent Builder pattern for easily creating, finding and exporting certificates. Makes it simple to generate your own certificate chains, or just stand-alone self-signed certificates.

fluentcertificates's Issues

Verify signatures using standard .NET methods rather than relying on the BouncyCastle library

Move the BouncyCastle dependencies from FluentCertificates.Builder to FluentCertificates.Builder.BouncyCastle package

Helpers/methods which ease the user's integration with BouncyCastle functionality should be moved into the FluentCertificates.BouncyCastle package. Use extension methods where appropriate.

Any remaining internal functionality depending on BouncyCastle should be rewritten to remove the dependency.

Support ECDsa keys

[BUG]Calling .ToCertificateRequest().CreateSigningRequest() on a CertificateBuilder used to work but now throws an exception

Describe the bug
Calling the ToCertificateRequest() method on a CertificateBuilder used to create a CertificateRequest instance that could be called with the parameterless CreateSigningRequest() method overload. However, this now throws an exception:

System.InvalidOperationException: This method cannot be used since no signing key was provided via a constructor, use an overload accepting an X509SignatureGenerator instead.
   at System.Security.Cryptography.X509Certificates.CertificateRequest.CreateSigningRequest()

Expected behaviour
To be able to create a Certificate Signing Request simply without advanced knowledge about signature generators etc.

Code snippet

using var keys = RSA.Create();
var req = new CertificateBuilder().SetKeyPair(keys).ToCertificateRequest();
var csr = req.CreateSigningRequest(); //This line used to not, but now throws an InvalidOperationException

Environment

• FluentCertificates 0.7.1
• .NET 6.0

The bug has the severity

• Major: The defect affects major functionality or major data. It has a workaround but is not obvious and is difficult.

Add method ToCertificateRequest() method to the CertificateBuilder

ToCertificateRequest should generate a .NET CertificateRequest object based on the builder's parameters. Write extension-methods for the CertificateRequest class for exporting as PEM etc.

The ToCsr method should be made obsolete.

The goal is to minimize the library's reliance on the BouncyCastle and use built-in .NET classes wherever possible without sacrificing flexibility.

Add support for encrypted private keys when exporting to PEM files

Currently, any private-key included in a PEM export is unencrypted

Export private keys *before* certificates when including them in a PEM export

At the moment, private keys are being exported last, after the certificate/s. I'm not aware of this causing issues anywhere, but in the interest of matching OpenSSL behaviours more closely, they should be serialized first.

Rework the Export extension-methods to fit-in with new .NET 7 APIs, and polyfill where possible to earlier frameworks

.NET 7 will be introducing a bunch of PEM export methods, making a lot of the extension-methods from FluentCertificates.Extensions redundant. See dotnet/runtime#51630

After exporting a chain/certificate-collection to PKCS12/PKCS7, using OpenSSL to convert to PEM wrongly lists certificates in reverse order

The end-user certificate should be listed first, followed by the certificate which signed it, and then the certificate which signed that one, etc., all the way to the root.