Repository navigation
Implementation of X509 certificate APIs on iOS #49289
Description
Issues #47533 and #47910 track APIs that are missing from Apple Crypto interop on iOS. When I started removing the managed part of the Interop APIs from iOS build of System.Security.Cryptography.X509Certificates I realised I'd basically end up with a useless assembly that throws PlatformNotSupportedException for everything. The underlying reason is that iOS doesn't have the macOS keychain API and even the most basic X509 manipulation relies on a working export which is implemented through this API and hence not available. To make it at least marginally working the following things probably need to be done:
- Export certificates through
SecCertificateCopyDataAPI and expose it asAppleCryptoNative_X509GetRawData - Import certificates through
SecCertificateCreateWithData/SecPKCS12ImportAPI instead of temporary keychains
This should probably be analysed by someone who is more familiar with the API surface on the Apple side. It also looks like enumerating any certificate store, including the trusted root certificates, seems impossible on iOS.
Activity
bartonjs commentedon Mar 10, 2021
If I recall correctly, all the stuff about temporary keychains is because "copy to keychain" (for X509Store.Add) on a keychainless certificate actually modifies the live object, which made some later operations get weird (which almost certainly means tests failed).
So this may mean that things just have to work differently between iOS and macOS. If SecPKCS12Import doesn't automatically add things to the default keychain and its SecIdentityRef values work fine across the test suite, then great. (Seems like PKCS7 collection importing is still missing, though).
filipnavara commentedon Mar 10, 2021
Very likely yes. Certainly the iOS code has to use different APIs to work at all so that's a time investment that has to be made regardless of the situation on macOS. We can try to see how the iOS-compatible code would behave on macOS later and evaluate whether there's any way to enable more sharing. On macOS there's an additional
SecIdentityCreateWithCertificateAPI that would likely cover few more use cases that currently use the temporary keychains.Yep, it is. I am currently looking to establish at least parity with what Xamarin/Mono used to provide which, quite honestly, was not much.
filipnavara commentedon Apr 29, 2021
After #51926 is merged the functional changes for S.S.C.Algorithms are basically done. There's still some work with marking few APIs with unsupported attributes, etc. I started looking into S.S.C.X509Certificates again and I am leaning towards a completely separate PAL implementation on the managed side:
SecCertificateCreateWithData/SecPKCS12ImportSecPKCS12Import. Unfortunately theSecIdentityCreateAPI is private.SecItemAdd/SecItemUpdate/SecItemDelete/SecItemCopyMatching. In theory named keychains can be emulated with labels but I don't think it's worth it. It needs some additional entitlement which is currently not enabled for the Xunit tests.filipnavara commentedon Apr 29, 2021
First attempts seem promising. My first draft with lot of stubbed places passed around 65% of the unit tests. I will look more into it over the next couple of days.
filipnavara commentedon Apr 30, 2021
On macOS PKCS7 APIs actually exist -
CMSDecoderCreate,CMSDecoderCopySignerCert- and can be used for the import if desired. On iOS they are not supported unfortunately.