Skip to content

Commit beb93bb

Browse files
leefine02leefine02
leefine02
authored and
leefine02
committed
1 parent 973e015 commit beb93bb

File tree

4 files changed

+76
-37
lines changed

4 files changed

+76
-37
lines changed

‎RemoteFile/ImplementedStoreTypes/DER/DERCertificateStoreSerializer.cs‎

Lines changed: 10 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -5,24 +5,22 @@
55
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions
66
// and limitations under the License.
77

8-
using System;
9-
using System.Collections.Generic;
10-
using System.IO;
11-
using System.Linq;
12-
13-
using Newtonsoft.Json;
14-
8+
using Keyfactor.Extensions.Orchestrator.RemoteFile.Models;
9+
using Keyfactor.Extensions.Orchestrator.RemoteFile.RemoteHandlers;
1510
using Keyfactor.Logging;
11+
using Keyfactor.PKI.CryptographicObjects.Formatters;
1612
using Keyfactor.PKI.PrivateKeys;
1713
using Keyfactor.PKI.X509;
18-
using Keyfactor.Extensions.Orchestrator.RemoteFile.RemoteHandlers;
19-
using Keyfactor.Extensions.Orchestrator.RemoteFile.Models;
20-
2114
using Microsoft.Extensions.Logging;
22-
15+
using Newtonsoft.Json;
2316
using Org.BouncyCastle.Crypto;
2417
using Org.BouncyCastle.Pkcs;
18+
using Org.BouncyCastle.Tls;
2519
using Org.BouncyCastle.X509;
20+
using System;
21+
using System.Collections.Generic;
22+
using System.IO;
23+
using System.Linq;
2624

2725
namespace Keyfactor.Extensions.Orchestrator.RemoteFile.DER
2826
{
@@ -94,8 +92,7 @@ public List<SerializedStoreInfo> SerializeRemoteCertificateStore(Pkcs12Store cer
9492
throw new RemoteFileException($"DER certificate store has a private key at {SeparatePrivateKeyFilePath}, but no private key was passed with the certificate to this job.");
9593
}
9694

97-
CertificateConverter certConverter = CertificateConverterFactory.FromBouncyCastleCertificate(certificateStore.GetCertificate(alias).Certificate);
98-
certificateBytes = certConverter.ToDER(string.IsNullOrEmpty(storePassword) ? string.Empty : storePassword);
95+
certificateBytes = CryptographicObjectFormatter.DER.Format(certificateStore.GetCertificate(alias).Certificate);
9996

10097
if (!string.IsNullOrEmpty(SeparatePrivateKeyFilePath))
10198
{

‎RemoteFile/ImplementedStoreTypes/PEM/PEMCertificateStoreSerializer.cs‎

Lines changed: 55 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
using Keyfactor.PKI.Extensions;
1313
using Keyfactor.PKI.PEM;
1414
using Keyfactor.PKI.PrivateKeys;
15+
using Keyfactor.PKI.X509;
1516
using Microsoft.Extensions.Logging;
1617
using Newtonsoft.Json;
1718
using Org.BouncyCastle.Asn1.X9;
@@ -23,10 +24,12 @@
2324
using Org.BouncyCastle.X509;
2425
using System;
2526
using System.Collections.Generic;
27+
using System.DirectoryServices.Protocols;
2628
using System.IO;
2729
using System.Linq;
2830
using System.Security.Cryptography;
2931
using System.Text;
32+
using static Keyfactor.PKI.PEM.PemUtilities;
3033

3134
namespace Keyfactor.Extensions.Orchestrator.RemoteFile.PEM
3235
{
@@ -50,7 +53,7 @@ private enum PrivateKeyTypeEnum
5053

5154
private ILogger logger;
5255

53-
public PEMCertificateStoreSerializer(string storeProperties)
56+
public PEMCertificateStoreSerializer(string storeProperties)
5457
{
5558
logger = LogHandler.GetClassLogger(this.GetType());
5659
LoadCustomProperties(storeProperties);
@@ -59,7 +62,7 @@ public PEMCertificateStoreSerializer(string storeProperties)
5962
public Pkcs12Store DeserializeRemoteCertificateStore(byte[] storeContentBytes, string storePath, string storePassword, IRemoteHandler remoteHandler, bool isInventory)
6063
{
6164
logger.MethodEntry(LogLevel.Debug);
62-
65+
6366
Pkcs12StoreBuilder storeBuilder = new Pkcs12StoreBuilder();
6467
Pkcs12Store store = storeBuilder.Build();
6568

@@ -68,7 +71,7 @@ public Pkcs12Store DeserializeRemoteCertificateStore(byte[] storeContentBytes, s
6871

6972
if (IsTrustStore || (isInventory && IgnorePrivateKeyOnInventory))
7073
{
71-
foreach(X509CertificateEntry certificate in certificates)
74+
foreach (X509CertificateEntry certificate in certificates)
7275
{
7376
store.SetCertificateEntry(certificate.Certificate.Thumbprint(), certificate);
7477
}
@@ -122,7 +125,7 @@ public List<SerializedStoreInfo> SerializeRemoteCertificateStore(Pkcs12Store cer
122125

123126
if (!string.IsNullOrEmpty(storePassword) && privateKeyType != PrivateKeyTypeEnum.PKCS8)
124127
throw new RemoteFileException("Error retrieving private key. Certificate store password cannot have a non empty value if the private key is in PKCS#1 format (BEGIN [RSA|EC] PRIVATE KEY)");
125-
128+
126129
bool keyEntryProcessed = false;
127130
foreach (string alias in certificateStore.Aliases)
128131
{
@@ -140,10 +143,27 @@ public List<SerializedStoreInfo> SerializeRemoteCertificateStore(Pkcs12Store cer
140143
AsymmetricKeyParameter privateKey = certificateStore.GetKey(alias).Key;
141144
PrivateKeyConverter keyConverter = PrivateKeyConverterFactory.FromBCPrivateKeyAndCert(privateKey, endCertificate);
142145

143-
keyString = CryptographicObjectFormatter.PEM.Format(keyConverter, storePassword);
144-
pemString = string.IsNullOrEmpty(SeparatePrivateKeyFilePath)
145-
? CryptographicObjectFormatter.PEM.Format(endCertificate, keyConverter, storePassword, false)
146-
: CryptographicObjectFormatter.PEM.Format(endCertificate, false);
146+
pemString = CryptographicObjectFormatter.PEM.Format(endCertificate, false);
147+
148+
if (privateKeyType == PrivateKeyTypeEnum.PKCS8)
149+
{
150+
if (string.IsNullOrEmpty(storePassword))
151+
keyString = PemUtilities.DERToPEM(keyConverter.ToPkcs8BlobUnencrypted(), PemObjectType.PrivateKey);
152+
else
153+
keyString = CryptographicObjectFormatter.PEM.Format(keyConverter, storePassword);
154+
}
155+
else
156+
{
157+
TextWriter textWriter = new StringWriter();
158+
PemWriter pemWriter = new PemWriter(textWriter);
159+
pemWriter.WriteObject(privateKey);
160+
pemWriter.Writer.Flush();
161+
162+
keyString = textWriter.ToString();
163+
}
164+
165+
if (string.IsNullOrEmpty(SeparatePrivateKeyFilePath))
166+
pemString += keyString;
147167

148168
if (!IncludesChain)
149169
{
@@ -180,7 +200,7 @@ private void LoadCustomProperties(string storeProperties)
180200
IncludesChain = properties.IncludesChain == null || string.IsNullOrEmpty(properties.IncludesChain.Value) ? false : bool.Parse(properties.IncludesChain.Value);
181201
SeparatePrivateKeyFilePath = properties.SeparatePrivateKeyFilePath == null || string.IsNullOrEmpty(properties.SeparatePrivateKeyFilePath.Value) ? String.Empty : properties.SeparatePrivateKeyFilePath.Value;
182202
IgnorePrivateKeyOnInventory = properties.IgnorePrivateKeyOnInventory == null || string.IsNullOrEmpty(properties.IgnorePrivateKeyOnInventory.Value) ? false : bool.Parse(properties.IgnorePrivateKeyOnInventory.Value);
183-
203+
184204
logger.LogDebug("Custom Properties have been loaded:");
185205
logger.LogDebug($"IsTrustStore: {IsTrustStore}, IncludesChain: {IncludesChain}, SeparatePrivateKeyFilePath: {SeparatePrivateKeyFilePath}, IgnorePrivateKeyOnInventory: {IgnorePrivateKeyOnInventory}");
186206

@@ -195,7 +215,7 @@ private X509CertificateEntry[] GetCertificates(string certificates)
195215

196216
try
197217
{
198-
IEnumerable<string> pemCertificates = PemUtilities.SplitCollection(certificates);
218+
IEnumerable<string> pemCertificates = PemUtilities.SplitCollection(RemovePrivateKey(certificates));
199219
certificateEntries.AddRange(pemCertificates.Select(cert =>
200220
new X509CertificateEntry(new X509Certificate(CryptographicObjectFormatter.DER.Format(cert))))
201221
);
@@ -262,7 +282,7 @@ private AsymmetricKeyEntry GetPrivateKey(string storeContents, string storePassw
262282

263283
logger.MethodExit(LogLevel.Debug);
264284

265-
return keyEntry;
285+
return keyEntry;
266286
}
267287

268288
private PrivateKeyTypeEnum GetPrivateKeyType(string storeContents, out string privateKeyBegDelim)
@@ -325,5 +345,29 @@ private AsymmetricKeyParameter ToBCPrivateKey(ECDiffieHellman ecdh)
325345
throw new RemoteFileException("Error converting to BouncyCastle private key - Invalid parameter.");
326346
}
327347
}
348+
349+
private string RemovePrivateKey(string pemString)
350+
{
351+
List<string> delimiters = new List<string>();
352+
353+
foreach (string delim in PrivateKeyDelimetersPkcs8)
354+
delimiters.Add(delim);
355+
foreach (string delim in PrivateKeyDelimetersRSA)
356+
delimiters.Add(delim);
357+
foreach (string delim in PrivateKeyDelimetersEC)
358+
delimiters.Add(delim);
359+
360+
foreach (string delim in delimiters)
361+
{
362+
string delimEnd = delim.Replace("BEGIN", "END");
363+
int certStart = pemString.IndexOf(delim);
364+
if (certStart == -1)
365+
continue;
366+
int certLength = pemString.IndexOf(delimEnd) + delimEnd.Length - certStart;
367+
pemString = pemString.Remove(certStart, certLength);
368+
}
369+
370+
return pemString.Trim();
371+
}
328372
}
329373
}

‎RemoteFile/InventoryBase.cs‎

Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -5,21 +5,20 @@
55
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions
66
// and limitations under the License.
77

8-
using System;
9-
using System.Collections.Generic;
10-
using System.Linq;
11-
12-
using Keyfactor.Orchestrators.Extensions;
13-
using Keyfactor.Orchestrators.Common.Enums;
14-
using Keyfactor.Logging;
158
using Keyfactor.Extensions.Orchestrator.RemoteFile.Models;
9+
using Keyfactor.Logging;
10+
using Keyfactor.Orchestrators.Common.Enums;
11+
using Keyfactor.Orchestrators.Extensions;
12+
using Keyfactor.PKI.CryptographicObjects.Formatters;
1613
using Keyfactor.PKI.Extensions;
17-
14+
using Keyfactor.PKI.X509;
1815
using Microsoft.Extensions.Logging;
1916
using Newtonsoft.Json;
2017
using Org.BouncyCastle.Pkcs;
18+
using System;
19+
using System.Collections.Generic;
20+
using System.Linq;
2121
using System.Security.Cryptography.X509Certificates;
22-
using Keyfactor.PKI.X509;
2322

2423
namespace Keyfactor.Extensions.Orchestrator.RemoteFile
2524
{
@@ -57,10 +56,9 @@ public JobResult ProcessJob(InventoryJobConfiguration config, SubmitInventoryUpd
5756
List<string> certChain = new List<string>();
5857
foreach (X509CertificateEntry certificateEntry in entry.CertificateChain)
5958
{
60-
CertificateConverter converter = CertificateConverterFactory.FromBouncyCastleCertificate(certificateEntry.Certificate);
61-
certChain.Add(converter.ToPEM(false));
59+
certChain.Add(CryptographicObjectFormatter.PEM.Format(certificateEntry.Certificate, false));
6260
}
63-
61+
6462
inventoryItems.Add(new CurrentInventoryItem()
6563
{
6664
ItemStatus = OrchestratorInventoryItemStatus.Unknown,

‎RemoteFile/ManagementBase.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ public JobResult ProcessJob(ManagementJobConfiguration config)
3434
try
3535
{
3636
SetJobProperties(config, config.CertificateStoreDetails, logger);
37-
37+
3838
certificateStore = new RemoteCertificateStore(config.CertificateStoreDetails.ClientMachine, UserName, UserPassword, config.CertificateStoreDetails.StorePath, StorePassword, FileTransferProtocol, SSHPort, IncludePortInSPN);
3939
certificateStore.Initialize(SudoImpersonatedUser, UseShellCommands);
4040

0 commit comments

Comments
 (0)