[ECC] Implicitly set CertificateType of Certificate Identifier & allow Revocation with ECC Issuer Certificate & fix VerifyECDsaKeyPair (#2924)

* implicitly set certificate type of certificate identifier
extend CertificateFactory to allow Revocation with ECC Issuer Certificate

* Add Crl tests for ECC

* fix X509 PFXUtils VerifyECDsaKeyPair

Author: romanett

Libraries/Opc.Ua.Security.Certificates/X509Certificate/X509PfxUtils.cs

@@ -257,8 +257,8 @@ public static bool VerifyECDsaKeyPair(
             bool throwOnError = false)
         {
             bool result = false;
-            using (ECDsa ecdsaPublicKey = certWithPrivateKey.GetECDsaPublicKey())
-            using (ECDsa ecdsaPrivateKey = certWithPublicKey.GetECDsaPrivateKey())
+            using (ECDsa ecdsaPublicKey = certWithPublicKey.GetECDsaPublicKey())
+            using (ECDsa ecdsaPrivateKey = certWithPrivateKey.GetECDsaPrivateKey())
             {
                 try
                 {

Stack/Opc.Ua.Core/Schema/ApplicationConfiguration.cs

@@ -3067,7 +3067,7 @@ public CertificateIdentifier()
         public CertificateIdentifier(X509Certificate2 certificate)
         {
             Initialize();
-            m_certificate = certificate;
+            Certificate = certificate;
         }
 
         /// <summary>
@@ -3076,7 +3076,7 @@ public CertificateIdentifier(X509Certificate2 certificate)
         public CertificateIdentifier(X509Certificate2 certificate, CertificateValidationOptions validationOptions)
         {
             Initialize();
-            m_certificate = certificate;
+            Certificate = certificate;
             m_validationOptions = validationOptions;
         }
 
@@ -3087,7 +3087,7 @@ public CertificateIdentifier(X509Certificate2 certificate, CertificateValidation
         public CertificateIdentifier(byte[] rawData)
         {
             Initialize();
-            m_certificate = CertificateFactory.Create(rawData, true);
+            Certificate = CertificateFactory.Create(rawData, true);
         }
 
         /// <summary>
@@ -3324,6 +3324,7 @@ public byte[] RawData
                 m_certificate = CertificateFactory.Create(value, true);
                 m_subjectName = m_certificate.Subject;
                 m_thumbprint = m_certificate.Thumbprint;
+                m_certificateType = GetCertificateType(m_certificate);
             }
         }
 

Stack/Opc.Ua.Core/Security/Certificates/CertificateFactory.cs

@@ -292,7 +292,19 @@ DateTime nextUpdate
                 .SetNextUpdate(nextUpdate)
                 .AddCRLExtension(X509Extensions.BuildAuthorityKeyIdentifier(issuerCertificate))
                 .AddCRLExtension(X509Extensions.BuildCRLNumber(crlSerialNumber + 1));
-            return new X509CRL(crlBuilder.CreateForRSA(issuerCertificate));
+
+            if (X509PfxUtils.IsECDsaSignature(issuerCertificate))
+            {
+#if ECC_SUPPORT
+                return new X509CRL(crlBuilder.CreateForECDsa(issuerCertificate));
+#else
+                throw new NotSupportedException("CRL can only be created for an RSA Certificate on this system");
+#endif
+            }
+            else
+            {
+                return new X509CRL(crlBuilder.CreateForRSA(issuerCertificate));
+            }
         }
 
 #if NETSTANDARD2_1 || NET472_OR_GREATER || NET5_0_OR_GREATER

Stack/Opc.Ua.Core/Security/Certificates/CertificateIdentifier.cs

@@ -145,7 +145,14 @@ public CertificateValidationOptions ValidationOptions
         public X509Certificate2 Certificate
         {
             get { return m_certificate; }
-            set { m_certificate = value; }
+            set
+            {
+                m_certificate = value;
+                if (m_certificate != null)
+                {
+                    m_certificateType = GetCertificateType(m_certificate);
+                }
+            }
         }
         #endregion
 

Tests/Opc.Ua.Security.Certificates.Tests/CRLTests.cs

@@ -30,6 +30,7 @@
 
 using System;
 using System.Globalization;
+using System.Runtime.InteropServices;
 using System.Security.Cryptography;
 using System.Security.Cryptography.X509Certificates;
 using System.Text;
@@ -44,6 +45,7 @@ namespace Opc.Ua.Security.Certificates.Tests
     /// </summary>
     [TestFixture, Category("CRL")]
     [Parallelizable]
+    [TestFixtureSource(nameof(FixtureArgs))]
     [SetCulture("en-us")]
     public class CRLTests
     {
@@ -58,16 +60,48 @@ public class CRLTests
             { 4096, HashAlgorithmName.SHA512 } }.ToArray();
         #endregion
 
+        /// <summary>
+        /// store types to run the tests with
+        /// </summary>
+        public static readonly object[] FixtureArgs = {
+            new object [] { nameof(Opc.Ua.ObjectTypeIds.RsaSha256ApplicationCertificateType)},
+            new object [] { nameof(Opc.Ua.ObjectTypeIds.EccNistP256ApplicationCertificateType)}
+        };
+
+        public CRLTests(string certificateType)
+        {
+            if (certificateType == CertificateStoreType.X509Store && !RuntimeInformation.IsOSPlatform(OSPlatform.Windows))
+            {
+                Assert.Ignore("X509 Store with crls is only supported on Windows, skipping test run");
+            }
+            m_certifiateType = certificateType;
+        }
+
+
         #region Test Setup
         /// <summary>
         /// Set up a Global Discovery Server and Client instance and connect the session
         /// </summary>
         [OneTimeSetUp]
         protected void OneTimeSetUp()
         {
-            m_issuerCert = CertificateBuilder.Create("CN=Root CA, O=OPC Foundation")
-                .SetCAConstraint()
-                .CreateForRSA();
+            if (m_certifiateType == nameof(Opc.Ua.ObjectTypeIds.RsaSha256ApplicationCertificateType))
+            {
+                m_issuerCert = CertificateBuilder.Create("CN=Root CA, O=OPC Foundation")
+                    .SetCAConstraint()
+                    .CreateForRSA();
+            }
+            else if (m_certifiateType == nameof(Opc.Ua.ObjectTypeIds.EccNistP256ApplicationCertificateType))
+            {
+                m_issuerCert = CertificateBuilder.Create("CN=Root CA, O=OPC Foundation")
+                    .SetCAConstraint()
+                    .SetECCurve(ECCurve.NamedCurves.nistP256)
+                    .CreateForECDsa();
+            }
+            else
+            {
+                throw new NotImplementedException();
+            }
         }
 
         /// <summary>
@@ -144,8 +178,16 @@ public void CrlBuilderTest(bool empty, bool noExtensions, KeyHashPair keyHashPai
                 crlBuilder.CrlExtensions.Add(X509Extensions.BuildCRLNumber(1111));
                 crlBuilder.CrlExtensions.Add(X509Extensions.BuildAuthorityKeyIdentifier(m_issuerCert));
             }
+            IX509CRL i509Crl;
+            if (X509PfxUtils.IsECDsaSignature(m_issuerCert))
+            {
 
-            var i509Crl = crlBuilder.CreateForRSA(m_issuerCert);
+                i509Crl = crlBuilder.CreateForECDsa(m_issuerCert);
+            }
+            else
+            {
+                i509Crl = crlBuilder.CreateForRSA(m_issuerCert);
+            }
             X509CRL x509Crl = new X509CRL(i509Crl.RawData);
             Assert.NotNull(x509Crl);
             Assert.NotNull(x509Crl.CrlExtensions);
@@ -203,10 +245,21 @@ public void CrlBuilderTestWithSignatureGenerator(KeyHashPair keyHashPair)
             crlBuilder.CrlExtensions.Add(X509Extensions.BuildAuthorityKeyIdentifier(m_issuerCert));
 
             IX509CRL ix509Crl;
-            using (RSA rsa = m_issuerCert.GetRSAPrivateKey())
+            if (X509PfxUtils.IsECDsaSignature(m_issuerCert))
             {
-                X509SignatureGenerator generator = X509SignatureGenerator.CreateForRSA(rsa, RSASignaturePadding.Pkcs1);
-                ix509Crl = crlBuilder.CreateSignature(generator);
+                using (ECDsa ecdsa = m_issuerCert.GetECDsaPrivateKey())
+                {
+                    X509SignatureGenerator generator = X509SignatureGenerator.CreateForECDsa(ecdsa);
+                    ix509Crl = crlBuilder.CreateSignature(generator);
+                }
+            }
+            else
+            {
+                using (RSA rsa = m_issuerCert.GetRSAPrivateKey())
+                {
+                    X509SignatureGenerator generator = X509SignatureGenerator.CreateForRSA(rsa, RSASignaturePadding.Pkcs1);
+                    ix509Crl = crlBuilder.CreateSignature(generator);
+                }
             }
             X509CRL x509Crl = new X509CRL(ix509Crl);
             Assert.NotNull(x509Crl);
@@ -322,6 +375,7 @@ private void ValidateCRL(
 
         #region Private Fields
         X509Certificate2 m_issuerCert;
+        private string m_certifiateType;
         #endregion
     }