Skip to content

Use of Windows certificate store for authentication #900

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
JacobBarthelmeh wants to merge 5 commits into
base: master
Choose a base branch
from
Open

Use of Windows certificate store for authentication #900

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
69fc23a
add TrustedSystemCAKeys sshd option for system CA load
JacobBarthelmeh Sep 12, 2023
41d4d7d
add macro guard for system ca certs load
JacobBarthelmeh Sep 26, 2023
f32359d
Add support for loading user CA certs from a configurable Windows cer…
kareem-wolfssl Oct 11, 2024
6c36285
Prefix wolfSSH specific options with wolfSSH_.
kareem-wolfssl Nov 15, 2024
7dc6ac4
add Windows cert store use with signing and add example arguments
JacobBarthelmeh Feb 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
731 changes: 731 additions & 0 deletions .github/workflows/windows-cert-store-test.yml
View file
Open in desktop

Large diffs are not rendered by default.

23 changes: 19 additions & 4 deletions apps/wolfsshd/auth.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,9 @@
#include <wolfssl/wolfcrypt/error-crypt.h>
#include <wolfssl/wolfcrypt/coding.h>

#ifdef WOLFSSL_FPKI
#if defined(WOLFSSL_FPKI) || defined(_WIN32)
/* Used to bind a client certificate to the requested user name: by UPN
* with FPKI, by subject CN on Windows builds without FPKI. */
#include <wolfssl/wolfcrypt/asn.h>
#endif

Expand Down Expand Up @@ -1728,10 +1730,11 @@ static int RequestAuthentication(WS_UserAuthData* authData,
ret = WOLFSSH_USERAUTH_REJECTED;
}

#ifdef WOLFSSL_FPKI
#if defined(WOLFSSL_FPKI) || defined(_WIN32)
Comment thread
JacobBarthelmeh marked this conversation as resolved.
if (ret == WOLFSSH_USERAUTH_SUCCESS &&
authData->type == WOLFSSH_USERAUTH_PUBLICKEY) {
/* compare user name to UPN in certificate */
/* Bind the certificate to the requested user name via UPN with FPKI or
* CN without FPKI. */
if (authData->sf.publicKey.isCert) {
DecodedCert* dCert;
#ifdef WOLFSSH_SMALL_STACK
Expand All @@ -1756,6 +1759,7 @@ static int RequestAuthentication(WS_UserAuthData* authData,
}
else {
int usrMatch = 0;
#ifdef WOLFSSL_FPKI
int upnRealmUnchecked = 0;
DNS_entry* current = dCert->altNames;
const char* upnDomains =
Expand Down Expand Up @@ -1784,6 +1788,15 @@ static int RequestAuthentication(WS_UserAuthData* authData,
wolfSSH_Log(WS_LOG_WARN, "[SSHD] AuthorizedUPNDomains "
"not set; certificate UPN domain is not checked");
}
#else
/* Without FPKI compare subject CN with user name */
if (dCert->subjectCN != NULL &&
(int)XSTRLEN(usr) == dCert->subjectCNLen &&
XSTRNCMP(usr, dCert->subjectCN,
(size_t)dCert->subjectCNLen) == 0) {
usrMatch = 1;
}
#endif

if (usrMatch == 0) {
wolfSSH_Log(WS_LOG_ERROR, "[SSHD] incorrect user cert "
Expand Down Expand Up @@ -1821,7 +1834,9 @@ static int RequestAuthentication(WS_UserAuthData* authData,
}
else {
#ifdef _WIN32
/* Still need to get users token on Windows */
/* The UPN/CN-vs-username check above already bound the
* certificate to the requested user. Still need to get
* the users token on Windows. */
wolfSSH_Log(WS_LOG_INFO,
"[SSHD] Relying on CA for public key check");
rc = SetupUserTokenWin(usr, &authData->sf.publicKey,
Expand Down
Loading
Loading