//******************************************************************************************************//  SelfSignedCertificateGenerator.cs - Gbtc////  Copyright © 2013, Grid Protection Alliance.  All Rights Reserved.////  Licensed to the Grid Protection Alliance (GPA) under one or more contributor license agreements. See//  the NOTICE file distributed with this work for additional information regarding copyright ownership.//  The GPA licenses this file to you under the MIT License (MIT), the "License"; you may//  not use this file except in compliance with the License. You may obtain a copy of the License at:////      http://www.opensource.org/licenses/MIT////  Unless agreed to in writing, the subject software distributed under the License is distributed on an//  "AS-IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. Refer to the//  License for the specific language governing permissions and limitations.////  Code Modification History://  ----------------------------------------------------------------------------------------------------//  12/18/2013 - Stephen C. Wills//       Generated original version of source code.////****************************************************************************************************** using System;using System.Collections.Generic;using System.Diagnostics;using System.Diagnostics.CodeAnalysis;using System.IO;using System.Linq;using System.Net;using System.Security;using System.Security.Cryptography;using System.Security.Cryptography.X509Certificates;using System.Text;using GSF.IO; namespace GSF.Net.Security{    /// <summary>    /// The CertificateGenerator searches certificate stores for existing certificates and creates    /// self-signed certificates if no matching certificate exists in any accessible store.    /// It then generates a certificate file at the specified certificate path.    /// </summary>    public class CertificateGenerator    {        #region [ Members ]         // Fields        private string m_issuer;        private string[] m_subjectNames;        private string m_certificatePath;        private List<string> m_debugLog;         #endregion         #region [ Constructors ]         /// <summary>        /// Creates a new instance of the <see cref="CertificateGenerator"/> class.        /// </summary>        public CertificateGenerator()        {            m_debugLog = new List<string>();        }         #endregion         #region [ Properties ]         /// <summary>        /// Gets or sets the name of the entity issuing the certificate.        /// </summary>        public string Issuer        {            get            {                return (m_issuer = m_issuer ?? GetDefaultIssuer());            }            set            {                m_issuer = value;            }        }         /// <summary>        /// Gets or sets the subject names (common names)        /// of the entity that this certificate identifies.        /// </summary>        public string[] SubjectNames        {            get            {                return (m_subjectNames = m_subjectNames ?? GetDefaultSubjectNames());            }            set            {                m_subjectNames = value;            }        }         /// <summary>        /// Gets or sets the path to the certificate file        /// that is generated by this certificate generator.        /// </summary>        public string CertificatePath        {            get            {                return (m_certificatePath = m_certificatePath ?? GetDefaultCertificatePath());            }            set            {                m_certificatePath = value;            }        }         /// <summary>        /// Gets a list of detailed log messages        /// </summary>        public List<string> DebugLog        {            get            {                return new List<string>(m_debugLog);            }        }         #endregion         #region [ Methods ]         /// <summary>        /// Generates the certificate.        /// </summary>        /// <returns>The certificate that was generated by this certificate generator.</returns>        [SuppressMessage("Microsoft.Maintainability", "CA1502:AvoidExcessiveComplexity")]        public X509Certificate2 GenerateCertificate()        {            List<X509Store> stores;            List<X509Certificate2> storedCertificates;             X509Certificate2 certificate = null;            string certificatePath;            string commonNameList;            byte[] certificateData;             ProcessStartInfo processInfo;            string makeCertPath;             m_debugLog.Clear();             stores = new List<X509Store>()            {                new X509Store(StoreName.My, StoreLocation.LocalMachine),                new X509Store(StoreName.My, StoreLocation.CurrentUser)            };             // Attempt to get an existing certificate from the given certificate path            certificatePath = FilePath.GetAbsolutePath(CertificatePath);             if (File.Exists(certificatePath))                m_debugLog.Add($"Searching for existing certificate...found ({certificatePath})");            else                m_debugLog.Add($"Searching for existing certificate...not found ({certificatePath})");             if (File.Exists(certificatePath))            {                try                {                    certificate = new X509Certificate2(certificatePath);                }                catch (CryptographicException ex)                {                    string message = new StringBuilder()                        .AppendLine()                        .AppendLine("Error opening existing certificate:")                        .AppendLine(ex.ToString())                        .AppendLine()                        .ToString();                     m_debugLog.Add(message);                }            }             try            {                TryOpenStores(stores, OpenFlags.ReadOnly);                 if (stores.Count == 0)                    m_debugLog.Add($"Opening certificate stores with readonly access...failed");                else if (stores.Count == 1)                    m_debugLog.Add($"Opening certificate stores with readonly access...opened {stores[0].Location} store");                else                    m_debugLog.Add($"Opening certificate stores with readonly access...success");                 // If a valid certificate exists on the certificate path,                // search the certificate stores to determine if we have                // access to its private key                if ((object)certificate != null)                {                    bool canAccessPrivateKey;                     storedCertificates = stores.SelectMany(store => store.Certificates.Cast<X509Certificate2>()).ToList();                    FindMatchingCertificates(storedCertificates, certificate);                    canAccessPrivateKey = storedCertificates.Any(CanAccessPrivateKey);                     if (canAccessPrivateKey)                        m_debugLog.Add($"Attempting to access existing certificate's private key...success");                    else                        m_debugLog.Add($"Attempting to access existing certificate's private key...failed");                     if (canAccessPrivateKey)                        return certificate;                }                 // Search the certificate stores for certificates                // with a matching issuer and accessible private keys                commonNameList = GetCommonNameList();                storedCertificates = stores.SelectMany(store => store.Certificates.Cast<X509Certificate2>()).ToList();                certificate = storedCertificates.FirstOrDefault(storedCertificate => storedCertificate.Issuer.Equals(commonNameList) && CanAccessPrivateKey(storedCertificate));                 if ((object)certificate != null)                    m_debugLog.Add($"Searching stores for a usable certificate with accessible private key...success");                else                    m_debugLog.Add($"Searching stores for a usable certificate with accessible private key...failed");                 // If such a certificate exists, generate the certificate file and return the result                if ((object)certificate != null)                {                    using (FileStream certificateStream = File.OpenWrite(certificatePath))                    {                        certificateData = certificate.Export(X509ContentType.Cert);                        certificateStream.Write(certificateData, 0, certificateData.Length);                    }                     return new X509Certificate2(certificatePath);                }            }            finally            {                CloseStores(stores);            }             try            {                // Ensure that we can write to the certificate                // stores before generating a new certificate                TryOpenStores(stores, OpenFlags.ReadWrite);                 if (stores.Count == 0)                    m_debugLog.Add($"Opening certificate stores with read-write access...failed");                else if (stores.Count == 1)                    m_debugLog.Add($"Opening certificate stores with read-write access...opened {stores[0].Location} store");                else                    m_debugLog.Add($"Opening certificate stores with read-write access...success");            }            finally            {                CloseStores(stores);            }             // Attempt to use makecert to create a new self-signed certificate            makeCertPath = FilePath.GetAbsolutePath("makecert.exe");             if (File.Exists(makeCertPath))                m_debugLog.Add("Searching for makecert utility to generate a new certificate...success");            else                m_debugLog.Add("Searching for makecert utility to generate a new certificate...failed");             if (File.Exists(makeCertPath))            {                foreach (X509Store store in stores)                {                    processInfo = new ProcessStartInfo(makeCertPath);                    processInfo.Arguments = string.Format("-r -pe -n \"{0}\" -ss My -sr {1} \"{2}\"", commonNameList, store.Location, certificatePath);                    processInfo.UseShellExecute = true;                     using (Process makeCertProcess = Process.Start(processInfo))                    {                        makeCertProcess.WaitForExit();                    }                     if (File.Exists(certificatePath))                        m_debugLog.Add($"Attemping to generate a new certificate in the {store.Location} store... success");                    else                        m_debugLog.Add($"Attemping to generate a new certificate in the {store.Location} store... failed");                     if (File.Exists(certificatePath))                        return new X509Certificate2(certificatePath);                }            }             // All attempts to generate the certificate failed, so we must throw an exception            throw new InvalidOperationException("Unable to generate the self-signed certificate.");        }         /// <summary>        /// Exports the private key of the certificate that is currently in use to the given path,        /// encrypting the file with the given password.        /// </summary>        /// <param name="exportPath">The path to which the certificate will be exported.</param>        /// <param name="password">The password used to encrypt the certificate file.</param>        public void ExportCertificateWithPrivateKey(string exportPath, SecureString password)        {            // Attempt to get an existing certificate from the given certificate path            string certificatePath = FilePath.GetAbsolutePath(CertificatePath);            X509Certificate2 certificate = new X509Certificate2(certificatePath);             using (X509Store store = new X509Store(StoreName.My, StoreLocation.CurrentUser))            {                store.Open(OpenFlags.ReadOnly);                 List<X509Certificate2> certificates = store.Certificates.Cast<X509Certificate2>().ToList();                FindMatchingCertificates(certificates, certificate);                 X509Certificate2 pvkCertificate = certificates.FirstOrDefault(CanAccessPrivateKey);                 if ((object)pvkCertificate == null)                    throw new InvalidOperationException("Could not locate private key in the current user store.");                 byte[] certificateData = pvkCertificate.Export(X509ContentType.Pfx, password);                File.Delete(exportPath);                File.WriteAllBytes(exportPath, certificateData);                 store.Close();            }        }         /// <summary>        /// Imports the given certificate into the current user store and then exports the public key.        /// </summary>        /// <param name="importPath">The file with the certificate and private key to be imported.</param>        /// <param name="password">The password used to encrypt the certificate file with the private key.</param>        public void ImportCertificateWithPrivateKey(string importPath, SecureString password)        {            X509KeyStorageFlags keyStorageFlags = X509KeyStorageFlags.Exportable | X509KeyStorageFlags.PersistKeySet;            X509Certificate2 certificate = new X509Certificate2(importPath, password, keyStorageFlags);             using (X509Store store = new X509Store(StoreName.My, StoreLocation.CurrentUser))            {                store.Open(OpenFlags.ReadWrite);                store.Add(certificate);                store.Close();            }             string certificatePath = FilePath.GetAbsolutePath(CertificatePath);            byte[] certificateData = certificate.Export(X509ContentType.Cert);            File.WriteAllBytes(certificatePath, certificateData);        }         // Gets the list of common names to be passed to        // makecert when generating self-signed certificates.        private string GetCommonNameList()        {            return string.Join(",", new string[] { Issuer }.Concat(SubjectNames).Distinct().Select(name => "CN=" + name));        }         // Gets the default value for the issuer.        private string GetDefaultIssuer()        {            return Dns.GetHostEntry(Dns.GetHostName()).HostName;        }         // Gets the default value for the subject names.        // This uses a DNS lookup to determine the host name of the system and        // all the possible IP addresses and aliases that the system may go by.        private string[] GetDefaultSubjectNames()        {            IPHostEntry hostEntry = Dns.GetHostEntry(Dns.GetHostName());             return hostEntry.AddressList#if !MONO                .Select(address => address.MapToIPv6())#endif                .Concat(hostEntry.AddressList)                .Distinct()                .Select(address => address.ToString())                .Concat(hostEntry.Aliases)                .Concat(new string[] { Environment.MachineName, hostEntry.HostName })                .ToArray();        }         // Gets the default path to which the certificate file will be generated.        private string GetDefaultCertificatePath()        {            return string.Format("{0}.cer", Issuer);        }         // Attempts to open all the stores in the given list of stores.        // After returning, the list of stores contains only the stores which could be opened.        private void TryOpenStores(List<X509Store> stores, OpenFlags flags)        {            for (int i = stores.Count - 1; i >= 0; i--)            {                try                {                    stores[i].Open(flags);                }                catch                {                    stores.RemoveAt(i);                }            }        }         // Filters the given list of certificates down to only the certificates that match the given certificate.        private void FindMatchingCertificates(List<X509Certificate2> certificates, X509Certificate2 certificate)        {            byte[] hash = certificate.GetCertHash();            byte[] key = certificate.GetPublicKey();             for (int i = certificates.Count - 1; i >= 0; i--)            {                if (!hash.SequenceEqual(certificates[i].GetCertHash()) || !key.SequenceEqual(certificates[i].GetPublicKey()))                    certificates.RemoveAt(i);            }        }         // Determines if the current application has access to the private key of the given certificate.        private bool CanAccessPrivateKey(X509Certificate2 certificate)        {            try            {                // The point here is not only to check if the certificate has a private key,                // but also to attempt to access its private key, since doing so might result                // in a CryptographicException; certificate.HasPrivateKey will not work                return ((object)certificate.PrivateKey != null);            }            catch (CryptographicException)            {                return false;            }        }         // Closes all stores in the given list of stores.        private void CloseStores(List<X509Store> stores)        {            foreach (X509Store store in stores)                store.Close();        }         #endregion    }}