Repository navigation
[QUIC] Certificate Validation with OpenSSL on Windows #55544
Description
Description
To support QUIC on older versions of Windows, the OpenSSL build of msquic may substitute. However, the raw certificate needs to be converted to PCERT_CONTEXT before loading into X509Certificate2. #51015 breaks this scenario due to loading the certificate in the wrong format.
Moreover, there should be better a way to disable certificate validation altogether and not attempt to load the certificate, than using a lambda that always returns true.
Configuration
Windows with OpenSSL build of msquic.dll, self-signed cert without chain.
Regression?
Skip this line https://github.com/dotnet/runtime/blob/main/src/libraries/System.Net.Quic/src/System/Net/Quic/Implementations/MsQuic/MsQuicConnection.cs#L368 and return success.
Other information
SChannel on Windows 11 works, OpenSSL on Linux works. QUIC could otherwise be supported on older versions of Windows too.
Activity
wegylexy commentedon Jul 13, 2021
@bartonjs Could be security-related too as the exception is thrown from
X509Certificate2CollectionandX509Certificate2, given a raw cert from the OpenSSL build ofmsquic. Do they only work with SChannel on Windows?wfurt commentedon Jul 13, 2021
I'm not sure I understand the comment @wegylexy. On Windows with channel the Handle is basically raw pointer to memory. When this is called with openssl backend you basically give it pointer to random memory. It is not surprising that it would crash. If you build MsQuic yourself you could fix up the crypto to cover to PCERT_CONTEXT or set it to null.
wegylexy commentedon Jul 13, 2021
@wfurt I see. So either msquic or .NET needs to convert the raw cert to
PCERT_CONTEXTon Windows, and .NET QUIC should support OpenSSL build of msquic on older versions of Windows, because at least Windows 8.1 and some LTS servers have no ways to enable TLS 1.3 in SChannel. It's also risky to ask Windows 10 users to change the registry to just to enable QUIC for our .NET 6 apps.wfurt commentedon Jul 13, 2021
avoiding crash is easy. The real question is how you are going to do real validation and certificate management.
I added flag to MsQuic to specific if the certificates are expected in "portable" e.g. PKCS format or as a native platform pointer. microsoft/msquic#1453 tracks deferred work to support "portable" option on Windows/Schannel. When I look at it back then, Windows has all the needed functions to deal with the formats so can could also submit fix to upstream msquic to convert OpenSSL structures to native PCERT_CONTEXT.
Furher more, microsoft/msquic#1258 added option to do OpenSSL validation with Windows store. That should get you really close.
cc: @nibanks @ThadHouse
wegylexy commentedon Jul 24, 2021
Finally found it!
runtime/src/libraries/System.Net.Quic/src/System/Net/Quic/Implementations/MsQuic/Interop/SafeMsQuicConfigurationHandle.cs
Lines 122 to 126 in 6ebdf24