Support more certificate loading scenarios (#69)

[cesarblum]

#69

[dnfclas]

@CesarBS,
Thanks for having already signed the Contribution License Agreement. Your agreement was validated by .NET Foundation. We will now review your pull request.
Thanks,
.NET Foundation Pull Request Bot

[cesarblum]

@blowdart @bartonjs Does this look right?

Actually, unless I'm missing something, the #if here doesn't make sense since we're targeting netstandard1.3 only. Should I only leave it as UserKeySet?

[danroth27]

@Eilon @DamianEdwards @muratg @davidfowl
We should prefer ephemeral if it is available, which is only available in netcoreapp2.0. I believe that means this package (Microsoft.AspNetCore) needs to target netcoreapp2.0, not netstandard1.3.

[cesarblum]

When I put ephemeral first, I can't run the sample app. It loads the certificate but this happens on every request:

fail: Microsoft.AspNetCore.Server.Kestrel[0]
      Uncaught exception from the OnConnectionAsync method of an IConnectionAdapter.
System.ComponentModel.Win32Exception (0x80004005): No credentials are available in the security package
   at System.Net.SSPIWrapper.AcquireCredentialsHandle(SSPIInterface secModule, String package, CredentialUse intent, SCHANNEL_CRED scc)
   at System.Net.Security.SslStreamPal.AcquireCredentialsHandle(CredentialUse credUsage, SCHANNEL_CRED secureCredential)
   at System.Net.Security.SslStreamPal.AcquireCredentialsHandle(X509Certificate certificate, SslProtocols protocols, EncryptionPolicy policy, Boolean isServer)
   at System.Net.Security.SecureChannel.AcquireServerCredentials(Byte[]& thumbPrint)
   at System.Net.Security.SecureChannel.GenerateToken(Byte[] input, Int32 offset, Int32 count, Byte[]& output)
   at System.Net.Security.SecureChannel.NextMessage(Byte[] incoming, Int32 offset, Int32 count)
   at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)
   at System.Net.Security.SslStream.BeginAuthenticateAsServer(X509Certificate serverCertificate, Boolean clientCertificateRequired, SslProtocols enabledSslProtocols, Boolean checkCertificateRevocation, AsyncCallback asyncCallback, Object asyncState)
   at System.Net.Security.SslStream.<>c__DisplayClass35_0.<AuthenticateAsServerAsync>b__0(AsyncCallback callback, Object state)
   at System.Threading.Tasks.TaskFactory`1.FromAsyncImpl(Func`3 beginMethod, Func`2 endFunction, Action`1 endAction, Object state, TaskCreationOptions creationOptions)
   at System.Threading.Tasks.TaskFactory.FromAsync(Func`3 beginMethod, Action`1 endMethod, Object state)
   at System.Net.Security.SslStream.AuthenticateAsServerAsync(X509Certificate serverCertificate, Boolean clientCertificateRequired, SslProtocols enabledSslProtocols, Boolean checkCertificateRevocation)
   at Microsoft.AspNetCore.Server.Kestrel.Https.HttpsConnectionAdapter.<OnConnectionAsync>d__7.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.FrameConnection.<ApplyConnectionAdaptersAsync>d__32.MoveNext()

So I'm leaving the order as it is for now.

[cesarblum]

@danroth27 Do you want to keep the keys when loading from e.g.

"MyCert" : {
  "Source": "File",
  "Path": "mycert.pfx"
},
"MyCert2": {
  "Source": "Store",
  "StoreName": "My",
  "StoreLocation": "CurrentUser"
}

?

[danroth27]

By "keys" do you mean the certificate name used in config? Yeah, I think it would be good to provide those.

[danroth27]

But not required.

[muratg]

"Wrong!" :)

[muratg]

Ditto

[cesarblum]

📢

[muratg]

👍

[danroth27]

We shouldn't throw if we look for certificates in store and don't find any. Instead we should throw where those certificates are being used (ex identity/kestrel).

[muratg]

@CesarBS, @DamianEdwards thinks we should multi-target netstandard1.3 and netcoreapp2.0 so that we keep supporting desktop CLR apps.