[HTTPS] Update certificate strategy for Mac OS #20022
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
javiercn
changed the title
javiercn
force-pushed
the
javiercn/https-mac-os-update-50
branch
4 times, most recently
from
95d94e6 to
cb39145
Compare
javiercn
requested review from
analogrelay,
halter73,
jkotalik,
SteveSandersonMS and
Tratcher
as code owners
javiercn
force-pushed
the
javiercn/https-mac-os-update-50
branch
from
0607701 to
c646883
Compare
Tratcher
reviewed
Mar 20, 2020
Tratcher
reviewed
Mar 20, 2020
|
/AzurePipelines run AspNetCore-ci |
|
Azure Pipelines successfully started running 1 pipeline(s). |
This was referenced Mar 23, 2020
Tratcher
approved these changes
Mar 24, 2020
src/Servers/Kestrel/test/InMemory.FunctionalTests/HttpsTests.cs
Outdated
Show resolved
Hide resolved
|
@javiercn Are you blocked on this? |
javiercn
force-pushed
the
javiercn/https-mac-os-update-50
branch
from
e76034f to
2837991
Compare
I was running into some issues and had other blazor related deadlines to meet, I'm looking to see if I can get this merged today once I resolve the test issues. |
* Revamps the HTTPS developer certificate tool implementation. * It accumulated a lot of cruft during the past few years and that has made making changes harder. * Separated the CertificateManager implementation into different classes per platform. * This centralizes the decision point of choosing a platform in a single place. * Makes clear what the flow is for a given platform. * Isolates changes needed for a given platform in the future. * Moved CertificateManager to a singleton * No more statics! * Updates logging to use EventSource * We didn't have a good way of performing logging as the code is shared and must run in multiple contexts and the set of dependencies need to be kept to a minimum. * Adding ETW allow us to log/monitor the the tool execution and capture the logs with `dotnet trace` without having to invent our own logging. * We can decide to write an EventListener in `dotnet-dev-certs` to write the results to the console output. * Updates the way we handle the dev-cert in Mac OS to use the security tool to import the certificate into the store instead of using the certificate store.
javiercn
force-pushed
the
javiercn/https-mac-os-update-50
branch
from
8b3a17c to
ae2f168
Compare
javiercn
force-pushed
the
javiercn/https-mac-os-update-50
branch
from
ae2f168 to
79d9315
Compare
|
/AzurePipelines run AspNetCore-ci |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
/AzurePipelines run AspNetCore-ci |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
Why do you keep rerunning this since you definitely have a broken test... |
|
/AzurePipelines run AspNetCore-ci |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
/AzurePipelines run AspNetCore-ci |
|
Azure Pipelines successfully started running 1 pipeline(s). |
amcasey
added
area-networking
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
After Mac OS Catalina started requiring notarized installers/packages we had to do a fix to allow the ASP.NET Core certificate to be accessible from dotnet apps.
Turns out that the command that we were running to make this doesn't work all the time, (and at this point, we don't want to pursue that strategy anymore) and that we wanted to go with a new approach for 5.0.
Given that we are having issues after the patch (we've given customers a workaround) we want to get this in early on 5.0 so that we can make sure it doesn't cause issues on customers machines and then, based on that update 3.1 to follow the new approach.
The changes here also include improvements for the tool that were long due and that were making the code brittle and hard to modify.
dotnet tracewithout having to invent our own logging.dotnet-dev-certsto write the results to the console output.The new experience for Mac OS is shown below: