[Platform] Detect and fix certificates with potentially inaccessible keys on Mac OS (2.1) #17560

javiercn · 2019-12-03T21:30:47Z

Description

We are signing the SDK installer and packages for Mac OS Catalina compliance with the requirement to have packages notarized. That change affects the way HTTPS works in ASP.NET Core and prevents users from running their ASP.NET Core applications.

To mitigate the issue we are including logic in Kestrel that detects this situation and informs customers of what steps to take to mitigate the issue and we are updating the "dotnet dev-certs" tool to detect when this situation can happen and to fix it automatically when the "dotnet dev-certs https" command is run.

Customer Impact

High

Once a customer installs an updated SDK version they won't be able to run their applications normally unless they fix the existing certificate.

Regression?

No, this is a new requirement introduced by Mac OS Catalina.

Risk

Low, we are limiting the changes in the runtime and the changes on the tool are simple.

Implementation details

Uses a sentinel file to detect if we explicitly made a certificate key trusted.
Creates new certificates and tries to set the key to be accessible across partitions when running dotnet dev-certs https
Detects when a valid certificate might not contain an accessible key and tries to fix it.
Produces an error message when Kestrel is not able to access the certificate key.

…ranteed to be accessible across security partitions

javiercn · 2019-12-03T21:33:01Z

src/Tools/FirstRunCertGenerator/src/CertificateGenerator.cs

@@ -9,7 +9,7 @@ public static void GenerateAspNetHttpsCertificate()
        {
            var manager = new CertificateManager();
            var now = DateTimeOffset.Now;
-            manager.EnsureAspNetCoreHttpsDevelopmentCertificate(now, now.AddYears(1));
+            manager.EnsureAspNetCoreHttpsDevelopmentCertificate(now, now.AddYears(1), isInteractive: false);


This is the bit that goes into the CLI.

At this point we don't want to try and setup the certificate key as that requires user interaction and the CLI first run experience must remain non-interactive.

After this change, at which point would the dev certificate first be added/updated if not during the first run experience?

The certificate still gets created during the first run experience. We simply don't try and make it available across security partitions at that time as that's the bit that requires user interaction.

src/Tools/dotnet-dev-certs/src/Program.cs

Co-Authored-By: Daniel Roth <[email protected]>

src/Servers/Kestrel/Core/src/Internal/HttpsConnectionAdapter.cs

src/Tools/dotnet-dev-certs/src/Program.cs

Co-Authored-By: Chris Ross <[email protected]>

javiercn · 2019-12-04T20:57:01Z

I had to change the exception being caught to be inline with the ones in 3.0 and 3.1. As it turns out, the test I wrote was not hitting the right code path and I'm afraid there's no good way we can write a test for this.

I've validated the solution E2E by monkey-patching the Kestrel.Core assembly in my shared framework and validated that it works. This fix is inline now with the one in 3.0 and in 3.1

src/Shared/CertificateGeneration/CertificateManager.cs

vivmishra · 2020-01-09T21:16:56Z

Moved to Mar as per Tactics. Will need to be explicitly approved for Feb, if required.

javiercn · 2020-01-15T19:22:45Z

/AzurePipelines run AspNetCore-ci

azure-pipelines · 2020-01-15T19:22:54Z

Azure Pipelines successfully started running 1 pipeline(s).

vivmishra · 2020-01-15T21:06:43Z

If this can make Feb then move the milestone to 2.1.16.

javiercn · 2020-01-15T21:23:26Z

/AzurePipelines run AspNetCore-ci

azure-pipelines · 2020-01-15T21:23:35Z

Azure Pipelines successfully started running 1 pipeline(s).

mkArtakMSFT · 2020-01-15T23:56:54Z

/AzurePipelines run AspNetCore-ci

azure-pipelines · 2020-01-15T23:57:04Z

Azure Pipelines successfully started running 1 pipeline(s).

mkArtakMSFT · 2020-01-16T06:53:37Z

All the checks have passed:

* [Platform] Detect and fix certificates with potentially inaccessible keys on Mac OS (2.1) (#17560) * [Https] Detects and fixes HTTPS certificates where the key is not guaranteed to be accessible across security partitions * Fix dotnet dev-certs https --check * Update logic for detecting missing certs * Fix security command * Update warning logic * Check that the key is accessible in Kestrel * Add correct link to docs * Update src/Tools/dotnet-dev-certs/src/Program.cs Co-Authored-By: Daniel Roth <[email protected]> * Update src/Tools/dotnet-dev-certs/src/Program.cs Co-Authored-By: Daniel Roth <[email protected]> * Add test for 2.1 * Update src/Tools/dotnet-dev-certs/src/Program.cs Co-Authored-By: Chris Ross <[email protected]> * Address feedback * Fix non-interctive path * Fix tests * Remove a couple of test from an unshipped product * Check only for certificates considered valid * Switch the exception being caught, remove invalid test Co-authored-by: Daniel Roth <[email protected]> Co-authored-by: Chris Ross <[email protected]> * Fix patchconfig merge (#18389) * Fix flaky HubConnectionHandler test (#18391) Co-authored-by: Javier Calvarro Nelson <[email protected]> Co-authored-by: Daniel Roth <[email protected]> Co-authored-by: Chris Ross <[email protected]> Co-authored-by: Brennan <[email protected]>

javiercn added 5 commits December 3, 2019 11:43

[Https] Detects and fixes HTTPS certificates where the key is not gua…

2882679

…ranteed to be accessible across security partitions

Fix dotnet dev-certs https --check

436295a

Update logic for detecting missing certs

d8c0df2

Fix security command

aa8b223

Update warning logic

e122550

javiercn commented Dec 3, 2019

View reviewed changes

javiercn added 2 commits December 3, 2019 14:05

Check that the key is accessible in Kestrel

364c7c0

Add correct link to docs

4eb1c38

danroth27 reviewed Dec 3, 2019

View reviewed changes

src/Tools/dotnet-dev-certs/src/Program.cs Outdated Show resolved Hide resolved

danroth27 reviewed Dec 3, 2019

View reviewed changes

src/Tools/dotnet-dev-certs/src/Program.cs Outdated Show resolved Hide resolved

javiercn and others added 3 commits December 3, 2019 23:34

Update src/Tools/dotnet-dev-certs/src/Program.cs

59b5f9f

Co-Authored-By: Daniel Roth <[email protected]>

Update src/Tools/dotnet-dev-certs/src/Program.cs

78ada7f

Co-Authored-By: Daniel Roth <[email protected]>

Add test for 2.1

6da2741

javiercn requested review from Pilchie and Tratcher December 3, 2019 23:41

Tratcher reviewed Dec 3, 2019

View reviewed changes

src/Servers/Kestrel/Core/src/Internal/HttpsConnectionAdapter.cs Outdated Show resolved Hide resolved

Tratcher reviewed Dec 4, 2019

View reviewed changes

src/Tools/dotnet-dev-certs/src/Program.cs Outdated Show resolved Hide resolved

Tratcher reviewed Dec 4, 2019

View reviewed changes

src/Tools/dotnet-dev-certs/src/Program.cs Outdated Show resolved Hide resolved

javiercn added the feature-platform Deprecated: Cross-cutting issues related to ASP.NET Core as a platform label Dec 4, 2019

javiercn and others added 3 commits December 4, 2019 12:14

Update src/Tools/dotnet-dev-certs/src/Program.cs

63f43f9

Co-Authored-By: Chris Ross <[email protected]>

Address feedback

315e003

Fix non-interctive path

79e8f14

javiercn force-pushed the javiercn/https-mac-os-21 branch from c8134b5 to 79e8f14 Compare December 4, 2019 12:45

Fix tests

100071b

javiercn changed the title ~~[Platform] Detect and fix certificates with potentially inaccessible keys on Mac OS~~ [Platform] Detect and fix certificates with potentially inaccessible keys on Mac OS (2.1) Dec 4, 2019

javiercn added 2 commits December 4, 2019 06:06

Remove a couple of test from an unshipped product

13da157

Check only for certificates considered valid

f47d145

javiercn added the Servicing-consider Shiproom approval is required for the issue label Dec 4, 2019

Tratcher approved these changes Dec 4, 2019

View reviewed changes

Switch the exception being caught, remove invalid test

69d0d6c

halter73 reviewed Dec 5, 2019

View reviewed changes

src/Shared/CertificateGeneration/CertificateManager.cs Show resolved Hide resolved

halter73 approved these changes Dec 5, 2019

View reviewed changes

jamshedd added Servicing-approved Shiproom has approved the issue and removed Servicing-consider Shiproom approval is required for the issue labels Dec 10, 2019

jamshedd added this to the 2.1.16 milestone Dec 10, 2019

vivmishra modified the milestones: 2.1.16, 2.1.17 Jan 9, 2020

mkArtakMSFT modified the milestones: 2.1.17, 2.1.16 Jan 16, 2020

mkArtakMSFT merged commit 7f53f7e into release/2.1 Jan 16, 2020

mkArtakMSFT deleted the javiercn/https-mac-os-21 branch January 16, 2020 06:54

[Platform] Detect and fix certificates with potentially inaccessible keys on Mac OS (2.1) #17560

[Platform] Detect and fix certificates with potentially inaccessible keys on Mac OS (2.1) #17560

Uh oh!

Conversation

javiercn commented Dec 3, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Customer Impact

Regression?

Risk

Implementation details

Uh oh!

javiercn Dec 3, 2019

Choose a reason for hiding this comment

Uh oh!

halter73 Dec 5, 2019

Choose a reason for hiding this comment

Uh oh!

javiercn Dec 5, 2019

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

javiercn commented Dec 4, 2019

Uh oh!

Uh oh!

vivmishra commented Jan 9, 2020

Uh oh!

javiercn commented Jan 15, 2020

Uh oh!

azure-pipelines bot commented Jan 15, 2020

Uh oh!

vivmishra commented Jan 15, 2020

Uh oh!

javiercn commented Jan 15, 2020

Uh oh!

azure-pipelines bot commented Jan 15, 2020

Uh oh!

mkArtakMSFT commented Jan 15, 2020

Uh oh!

azure-pipelines bot commented Jan 15, 2020

Uh oh!

mkArtakMSFT commented Jan 16, 2020

Uh oh!

Uh oh!

javiercn commented Dec 3, 2019 •

edited

Loading