====== TrustStoreExtensions & PqTrustStore ======

Upravljanje prilagođenim Trust Store-om za PQ-kompatibilne PKI infrastrukture.

----

===== Pregled =====

^  Klasa  ^  Opis  ^
| ''PqTrustStore'' | Potpuni Trust Store s PQ podrškom |
| ''TrustStoreExtensions'' | Extension Methods za ''X509Certificate2Collection'' |
| ''TrustEntry'' | Metapodaci za unose u Trust Store |
| ''TrustType'' | Enum: TrustAnchor, IntermediateCA, itd. |

----

===== PqTrustStore Klasa =====

<code csharp>
using WvdS.System.Security.Cryptography.X509Certificates;

// Stvaranje Trust Store-a
using var trustStore = new PqTrustStore();

// Dodavanje Root CA
var rootCa = new X509Certificate2("root-ca.cer");
trustStore.AddTrustAnchor(rootCa, alias: "Company Root CA");

// Dodavanje Intermediate CA
var intermediateCa = new X509Certificate2("intermediate-ca.cer");
trustStore.AddIntermediate(intermediateCa, alias: "Issuing CA");

// Korištenje Trust Store-a
Console.WriteLine($"Trust Store sadrži {trustStore.Count} unosa");
</code>

----

===== Integracija s X509Chain =====

**Validacija s prilagođenim Trust Store-om:**

<code csharp>
using System.Security.Cryptography.X509Certificates;
using WvdS.System.Security.Cryptography;
using WvdS.System.Security.Cryptography.X509Certificates;

// Učitavanje Trust Store-a
using var trustStore = PqTrustStore.LoadFromPem("company-trust-store.pem");

// Validacija certifikata
var userCert = new X509Certificate2("user.cer");

using var chain = new X509Chain();
bool isValid = chain.Build(userCert, trustStore, CryptoMode.Hybrid);

if (isValid)
{
    Console.WriteLine("Certifikat je valjan");
}
else
{
    foreach (var status in chain.ChainStatus)
    {
        Console.WriteLine($"Greška: {status.StatusInformation}");
    }
}
</code>

**S X509Certificate2Collection:**

<code csharp>
// Jednostavnije: Izravno s kolekcijom
var trustAnchors = TrustStoreExtensions.LoadFromPem("trust-anchors.pem");

using var chain = new X509Chain();
bool isValid = chain.Build(userCert, trustAnchors, CryptoMode.Hybrid);
</code>

----

===== Trust Store Import/Export =====

**PEM Bundle:**

<code csharp>
// Spremanje
trustStore.SaveToPem("trust-store.pem");

// Učitavanje
var loadedStore = PqTrustStore.LoadFromPem("trust-store.pem");
</code>

**PKCS#7 (DER):**

<code csharp>
// Spremanje kao PKCS#7
trustStore.SaveToPkcs7("trust-store.p7b");

// Učitavanje
var loadedStore = PqTrustStore.LoadFromPkcs7("trust-store.p7b");
</code>

----

===== Import iz sistemskog Store-a =====

<code csharp>
// Popunjavanje Trust Store-a sa sistemskim certifikatima
using var trustStore = new PqTrustStore();

// Import Windows Root CA-ova
trustStore.ImportFromSystemRootStore();

// Import Windows Intermediate CA-ova
trustStore.ImportFromSystemIntermediateStore();

// Export kao PEM za air-gapped sustave
trustStore.SaveToPem("system-trust-store.pem");
</code>

----

===== TrustType Enum =====

^  Vrijednost  ^  Opis  ^
| ''TrustAnchor'' | Sidro povjerenja (Root CA) |
| ''IntermediateCA'' | Posrednička certifikacijska agencija |
| ''CrossCertifiedCA'' | Unakrsno certificirana CA |
| ''EndEntity'' | Krajnji entitet (nije CA) |

----

===== Upiti u Trust Store =====

<code csharp>
// Samo Trust Anchori
var roots = trustStore.TrustAnchors;

// Samo Intermediate CA-ovi
var intermediates = trustStore.IntermediateCAs;

// Pretraga po Subject-u
var found = trustStore.FindBySubjectName("Company");

// Pretraga po Thumbprint-u
var entry = trustStore.FindByThumbprint("A1B2C3...");

// Provjera postojanja
bool exists = trustStore.Contains(certificate);
</code>

----

===== Izvješće o validaciji =====

<code csharp>
using var chain = new X509Chain();
chain.Build(cert, trustStore, CryptoMode.Hybrid);

// Stvaranje detaljnog izvješća
var report = chain.GetValidationReport();

Console.WriteLine($"Valjano: {report.IsValid}");
Console.WriteLine($"Duljina lanca: {report.ChainLength}");
Console.WriteLine($"Potpuno PQ-zaštićeno: {report.IsFullyPqProtected}");

// Pojedinačni elementi
foreach (var element in report.Elements)
{
    Console.WriteLine($"  {element.Subject}");
    Console.WriteLine($"    Način: {element.CryptoMode}");
    Console.WriteLine($"    PQ ključevi: {element.HasPqKeys}");
}
</code>

**Primjer izlaza:**

<code>
Chain Validation: VALID
Chain Length: 3
Fully PQ Protected: True
Elements:
  [0] CN=User Certificate
      Mode: Hybrid, PQ Keys: True
  [1] CN=Issuing CA
      Mode: Hybrid, PQ Keys: True
  [2] CN=Root CA
      Mode: Hybrid, PQ Keys: True
</code>

----

===== Offline CRL provjera =====

Za air-gapped sustave s prethodno učitanim CRL-ovima:

<code csharp>
// Učitavanje CRL-ova
var crls = new List<byte[]>
{
    File.ReadAllBytes("root-ca.crl"),
    File.ReadAllBytes("issuing-ca.crl")
};

using var chain = new X509Chain();
bool isValid = chain.BuildWithOfflineCrl(
    certificate,
    trustStore.ToCollection(),
    crls,
    CryptoMode.Hybrid);
</code>

----

===== Collection Extensions =====

<code csharp>
// Filtriranje kolekcije
var collection = new X509Certificate2Collection();
collection.Import("certificates.p7b");

// Samo CA-ovi
var cas = collection.FilterCertificateAuthorities();

// Samo Root CA-ovi (samopotpisani)
var roots = collection.FilterRootCertificates();

// Pretraga po Subject-u
var found = collection.FindBySubjectName("Company");

// Provjera PQ statusa
bool hasPq = collection.HasPqProtectedCertificates();

// Spremanje kao PEM
collection.SaveToPem("output.pem");
</code>

----

===== Najbolje prakse =====

**Hijerarhija Trust Store-a:**

<code>
PqTrustStore
├── TrustAnchors (Root CA-ovi)
│   └── → chain.ChainPolicy.CustomTrustStore
└── IntermediateCAs
    └── → chain.ChainPolicy.ExtraStore
</code>

**Preporuke:**

  * **Načelo minimalnosti:** Uključiti samo potrebne CA-ove
  * **PQ migracija:** Postupno dodavati PQ ključeve postojećim CA-ovima
  * **Sigurnosna kopija:** Redovito izrađivati sigurnosne kopije Trust Store-a
  * **Validacija:** Provjeriti nove CA-ove prije dodavanja

----

===== Vidi također =====

  * [[.:x509chainextensions|X509ChainExtensions]] - Validacija lanca
  * [[.:revocationextensions|RevocationExtensions]] - Provjera opoziva
  * [[hr:int:pqcrypt:konzepte:pki|PKI koncepti]]

----
//Wolfgang van der Stille @ EMSR DATA d.o.o. - Post-Quantum Cryptography Professional//

{{tag>truststore pki ca chain}}