Ovaj scenarij opisuje izgradnju lanca certifikata (Chain Building) od certifikata krajnjeg entiteta do Trust Anchora. Izgradnja lanca je prvi korak validacije certifikata.

Proces:

1. End-Entity certifikat → pronaći Issuera
2. Issuer → pronaći njegovog Issuera
3. Ponavljati dok se ne dosegne Trust Anchor

using WvdS.Security.Cryptography.X509Certificates.Extensions.PQ;
using System.Security.Cryptography.X509Certificates;
 
using var ctx = PqCryptoContext.Initialize();
 
// Učitavanje certifikata za validaciju
var serverCert = ctx.LoadCertificate("server.crt.pem");
 
// Konfiguracija Trust Store-a
using var trustStore = new X509Store(StoreName.Root, StoreLocation.LocalMachine);
trustStore.Open(OpenFlags.ReadOnly);
 
// Intermediate certifikati (opcionalno)
var intermediates = new X509Certificate2Collection();
intermediates.Add(ctx.LoadCertificate("intermediate-ca.crt.pem"));
 
// Konfiguracija Chain Buildera
var chain = new X509Chain();
chain.ChainPolicy.ExtraStore.AddRange(intermediates);
chain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;  // Prvo samo izgradnja lanca
chain.ChainPolicy.VerificationFlags = X509VerificationFlags.AllFlags;  // Samo izgraditi lanac
 
// Izgradnja lanca
bool built = chain.Build(serverCert);
 
Console.WriteLine($"Izgradnja lanca: {(built ? "Uspješno" : "Neuspješno")}");
Console.WriteLine($"Duljina lanca: {chain.ChainElements.Count}");
 
foreach (var element in chain.ChainElements)
{
    Console.WriteLine($"  {element.ChainElementStatus.Length} Status");
    Console.WriteLine($"    Subject: {element.Certificate.Subject}");
    Console.WriteLine($"    Issuer: {element.Certificate.Issuer}");
}

Authority Information Access (AIA) omogućuje automatsko učitavanje Intermediate certifikata koji nedostaju:

public X509Certificate2Collection FetchIntermediatesViaAia(X509Certificate2 cert)
{
    var intermediates = new X509Certificate2Collection();
    var current = cert;
 
    while (true)
    {
        // Čitanje AIA ekstenzije
        var aiaUrl = GetCaIssuersUrl(current);
        if (string.IsNullOrEmpty(aiaUrl)) break;
 
        // Preuzimanje Issuer certifikata
        using var http = new HttpClient();
        var certData = http.GetByteArrayAsync(aiaUrl).Result;
 
        var issuer = new X509Certificate2(certData);
        intermediates.Add(issuer);
 
        // Self-signed = Root dosegnut
        if (issuer.Subject == issuer.Issuer) break;
 
        current = issuer;
    }
 
    return intermediates;
}
 
private string? GetCaIssuersUrl(X509Certificate2 cert)
{
    var aia = cert.Extensions["1.3.6.1.5.5.7.1.1"];  // AIA OID
    if (aia == null) return null;
 
    // Parsiranje AIA (pojednostavljeno)
    var asnData = new AsnReader(aia.RawData, AsnEncodingRules.DER);
    // ... Ekstrakcija CA Issuers URL-a
    return null;  // Implementacija ovisi o ASN.1 strukturi
}

public class PqChainBuilder
{
    public X509Chain BuildPqChain(X509Certificate2 endEntity, PqCryptoContext ctx)
    {
        var chain = new X509Chain();
 
        // Aktivacija PQ-specifične validacije
        chain.ChainPolicy.ApplicationPolicy.Add(new Oid("1.3.6.1.5.5.7.3.1"));  // serverAuth
        chain.ChainPolicy.CertificatePolicy.Add(new Oid("2.5.29.32.0"));  // anyPolicy
 
        // Prilagođeni Trust Store s PQ-Root-CA
        var pqTrustStore = new X509Certificate2Collection();
        pqTrustStore.Add(ctx.LoadCertificate("pq-root-ca.crt.pem"));
        chain.ChainPolicy.CustomTrustStore.AddRange(pqTrustStore);
        chain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
 
        chain.Build(endEntity);
        return chain;
    }
}

// Analiza Chain statusa
foreach (var element in chain.ChainElements)
{
    foreach (var status in element.ChainElementStatus)
    {
        Console.WriteLine($"  {element.Certificate.Subject}");
        Console.WriteLine($"    Status: {status.Status}");
        Console.WriteLine($"    Info: {status.StatusInformation}");
    }
}

« ← Pregled validacije | ↑ Scenariji | 5.2 Validacija lanca → »

Wolfgang van der Stille @ EMSR DATA d.o.o. - Post-Quantum Cryptography Professional