Fix issue with X509VerificationFlags.AllowUnknownCertificateAuthority behavior #174
Conversation
| chain.Build((X509Certificate2) certificate); | ||
|
|
||
| var rootCert = chain.ChainElements[chain.ChainElements.Count - 1].Certificate; | ||
| var isValid = rootCert.RawData.SequenceEqual(caCert.RawData); |
There was a problem hiding this comment.
If you want to test for a custom root you'd leave the check as it was, and then add isValid = isValid && rootCert.RawData.SequenceEqual(caCert.RawData);
As it is, this change would start accepting expired and revoked certificates (and possibly certificates where the signatures didn't check out).
|
@bartonjs can you please confirm now it is ok? |
|
Seems right to me. |
|
(Assuming that |
|
@bartonjs Sure, thank you! |
|
LGTM, thanks. Can you add a unit test that validates this behavior? e.g. fails w/o the fix, passes with the fix? Thanks! |
|
@brendandburns Done! |
|
LGTM, many thanks! |
… behavior (kubernetes-client#174) * Fix issue with X509VerificationFlags.AllowUnknownCertificateAuthority behavior * Add CertificateValidationTests
Fix this issue with this solution.
How to test:
Replace your certificate-authority-data from kubeconfig with data from another certificate and run.
The program works despite the non-validity of the certificate because of validation does not fail.
System.Net.Http.HttpRequestException is thrown because of validation fails.