Skip to content

Commit c83ed24

Browse files
elantiguamsftelantiguamsft
authored
Merge pull request #138 from microsoft/users/jstatia/pfx_as_chain_builder
Enhance PFX certificate handling in SignCommand and update documentation
2 parents 7f40677 + 1d3c4d9 commit c83ed24

File tree

7 files changed

+1322
-49
lines changed

7 files changed

+1322
-49
lines changed

‎CHANGELOG.md‎

Lines changed: 65 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,56 @@
11
# Changelog
22

3-
## [v1.5.3-pre2](https://github.com/microsoft/CoseSignTool/tree/v1.5.3-pre2) (2025-06-05)
3+
## [Unreleased](https://github.com/microsoft/CoseSignTool/tree/HEAD)
4+
5+
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.5.6...HEAD)
6+
7+
**Merged pull requests:**
8+
9+
- Migrate from VSTest to MTP [\#124](https://github.com/microsoft/CoseSignTool/pull/124) ([Youssef1313](https://github.com/Youssef1313))
10+
11+
## [v1.5.6](https://github.com/microsoft/CoseSignTool/tree/v1.5.6) (2025-07-15)
12+
13+
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v.1.5.5...v1.5.6)
14+
15+
## [v.1.5.5](https://github.com/microsoft/CoseSignTool/tree/v.1.5.5) (2025-07-15)
16+
17+
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.5.4-pre1...v.1.5.5)
18+
19+
## [v1.5.4-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.5.4-pre1) (2025-07-15)
20+
21+
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.5.4...v1.5.4-pre1)
22+
23+
**Merged pull requests:**
424

5-
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.5.4...v1.5.3-pre2)
25+
- Add KeyChain property to ICoseSigningKeyProvider and implement related concrete implementations and tests [\#136](https://github.com/microsoft/CoseSignTool/pull/136) ([JeromySt](https://github.com/JeromySt))
626

727
## [v1.5.4](https://github.com/microsoft/CoseSignTool/tree/v1.5.4) (2025-06-05)
828

9-
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.5.3-pre1...v1.5.4)
29+
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.5.3-pre2...v1.5.4)
30+
31+
## [v1.5.3-pre2](https://github.com/microsoft/CoseSignTool/tree/v1.5.3-pre2) (2025-06-05)
32+
33+
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.5.3-pre1...v1.5.3-pre2)
1034

1135
**Merged pull requests:**
1236

1337
- BugFix: Normalize CommonName Checks [\#132](https://github.com/microsoft/CoseSignTool/pull/132) ([elantiguamsft](https://github.com/elantiguamsft))
1438

1539
## [v1.5.3-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.5.3-pre1) (2025-06-05)
1640

17-
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.5.3...v1.5.3-pre1)
41+
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.5.2-pre1...v1.5.3-pre1)
1842

1943
**Merged pull requests:**
2044

2145
- Add unit tests for CoseSign1MessageExtensions and enhance Certificate… [\#133](https://github.com/microsoft/CoseSignTool/pull/133) ([JeromySt](https://github.com/JeromySt))
2246

23-
## [v1.5.3](https://github.com/microsoft/CoseSignTool/tree/v1.5.3) (2025-05-30)
47+
## [v1.5.2-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.5.2-pre1) (2025-05-30)
2448

25-
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.5.2-pre1...v1.5.3)
49+
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.5.3...v1.5.2-pre1)
2650

27-
## [v1.5.2-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.5.2-pre1) (2025-05-30)
51+
## [v1.5.3](https://github.com/microsoft/CoseSignTool/tree/v1.5.3) (2025-05-30)
2852

29-
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.5.2...v1.5.2-pre1)
53+
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.5.2...v1.5.3)
3054

3155
**Merged pull requests:**
3256

@@ -50,31 +74,31 @@
5074

5175
## [v1.5.0-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.5.0-pre1) (2025-05-07)
5276

53-
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.5.0...v1.5.0-pre1)
77+
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.4.0-pre1...v1.5.0-pre1)
5478

5579
**Merged pull requests:**
5680

5781
- Allow beta version of Azure.Security.CodeTransparency [\#129](https://github.com/microsoft/CoseSignTool/pull/129) ([lemccomb](https://github.com/lemccomb))
5882

59-
## [v1.5.0](https://github.com/microsoft/CoseSignTool/tree/v1.5.0) (2025-04-28)
83+
## [v1.4.0-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.4.0-pre1) (2025-04-28)
6084

61-
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.4.0-pre1...v1.5.0)
85+
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.5.0...v1.4.0-pre1)
6286

63-
## [v1.4.0-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.4.0-pre1) (2025-04-28)
87+
## [v1.5.0](https://github.com/microsoft/CoseSignTool/tree/v1.5.0) (2025-04-28)
6488

65-
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.3.0-pre5...v1.4.0-pre1)
89+
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.4.0...v1.5.0)
6690

6791
**Merged pull requests:**
6892

6993
- Added support for Transparency to CoseSign1 libraries to leverage services such as Azure Code Transparency Service [\#127](https://github.com/microsoft/CoseSignTool/pull/127) ([JeromySt](https://github.com/JeromySt))
7094

71-
## [v1.3.0-pre5](https://github.com/microsoft/CoseSignTool/tree/v1.3.0-pre5) (2025-03-18)
95+
## [v1.4.0](https://github.com/microsoft/CoseSignTool/tree/v1.4.0) (2025-03-18)
7296

73-
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.4.0...v1.3.0-pre5)
97+
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.3.0-pre5...v1.4.0)
7498

75-
## [v1.4.0](https://github.com/microsoft/CoseSignTool/tree/v1.4.0) (2025-03-18)
99+
## [v1.3.0-pre5](https://github.com/microsoft/CoseSignTool/tree/v1.3.0-pre5) (2025-03-18)
76100

77-
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.3.0-pre4...v1.4.0)
101+
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.3.0-pre4...v1.3.0-pre5)
78102

79103
**Merged pull requests:**
80104

@@ -244,19 +268,19 @@
244268

245269
## [v1.2.4-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.2.4-pre1) (2024-07-15)
246270

247-
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.2.4...v1.2.4-pre1)
271+
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.2.3-pre7...v1.2.4-pre1)
248272

249273
**Merged pull requests:**
250274

251275
- User/lemccomb/fileread [\#94](https://github.com/microsoft/CoseSignTool/pull/94) ([lemccomb](https://github.com/lemccomb))
252276

253-
## [v1.2.4](https://github.com/microsoft/CoseSignTool/tree/v1.2.4) (2024-06-14)
277+
## [v1.2.3-pre7](https://github.com/microsoft/CoseSignTool/tree/v1.2.3-pre7) (2024-06-14)
254278

255-
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.2.3-pre7...v1.2.4)
279+
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.2.4...v1.2.3-pre7)
256280

257-
## [v1.2.3-pre7](https://github.com/microsoft/CoseSignTool/tree/v1.2.3-pre7) (2024-06-14)
281+
## [v1.2.4](https://github.com/microsoft/CoseSignTool/tree/v1.2.4) (2024-06-14)
258282

259-
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.2.3-pre6...v1.2.3-pre7)
283+
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.2.3-pre6...v1.2.4)
260284

261285
**Merged pull requests:**
262286

@@ -328,35 +352,35 @@
328352

329353
## [v1.2.1-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.2.1-pre1) (2024-03-12)
330354

331-
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.2.1...v1.2.1-pre1)
355+
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.2.0-pre1...v1.2.1-pre1)
332356

333357
**Merged pull requests:**
334358

335359
- Revert "Add .exe to CoseSignTool NuGet" [\#83](https://github.com/microsoft/CoseSignTool/pull/83) ([elantiguamsft](https://github.com/elantiguamsft))
336360

337-
## [v1.2.1](https://github.com/microsoft/CoseSignTool/tree/v1.2.1) (2024-03-07)
361+
## [v1.2.0-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.2.0-pre1) (2024-03-07)
338362

339-
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.2.0-pre1...v1.2.1)
363+
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.2.1...v1.2.0-pre1)
340364

341-
## [v1.2.0-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.2.0-pre1) (2024-03-07)
365+
## [v1.2.1](https://github.com/microsoft/CoseSignTool/tree/v1.2.1) (2024-03-07)
342366

343-
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.2.exeTest...v1.2.0-pre1)
367+
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.2.exeTest...v1.2.1)
344368

345369
**Merged pull requests:**
346370

347371
- Add .exe to CoseSignTool NuGet [\#81](https://github.com/microsoft/CoseSignTool/pull/81) ([elantiguamsft](https://github.com/elantiguamsft))
348372

349373
## [v1.2.exeTest](https://github.com/microsoft/CoseSignTool/tree/v1.2.exeTest) (2024-03-06)
350374

351-
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.2.0...v1.2.exeTest)
375+
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.8-pre1...v1.2.exeTest)
352376

353-
## [v1.2.0](https://github.com/microsoft/CoseSignTool/tree/v1.2.0) (2024-03-04)
377+
## [v1.1.8-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.1.8-pre1) (2024-03-04)
354378

355-
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.8-pre1...v1.2.0)
379+
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.2.0...v1.1.8-pre1)
356380

357-
## [v1.1.8-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.1.8-pre1) (2024-03-04)
381+
## [v1.2.0](https://github.com/microsoft/CoseSignTool/tree/v1.2.0) (2024-03-04)
358382

359-
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.7-pre3...v1.1.8-pre1)
383+
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.7-pre3...v1.2.0)
360384

361385
**Merged pull requests:**
362386

@@ -521,7 +545,7 @@
521545

522546
## [v1.1.0-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.1.0-pre1) (2023-11-03)
523547

524-
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v0.3.1-pre.10...v1.1.0-pre1)
548+
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.0...v1.1.0-pre1)
525549

526550
**Merged pull requests:**
527551

@@ -531,13 +555,13 @@
531555
- DetachedSignatureFactory accepts pre-hashed content as payload [\#53](https://github.com/microsoft/CoseSignTool/pull/53) ([elantiguamsft](https://github.com/elantiguamsft))
532556
- Add password support for certificate files [\#52](https://github.com/microsoft/CoseSignTool/pull/52) ([lemccomb](https://github.com/lemccomb))
533557

534-
## [v0.3.1-pre.10](https://github.com/microsoft/CoseSignTool/tree/v0.3.1-pre.10) (2023-10-10)
558+
## [v1.1.0](https://github.com/microsoft/CoseSignTool/tree/v1.1.0) (2023-10-10)
535559

536-
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.0...v0.3.1-pre.10)
560+
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v0.3.1-pre.10...v1.1.0)
537561

538-
## [v1.1.0](https://github.com/microsoft/CoseSignTool/tree/v1.1.0) (2023-10-10)
562+
## [v0.3.1-pre.10](https://github.com/microsoft/CoseSignTool/tree/v0.3.1-pre.10) (2023-10-10)
539563

540-
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v0.3.2...v1.1.0)
564+
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v0.3.1-pre.9...v0.3.1-pre.10)
541565

542566
**Merged pull requests:**
543567

@@ -547,13 +571,13 @@
547571
- Port changes from ADO repo to GitHub repo [\#46](https://github.com/microsoft/CoseSignTool/pull/46) ([lemccomb](https://github.com/lemccomb))
548572
- Re-enable CodeQL [\#45](https://github.com/microsoft/CoseSignTool/pull/45) ([lemccomb](https://github.com/lemccomb))
549573

550-
## [v0.3.2](https://github.com/microsoft/CoseSignTool/tree/v0.3.2) (2023-09-28)
574+
## [v0.3.1-pre.9](https://github.com/microsoft/CoseSignTool/tree/v0.3.1-pre.9) (2023-09-28)
551575

552-
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v0.3.1-pre.9...v0.3.2)
576+
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v0.3.2...v0.3.1-pre.9)
553577

554-
## [v0.3.1-pre.9](https://github.com/microsoft/CoseSignTool/tree/v0.3.1-pre.9) (2023-09-28)
578+
## [v0.3.2](https://github.com/microsoft/CoseSignTool/tree/v0.3.2) (2023-09-28)
555579

556-
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v0.3.1-pre.8...v0.3.1-pre.9)
580+
[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v0.3.1-pre.8...v0.3.2)
557581

558582
**Merged pull requests:**
559583

‎CoseSign1.Tests.Common/TestCertificateUtils.cs‎

Lines changed: 49 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright (c) Microsoft Corporation.
1+
// Copyright (c) Microsoft Corporation.
22
// Licensed under the MIT License.
33

44

@@ -138,6 +138,16 @@ public static X509Certificate2 CreateCertificate(
138138
}
139139
}
140140

141+
/// <summary>
142+
/// Creates a certificate without private key from an existing certificate.
143+
/// </summary>
144+
/// <param name="certificate">The certificate to extract public key from.</param>
145+
/// <returns>A certificate with only the public key.</returns>
146+
public static X509Certificate2 CreateCertificateWithoutPrivateKey(X509Certificate2 certificate)
147+
{
148+
return new X509Certificate2(certificate.Export(X509ContentType.Cert));
149+
}
150+
141151
/// <summary>
142152
/// Creates a 3-tiered certificate structure in memory for use in unit tests.
143153
/// </summary>
@@ -165,5 +175,43 @@ public static X509Certificate2Collection CreateTestChain(
165175
return returnValue;
166176
}
167177

178+
/// <summary>
179+
/// Creates a 3-tiered certificate structure for PFX testing where only the leaf certificate has a private key.
180+
/// Root and intermediate certificates will only contain public keys.
181+
/// </summary>
182+
/// <param name="testName">The test name for cert name uniqueness.</param>
183+
/// <param name="useEcc">True for ecc certs, false (default) for RSA certs.</param>
184+
/// <param name="keySize">The optional key size to request for the certificate, defaults to 256 for ECC and 2048 for RSA.</param>
185+
/// <returns>An <see cref="X509Certificate2Collection"/> containing root (public only), intermediate (public only), and leaf (with private key) certificates.</returns>
186+
public static X509Certificate2Collection CreateTestChainForPfx(
187+
[CallerMemberName] string? testName = "none",
188+
bool useEcc = false,
189+
int? keySize = null,
190+
TimeSpan? rootDuration = null)
191+
{
192+
// Create certificates with private keys for signing purposes
193+
X509Certificate2 testRootWithPrivateKey = CreateCertificate($"Test Root: {testName}", useEcc: useEcc, keySize: keySize, duration: rootDuration);
194+
X509Certificate2 issuerWithPrivateKey = CreateCertificate($"Test Issuer: {testName}", testRootWithPrivateKey, useEcc: useEcc, keySize: keySize);
195+
X509Certificate2 leafWithPrivateKey = CreateCertificate($"Test Leaf: {testName}", issuerWithPrivateKey, useEcc: useEcc, keySize: keySize);
196+
197+
// Create public-only versions of root and intermediate certificates
198+
X509Certificate2 testRootPublicOnly = CreateCertificateWithoutPrivateKey(testRootWithPrivateKey);
199+
X509Certificate2 issuerPublicOnly = CreateCertificateWithoutPrivateKey(issuerWithPrivateKey);
200+
201+
// Return collection with public-only root and intermediate, but private key leaf
202+
X509Certificate2Collection returnValue =
203+
[
204+
testRootPublicOnly, // Root with public key only
205+
issuerPublicOnly, // Intermediate with public key only
206+
leafWithPrivateKey // Leaf with private key
207+
];
208+
209+
// Dispose the private key versions we don't need
210+
testRootWithPrivateKey.Dispose();
211+
issuerWithPrivateKey.Dispose();
212+
213+
return returnValue;
214+
}
215+
168216
}
169217

0 commit comments

Comments
 (0)