AcquireClientCredentials()

bool System.Net.Security.SecureChannel.AcquireClientCredentials ( ref byte[] thumbPrint )

inlineprivate

Definition at line 224 of file SecureChannel.cs.

    {
        X509Certificate x509Certificate = null;
        List<X509Certificate> list = null;
        bool flag = false;
        if (_sslAuthenticationOptions.CertSelectionDelegate != null)
        {
            string[] requestCertificateAuthorities = GetRequestCertificateAuthorities();
            if (System.Net.NetEventSource.Log.IsEnabled())
            {
                System.Net.NetEventSource.Info(this, "Calling CertificateSelectionCallback", "AcquireClientCredentials");
            }
            X509Certificate2 x509Certificate2 = null;
            try
            {
                x509Certificate2 = CertificateValidationPal.GetRemoteCertificate(_securityContext);
                if (_sslAuthenticationOptions.ClientCertificates == null)
                {
                    _sslAuthenticationOptions.ClientCertificates = new X509CertificateCollection();
                }
                x509Certificate = _sslAuthenticationOptions.CertSelectionDelegate(_sslAuthenticationOptions.TargetHost, _sslAuthenticationOptions.ClientCertificates, x509Certificate2, requestCertificateAuthorities);
            }
            finally
            {
                x509Certificate2?.Dispose();
            }
            if (x509Certificate != null)
            {
                if (_credentialsHandle == null)
                {
                    flag = true;
                }
                EnsureInitialized(ref list).Add(x509Certificate);
                if (System.Net.NetEventSource.Log.IsEnabled())
                {
                    System.Net.NetEventSource.Log.CertificateFromDelegate(this);
                }
            }
            else if (_sslAuthenticationOptions.ClientCertificates == null || _sslAuthenticationOptions.ClientCertificates.Count == 0)
            {
                if (System.Net.NetEventSource.Log.IsEnabled())
                {
                    System.Net.NetEventSource.Log.NoDelegateNoClientCert(this);
                }
                flag = true;
            }
            else if (System.Net.NetEventSource.Log.IsEnabled())
            {
                System.Net.NetEventSource.Log.NoDelegateButClientCert(this);
            }
        }
        else if (_credentialsHandle == null && _sslAuthenticationOptions.ClientCertificates != null && _sslAuthenticationOptions.ClientCertificates.Count > 0)
        {
            x509Certificate = _sslAuthenticationOptions.ClientCertificates[0];
            flag = true;
            if (x509Certificate != null)
            {
                EnsureInitialized(ref list).Add(x509Certificate);
            }
            if (System.Net.NetEventSource.Log.IsEnabled())
            {
                System.Net.NetEventSource.Log.AttemptingRestartUsingCert(x509Certificate, this);
            }
        }
        else if (_sslAuthenticationOptions.ClientCertificates != null && _sslAuthenticationOptions.ClientCertificates.Count > 0)
        {
            string[] requestCertificateAuthorities = GetRequestCertificateAuthorities();
            if (System.Net.NetEventSource.Log.IsEnabled())
            {
                if (requestCertificateAuthorities == null || requestCertificateAuthorities.Length == 0)
                {
                    System.Net.NetEventSource.Log.NoIssuersTryAllCerts(this);
                }
                else
                {
                    System.Net.NetEventSource.Log.LookForMatchingCerts(requestCertificateAuthorities.Length, this);
                }
            }
            for (int i = 0; i < _sslAuthenticationOptions.ClientCertificates.Count; i++)
            {
                if (requestCertificateAuthorities != null && requestCertificateAuthorities.Length != 0)
                {
                    X509Certificate2 x509Certificate3 = null;
                    X509Chain x509Chain = null;
                    try
                    {
                        x509Certificate3 = MakeEx(_sslAuthenticationOptions.ClientCertificates[i]);
                        if (x509Certificate3 == null)
                        {
                            continue;
                        }
                        if (System.Net.NetEventSource.Log.IsEnabled())
                        {
                            System.Net.NetEventSource.Info(this, $"Root cert: {x509Certificate3}", "AcquireClientCredentials");
                        }
                        x509Chain = new X509Chain();
                        x509Chain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
                        x509Chain.ChainPolicy.VerificationFlags = X509VerificationFlags.IgnoreInvalidName;
                        x509Chain.Build(x509Certificate3);
                        bool flag2 = false;
                        if (x509Chain.ChainElements.Count > 0)
                        {
                            int count = x509Chain.ChainElements.Count;
                            for (int j = 0; j < count; j++)
                            {
                                string issuer = x509Chain.ChainElements[j].Certificate.Issuer;
                                flag2 = Array.IndexOf(requestCertificateAuthorities, issuer) != -1;
                                if (flag2)
                                {
                                    if (System.Net.NetEventSource.Log.IsEnabled())
                                    {
                                        System.Net.NetEventSource.Info(this, $"Matched {issuer}", "AcquireClientCredentials");
                                    }
                                    break;
                                }
                                if (System.Net.NetEventSource.Log.IsEnabled())
                                {
                                    System.Net.NetEventSource.Info(this, $"No match: {issuer}", "AcquireClientCredentials");
                                }
                            }
                        }
                        if (!flag2)
                        {
                            continue;
                        }
                        goto IL_03c0;
                    }
                    finally
                    {
                        if (x509Chain != null)
                        {
                            x509Chain.Dispose();
                            int count2 = x509Chain.ChainElements.Count;
                            for (int k = 0; k < count2; k++)
                            {
                                x509Chain.ChainElements[k].Certificate.Dispose();
                            }
                        }
                        if (x509Certificate3 != null && x509Certificate3 != _sslAuthenticationOptions.ClientCertificates[i])
                        {
                            x509Certificate3.Dispose();
                        }
                    }
                }
                goto IL_03c0;
                IL_03c0:
                if (System.Net.NetEventSource.Log.IsEnabled())
                {
                    System.Net.NetEventSource.Log.SelectedCert(_sslAuthenticationOptions.ClientCertificates[i], this);
                }
                EnsureInitialized(ref list).Add(_sslAuthenticationOptions.ClientCertificates[i]);
            }
        }
        bool result = false;
        X509Certificate2 x509Certificate4 = null;
        x509Certificate = null;
        if (System.Net.NetEventSource.Log.IsEnabled())
        {
            if (list != null && list.Count != 0)
            {
                System.Net.NetEventSource.Log.CertsAfterFiltering(list.Count, this);
                System.Net.NetEventSource.Log.FindingMatchingCerts(this);
            }
            else
            {
                System.Net.NetEventSource.Log.CertsAfterFiltering(0, this);
                System.Net.NetEventSource.Info(this, "No client certificate to choose from", "AcquireClientCredentials");
            }
        }
        if (list != null)
        {
            for (int l = 0; l < list.Count; l++)
            {
                x509Certificate = list[l];
                if ((x509Certificate4 = FindCertificateWithPrivateKey(this, _sslAuthenticationOptions.IsServer, x509Certificate)) != null)
                {
                    break;
                }
                x509Certificate = null;
                x509Certificate4 = null;
            }
        }
        if (System.Net.NetEventSource.Log.IsEnabled())
        {
            System.Net.NetEventSource.Info(this, $"Selected cert = {x509Certificate4}", "AcquireClientCredentials");
        }
        try
        {
            byte[] array = x509Certificate4?.GetCertHash();
            SafeFreeCredentials safeFreeCredentials = SslSessionsCache.TryCachedCredential(array, _sslAuthenticationOptions.EnabledSslProtocols, _sslAuthenticationOptions.IsServer, _sslAuthenticationOptions.EncryptionPolicy);
            if (flag && safeFreeCredentials == null && x509Certificate4 != null)
            {
                if (System.Net.NetEventSource.Log.IsEnabled())
                {
                    System.Net.NetEventSource.Info(this, "Reset to anonymous session.", "AcquireClientCredentials");
                }
                if (x509Certificate != x509Certificate4)
                {
                    x509Certificate4.Dispose();
                }
                array = null;
                x509Certificate4 = null;
                x509Certificate = null;
            }
            if (safeFreeCredentials != null)
            {
                if (System.Net.NetEventSource.Log.IsEnabled())
                {
                    System.Net.NetEventSource.Log.UsingCachedCredential(this);
                }
                _credentialsHandle = safeFreeCredentials;
                _selectedClientCertificate = x509Certificate;
                result = true;
                if (x509Certificate4 != null)
                {
                    _sslAuthenticationOptions.CertificateContext = SslStreamCertificateContext.Create(x509Certificate4);
                }
            }
            else
            {
                if (x509Certificate4 != null)
                {
                    _sslAuthenticationOptions.CertificateContext = SslStreamCertificateContext.Create(x509Certificate4);
                }
                _credentialsHandle = SslStreamPal.AcquireCredentialsHandle(_sslAuthenticationOptions.CertificateContext, _sslAuthenticationOptions.EnabledSslProtocols, _sslAuthenticationOptions.EncryptionPolicy, _sslAuthenticationOptions.IsServer);
                thumbPrint = array;
                _selectedClientCertificate = x509Certificate;
            }
        }
        finally
        {
            if (x509Certificate4 != null && _sslAuthenticationOptions.CertificateContext != null)
            {
                _sslAuthenticationOptions.CertificateContext = SslStreamCertificateContext.Create(x509Certificate4);
            }
        }
        return result;
    }

References System.Net.Security.SecureChannel._credentialsHandle, System.Net.Security.SecureChannel._securityContext, System.Net.Security.SecureChannel._selectedClientCertificate, System.Net.Security.SecureChannel._sslAuthenticationOptions, System.Net.Security.SslStreamPal.AcquireCredentialsHandle(), System.array, System.Net.Security.SslAuthenticationOptions.CertificateContext, System.Net.Security.SslAuthenticationOptions.CertSelectionDelegate, System.Net.Security.SslAuthenticationOptions.ClientCertificates, System.Collections.CollectionBase.Count, System.count, System.Collections.Generic.Dictionary< TKey, TValue >.Count, System.Net.Security.SslStreamCertificateContext.Create(), System.Net.Security.SslAuthenticationOptions.EnabledSslProtocols, System.Net.Security.SslAuthenticationOptions.EncryptionPolicy, System.Net.Security.SecureChannel.FindCertificateWithPrivateKey(), System.Net.CertificateValidationPal.GetRemoteCertificate(), System.Net.Security.SecureChannel.GetRequestCertificateAuthorities(), System.Array.IndexOf(), System.Net.NetEventSource.Info(), System.Net.Security.SslAuthenticationOptions.IsServer, System.list, System.Net.NetEventSource.Log, System.Net.Security.SecureChannel.MakeEx(), System.Net.Security.SslAuthenticationOptions.TargetHost, and System.Net.Security.SslSessionsCache.TryCachedCredential().

Referenced by System.Net.Security.SecureChannel.GenerateToken().