Replace use of obsolete X509Certificate2 API

.config/CredScanSuppressions.json

@@ -32,6 +32,10 @@
     {
       "file": "\\tests\\Shared\\TestCertificates\\testCert.pfx",
       "_justification": "Legitimate UT certificate file with private key, from dotnet/aspnetcore"
+    },
+    {
+      "file": "\\tests\\Shared\\TestCertificates\\https-dsa.pem",
+      "_justification": "Legitimate UT certificate file with private key, from dotnet/aspnetcore"
     }
   ]
 }

Aspire.sln

@@ -145,6 +145,7 @@ EndProject
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution Items", "{991DB378-6CB5-4441-BFC3-657400690FC3}"
 	ProjectSection(SolutionItems) = preProject
 		.editorconfig = .editorconfig
+		.config\CredScanSuppressions.json = .config\CredScanSuppressions.json
 		Directory.Packages.props = Directory.Packages.props
 		spelling.dic = spelling.dic
 		eng\Versions.props = eng\Versions.props

src/Aspire.Dashboard/ResourceService/DashboardClient.cs

@@ -117,8 +117,14 @@ GrpcChannel CreateChannel()
                 // Auth hasn't been suppressed, so configure it.
                 var certificates = _dashboardOptions.ResourceServiceClient.ClientCertificate.Source switch
                 {
-                    DashboardClientCertificateSource.File => GetFileCertificate(),
-                    DashboardClientCertificateSource.KeyStore => GetKeyStoreCertificate(),
+                    DashboardClientCertificateSource.File => CertificateUtil.GetFileCertificate(
+                        filePath: _dashboardOptions.ResourceServiceClient.ClientCertificate.FilePath!, // validated
+                        password: _dashboardOptions.ResourceServiceClient.ClientCertificate.Password,
+                        logger: _logger),
+                    DashboardClientCertificateSource.KeyStore => CertificateUtil.GetKeyStoreCertificate(
+                        subject: _dashboardOptions.ResourceServiceClient.ClientCertificate.Subject!, // validated
+                        storeName: _dashboardOptions.ResourceServiceClient.ClientCertificate.Store,
+                        location: _dashboardOptions.ResourceServiceClient.ClientCertificate.Location ?? StoreLocation.LocalMachine),
                     _ => throw new InvalidOperationException("Unable to load ResourceServiceClient client certificate.")
                 };
 
@@ -158,58 +164,6 @@ GrpcChannel CreateChannel()
                     LoggerFactory = _loggerFactory,
                     ThrowOperationCanceledOnCancellation = true
                 });
-
-            X509CertificateCollection GetFileCertificate()
-            {
-                Debug.Assert(
-                    _dashboardOptions.ResourceServiceClient.ClientCertificate.FilePath != null,
-                    "FilePath is validated as not null when configuration is loaded.");
-
-                var filePath = _dashboardOptions.ResourceServiceClient.ClientCertificate.FilePath;
-                var password = _dashboardOptions.ResourceServiceClient.ClientCertificate.Password;
-
-                var certBytes = File.ReadAllBytes(filePath);
-
-                var certContentType = X509Certificate2.GetCertContentType(certBytes);
-
-                if (certContentType is X509ContentType.Pkcs12)
-                {
-                    return [X509CertificateLoader.LoadPkcs12(certBytes, password)];
-                }
-                else
-                {
-                    if (password is not null)
-                    {
-                        _logger.LogDebug("Resource service certificate {FilePath} has type {Type} which does not support passwords, yet a password was configured. The certificate password will be ignored.", filePath, certContentType);
-                    }
-
-                    return [X509CertificateLoader.LoadCertificate(certBytes)];
-                }
-            }
-
-            X509CertificateCollection GetKeyStoreCertificate()
-            {
-                Debug.Assert(
-                    _dashboardOptions.ResourceServiceClient.ClientCertificate.Subject != null,
-                    "Subject is validated as not null when configuration is loaded.");
-
-                var subject = _dashboardOptions.ResourceServiceClient.ClientCertificate.Subject;
-                var storeName = _dashboardOptions.ResourceServiceClient.ClientCertificate.Store ?? "My";
-                var location = _dashboardOptions.ResourceServiceClient.ClientCertificate.Location ?? StoreLocation.CurrentUser;
-
-                using var store = new X509Store(storeName: storeName, storeLocation: location);
-
-                store.Open(OpenFlags.ReadOnly);
-
-                var certificates = store.Certificates.Find(X509FindType.FindBySubjectName, findValue: subject, validOnly: true);
-
-                if (certificates is [])
-                {
-                    throw new InvalidOperationException($"Unable to load client certificate with subject \"{subject}\" from key store.");
-                }
-
-                return certificates;
-            }
         }
     }
 

src/Aspire.Dashboard/Utils/CertificateUtil.cs

@@ -0,0 +1,48 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System.Security.Cryptography.X509Certificates;
+
+namespace Aspire.Dashboard;
+
+internal static class CertificateUtil
+{
+    public static X509CertificateCollection GetFileCertificate(string filePath, string? password, ILogger logger)
+    {
+        var certBytes = File.ReadAllBytes(filePath);
+
+        var certContentType = X509Certificate2.GetCertContentType(certBytes);
+
+        if (certContentType is X509ContentType.Pkcs12)
+        {
+            return [X509CertificateLoader.LoadPkcs12(certBytes, password)];
+        }
+        else
+        {
+            if (password is not null)
+            {
+                logger.LogDebug("Resource service certificate {FilePath} has type {Type} which does not support passwords, yet a password was configured. The certificate password will be ignored.", filePath, certContentType);
+            }
+
+            return [X509CertificateLoader.LoadCertificate(certBytes)];
+        }
+    }
+
+    public static X509CertificateCollection GetKeyStoreCertificate(string subject, string? storeName = null, StoreLocation location = StoreLocation.CurrentUser)
+    {
+        storeName ??= "My";
+
+        using var store = new X509Store(storeName: storeName, storeLocation: location);
+
+        store.Open(OpenFlags.ReadOnly);
+
+        var certificates = store.Certificates.Find(X509FindType.FindBySubjectName, findValue: subject, validOnly: true);
+
+        if (certificates is [])
+        {
+            throw new InvalidOperationException($"Unable to load client certificate with subject \"{subject}\" from key store.");
+        }
+
+        return certificates;
+    }
+}

tests/Aspire.Dashboard.Tests/Aspire.Dashboard.Tests.csproj

@@ -25,6 +25,7 @@
     <Compile Include="$(TestsSharedDir)Logging\*.cs" LinkBase="shared/Logging" />
     <Compile Include="$(TestsSharedDir)Telemetry\*.cs" LinkBase="shared/Telemetry" />
     <Content Include="$(TestsSharedDir)TestCertificates\*.pfx" LinkBase="shared/TestCertificates" CopyToOutputDirectory="PreserveNewest" />
+    <Content Include="$(TestsSharedDir)TestCertificates\*.pem" LinkBase="shared/TestCertificates" CopyToOutputDirectory="PreserveNewest" />
 
     <Content Include="..\..\src\Aspire.Dashboard\wwwroot\**\*.*" LinkBase="wwwroot" CopyToOutputDirectory="PreserveNewest" />
   </ItemGroup>

tests/Aspire.Dashboard.Tests/Utils/CertificateUtilTests.cs

@@ -0,0 +1,132 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System.Collections;
+using System.Security.Cryptography;
+using System.Security.Cryptography.X509Certificates;
+using Microsoft.AspNetCore.InternalTesting;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
+using Xunit;
+
+namespace Aspire.Dashboard;
+
+public sealed class CertificateUtilTests
+{
+    [Theory]
+    [InlineData("testCert.pfx", X509ContentType.Pkcs12)]
+    [InlineData("https-dsa.pem", X509ContentType.Cert)]
+    public void TestCertificateTypes(string fileName, X509ContentType contentType)
+    {
+        var filePath = TestCertificateLoader.GetCertPath(fileName);
+
+        Assert.Equal(contentType, X509Certificate2.GetCertContentType(filePath));
+    }
+
+    [Fact]
+    public void GetFileCertificate_Pkcs12_CorrectPassword()
+    {
+        var certificates = CertificateUtil.GetFileCertificate(
+            filePath: TestCertificateLoader.GetCertPath("testCert.pfx"),
+            password: "testPassword",
+            logger: NullLogger.Instance);
+
+        Assert.NotNull(certificates);
+
+        var cert = Assert.Single(certificates.Cast<X509Certificate>());
+
+        Assert.NotNull(cert);
+        Assert.Equal("CN=localhost", cert.Subject);
+    }
+
+    [Fact]
+    public void GetFileCertificate_Pkcs12_IncorrectPassword()
+    {
+        Assert.Throws<CryptographicException>(() => CertificateUtil.GetFileCertificate(
+            filePath: TestCertificateLoader.GetCertPath("testCert.pfx"),
+            password: "wrongPassword",
+            logger: NullLogger.Instance));
+    }
+
+    [Fact]
+    public void GetFileCertificate_Cert_WithRedundantPassword()
+    {
+        var filePath = TestCertificateLoader.GetCertPath("https-dsa.pem");
+
+        using MockLogger logger = new()
+        {
+            $"Resource service certificate {filePath} has type {X509ContentType.Cert} which does not support passwords, yet a password was configured. The certificate password will be ignored."
+        };
+
+        var certificates = CertificateUtil.GetFileCertificate(
+            filePath: filePath,
+            password: "testPassword",
+            logger: logger);
+
+        Assert.NotNull(certificates);
+
+        var cert = Assert.Single(certificates.Cast<X509Certificate>());
+
+        Assert.NotNull(cert);
+        Assert.Equal("OU=Development, O=Contoso, L=Alexandria, S=Virginia, C=US", cert.Subject);
+    }
+
+    [Fact]
+    public void GetFileCertificate_Cert()
+    {
+        var filePath = TestCertificateLoader.GetCertPath("https-dsa.pem");
+
+        var certificates = CertificateUtil.GetFileCertificate(
+            filePath: filePath,
+            password: null, // No password required for this file
+            logger: null!); // Should not be called, and a sneaky null validates this
+
+        Assert.NotNull(certificates);
+
+        var cert = Assert.Single(certificates.Cast<X509Certificate>());
+
+        Assert.NotNull(cert);
+        Assert.Equal("OU=Development, O=Contoso, L=Alexandria, S=Virginia, C=US", cert.Subject);
+    }
+
+    private sealed class MockLogger : ILogger, IDisposable, IEnumerable
+    {
+        private readonly List<string> _expected = [];
+
+        IDisposable? ILogger.BeginScope<TState>(TState state) => null;
+
+        bool ILogger.IsEnabled(LogLevel logLevel) => true;
+
+        void ILogger.Log<TState>(LogLevel logLevel, EventId eventId, TState state, Exception? exception, Func<TState, Exception?, string> formatter)
+        {
+            if (_expected.Count == 0)
+            {
+                Assert.Fail("Unexpected log invocation.");
+            }
+
+            var actual = formatter(state, exception);
+            var expected = _expected[0];
+            _expected.RemoveAt(0);
+
+            Assert.Equal(expected, actual);
+        }
+
+        public void Add(string expected)
+        {
+            _expected.Add(expected);
+        }
+
+        IEnumerator IEnumerable.GetEnumerator()
+        {
+            throw new NotSupportedException("Only IEnumerable to support collection initializers.");
+        }
+
+        void IDisposable.Dispose()
+        {
+            if (_expected.Count is not 0)
+            {
+                Assert.Fail($"Not all expected log messages were observed. {_expected.Count} remain.");
+            }
+        }
+    }
+}

tests/Shared/TestCertificates/https-dsa.pem

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDWTCCAxWgAwIBAgIUFRQGA90GHC74cNK/hNzQDi7XJFYwCwYJYIZIAWUDBAMC
+MF0xCzAJBgNVBAYTAlVTMREwDwYDVQQIDAhWaXJnaW5pYTETMBEGA1UEBwwKQWxl
+eGFuZHJpYTEQMA4GA1UECgwHQ29udG9zbzEUMBIGA1UECwwLRGV2ZWxvcG1lbnQw
+HhcNMjAwNjE5MTkyODIwWhcNMjAwNzE5MTkyODIwWjBdMQswCQYDVQQGEwJVUzER
+MA8GA1UECAwIVmlyZ2luaWExEzARBgNVBAcMCkFsZXhhbmRyaWExEDAOBgNVBAoM
+B0NvbnRvc28xFDASBgNVBAsMC0RldmVsb3BtZW50MIIBtjCCASsGByqGSM44BAEw
+ggEeAoGBAJyiyioeXx1O98gRCMEjlPKMpr79KrcDkoroghtuXO1U6Cx34pBRjOQm
+QLDPqSOriEo5VuG6SJc/ppfZx9TrSrzqB26hKTUmiaOKmwpfIfzpi72wgsZeMOtU
+7JQ+FThfGyS8VxGh6G0h7xw26B/9ALxRw25zO1cy9ZJs0EY3hsHzAhUA/4dpclsc
+k8K+SkWBTcPfU+x7wTUCgYB4LP6UvrvIiiFPxhk7AEGMMr0MhcJ3hhsgKWukUqIY
+sJKBM5MpKCnej5BHvnLXdKodIxygcKR4dJX7BRv69L+2RJk+UrYL1qBco5HpUslu
+mA0e3gNdwRLoOoGD14dn1LD1LdESsyMgwfHHJ0RRkYwacgCVXsvHv/eAkA8qq136
+dwOBhAACgYAHltgzkK3zD8yGdcGY0YgvN5l3lna1voLmcK+XtmehjMVy7OSSFICN
+KybLBOvO8paydhCb1J0klkLPAoAjgP2cEd+KueeRyJpx+jD1MsjIEXIn5jtjXdUH
+d0JJmHWAyHdNzmhXrXC7JLnj4ri7xMAV3GZGDpAnYvvL0LiXzFyomqNTMFEwHQYD
+VR0OBBYEFF1l4ZrF3ND05CjGd//ev0dJLCB7MB8GA1UdIwQYMBaAFF1l4ZrF3ND0
+5CjGd//ev0dJLCB7MA8GA1UdEwEB/wQFMAMBAf8wCwYJYIZIAWUDBAMCAzEAMC4C
+FQD6plYf60MDCvMjf1yQ8SBaFX3YYwIVAKqRQklh2b0Qhv+US222hb8xySJV
+-----END CERTIFICATE-----