feat(gateway): generate self-signed ECDSA cert with SANs

2026-06-01 07:18:39 -04:00
parent 6f9188bc8d
commit b8a6695612
3 changed files with 112 additions and 0 deletions
@@ -0,0 +1,71 @@
+using System.Net;
+using System.Security.Cryptography;
+using System.Security.Cryptography.X509Certificates;
+using Microsoft.Extensions.Logging;
+using ZB.MOM.WW.MxGateway.Server.Configuration;
+
+namespace ZB.MOM.WW.MxGateway.Server.Security.Tls;
+
+/// <summary>
+/// Generates and persists a long-lived self-signed certificate used as the
+/// Kestrel HTTPS default when no operator certificate is configured.
+/// </summary>
+public sealed class SelfSignedCertificateProvider
+{
+    private const string ServerAuthOid = "1.3.6.1.5.5.7.3.1";
+
+    private readonly TlsOptions _options;
+    private readonly ILogger<SelfSignedCertificateProvider> _logger;
+    private readonly TimeProvider _timeProvider;
+
+    public SelfSignedCertificateProvider(
+        TlsOptions options,
+        ILogger<SelfSignedCertificateProvider> logger,
+        TimeProvider timeProvider)
+    {
+        _options = options;
+        _logger = logger;
+        _timeProvider = timeProvider;
+    }
+
+    /// <summary>Creates a fresh in-memory ECDSA P-256 self-signed certificate.</summary>
+    public X509Certificate2 GenerateCertificate()
+    {
+        using ECDsa key = ECDsa.Create(ECCurve.NamedCurves.nistP256);
+        CertificateRequest request = new(
+            new X500DistinguishedName("CN=MxAccessGateway Self-Signed"),
+            key,
+            HashAlgorithmName.SHA256);
+
+        request.CertificateExtensions.Add(new X509BasicConstraintsExtension(false, false, 0, true));
+        request.CertificateExtensions.Add(new X509KeyUsageExtension(
+            X509KeyUsageFlags.DigitalSignature | X509KeyUsageFlags.KeyEncipherment,
+            critical: true));
+        request.CertificateExtensions.Add(new X509EnhancedKeyUsageExtension(
+            [new Oid(ServerAuthOid, "Server Authentication")],
+            critical: false));
+
+        SubjectAlternativeNameBuilder san = new();
+        san.AddDnsName("localhost");
+        string machine = Environment.MachineName;
+        if (!string.IsNullOrWhiteSpace(machine))
+        {
+            san.AddDnsName(machine);
+        }
+
+        foreach (string extra in _options.AdditionalDnsNames)
+        {
+            if (!string.IsNullOrWhiteSpace(extra))
+            {
+                san.AddDnsName(extra);
+            }
+        }
+
+        san.AddIpAddress(IPAddress.Loopback);
+        san.AddIpAddress(IPAddress.IPv6Loopback);
+        request.CertificateExtensions.Add(san.Build());
+
+        DateTimeOffset now = _timeProvider.GetUtcNow();
+        return request.CreateSelfSigned(now.AddDays(-1), now.AddYears(_options.ValidityYears));
+    }
+}