HashiCorp Vault and TLS Certificate Authentication for .NET Applications (Comprehensive guide)

Pingback: Dew Drop – October 9, 2019 (#3047) | Morning Dew

Pingback: Install/Setup Vault for PKI + NGINX + Docker – Becoming your own CA | HoldMyBeer

2023-02-15T15:20:32+01:00

Hi,
Nice Article, but one thing I would like to know. So vault generates a pem files. How you store them in windows cert store. Because it will accept only .pfx files but not pem.
Could you please guide me on that.

Reply

2023-02-16T20:21:59+01:00

You can use openssl to to generate private key (pem), then public key (pem) and combine them into pfx, like this (3 commands)
openssl genrsa 2048 > vault-qa_private.pem
openssl req -x509 -new -key vault-qa_private.pem -out vault-qa_public.pem -days 365
openssl pkcs12 -export -in vault-qa_public.pem -inkey vault-qa_private.pem -out vault-qa.pfx

Reply

	#Import certificate to local machine personal folder
	$root = Set-Location -PassThru $PSScriptRoot

	$cert = Get-ChildItem -Path $root \| where {$_.Extension -like "*.pfx"}

	$PlainTextPass = Read-Host -Prompt "Type .pfx password for '$cert' certificate"
	$pfxpass = $PlainTextPass \| ConvertTo-SecureString -AsPlainText -Force

	$cert = $cert \| Import-PfxCertificate -CertStoreLocation Cert:\LocalMachine\My -Exportable -Password $pfxpass
	Write-Host "Certificate is imported"


	#Grant permission to selected account on private key and MachineKeys folder
	$fileName = $cert.PrivateKey.CspKeyContainerInfo.UniqueKeyContainerName
	$path = "$env:ALLUSERSPROFILE\Microsoft\Crypto\RSA\MachineKeys\$fileName"

	function SetPermissions([string[]]$accountNames)
	{
	$acl = Get-Acl -Path $path

	# Add the new user and preserve all current permissions: SetAccessRuleProtection(False, X)
	# Add the new user and remove all inherited permissions: SetAccessRuleProtection(True, False)
	# Add the new user and convert all inherited permissions to explicit permissions: SetAccessRuleProtection(True, True)
	$acl.SetAccessRuleProtection($True, $False)

	foreach ($accountName in $accountNames) {
	$rule = New-Object System.Security.AccessControl.FileSystemAccessRule($accountName,"Full","Allow")
	$acl.AddAccessRule($rule)
	}
	Set-Acl -Path $path -AclObject $acl

	Write-Host "Access to certificate is granted for $accountNames"
	}

	SetPermissions(@(
	"me@sergeytihon.com",
	"you@sergeytihon.com"
	))

	using System;
	using System.Collections.Generic;
	using System.Data;
	using System.Linq;
	using System.Threading.Tasks;
	using System.Security.Cryptography.X509Certificates;
	using VaultSharp;
	using VaultSharp.V1.AuthMethods.Cert;

	namespace SergeyTihon.App.Configuration
	{
	public class VaultSecretProvider
	{
	public VaultSecretProvider(string vaultUrl, string vaultNamespace, string certificateThumbprint)
	{
	var clientCertificate = GetCertificate(certificateThumbprint);
	var authMethod = new CertAuthMethodInfo(clientCertificate);

	_vaultClient = new VaultClient(new VaultClientSettings(vaultUrl, authMethod)
	{
	BeforeApiRequestAction = (httpClient, httpRequestMessage) =>
	{
	httpRequestMessage.Headers.Add("X-Vault-Namespace", vaultNamespace);
	}
	});
	}

	public static X509Certificate2 GetCertificate(string certThumbprint)
	{
	var store = new X509Store(StoreName.My, StoreLocation.LocalMachine);
	store.Open(OpenFlags.ReadOnly);
	var certCollection = store.Certificates;

	// Find unexpired certificates.
	var currentCerts = certCollection.Find(X509FindType.FindByTimeValid, DateTime.Now, false);

	// From the collection of unexpired certificates, find the ones with the correct thumbprint.
	var signingCert = currentCerts.Find(X509FindType.FindByThumbprint, certThumbprint, false);

	// Return the first certificate in the collection, has the right name and is current.
	var cert = signingCert.OfType<X509Certificate2>().OrderByDescending(c => c.NotBefore).FirstOrDefault();
	store.Close();

	if (cert is null)
	{
	throw new DataException($"Cannot find valid certificate with thumbprint {certThumbprint}");
	}
	return cert;
	}

	private readonly VaultClient _vaultClient;

	public async Task<Dictionary<string, object>> GetValue(string path, string mountPoint)
	{
	var secret = await _vaultClient.V1.Secrets.KeyValue.V1.ReadSecretAsync(path, mountPoint);
	return secret.Data;
	}
	}
	}

	new VaultSecretProvider(
	"https://my.server.com:8200", // VAULT_ADDR
	"dev/my-team", // VAULT_NAMESPACE
	"877501d5a018e9344088fd5c89580f6b095f5326" // vault.pfx certificate thumbprint
	).GetValue("my-secret", "kv") // path to the secret – vault write kv/my-secret value="s3c(eT"

HashiCorp Vault and TLS Certificate Authentication for .NET Applications (Comprehensive guide)

Why TLS certificate authentication?

TLS certificate generation

Vault configuration

Key/Value secret engine creation

ACL Policy creation

TLS Certificates – Auth Method

TLS certificate deployment

.NET client application

Conclusion

Published by Sergey Tihon 🦔🦀

4 thoughts on “HashiCorp Vault and TLS Certificate Authentication for .NET Applications (Comprehensive guide)”

Leave a comment Cancel reply