- Notifications
You must be signed in to change notification settings - Fork615
Added option to specify ClientCertificateContext in .NET 8+#1866
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Conversation
tyb-dev commentedSep 5, 2025
I haven't signed the CA yet. If there's interest in this change, I'm happy to sign it so this PR can proceed. |
michaelklishin commentedSep 5, 2025
@tyb-dev I definitely think there is interest in supporting this option (conditionally, on .NET 8+). Thank you! Please email us asdescribed in the contributor CLA repo and we will send you a Box Sign signature request. |
lukebakken left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
A test is required. If you'd like to get the skeleton of a test in place in theprojects\Test\Integration\TestSsl.cs file I can ensure the correct certs are in place for CI runs.
c3995bd to9849f55CompareFixesrabbitmq#1864.NET supports the ability to supply intermediate certificates as well asthe client certificate during mTLS setup. Without support for`ClientCertificateContext`, users must ensure that intermediate certsare available in the system cert store for the .NET runtime to find.These changes use certificates generated via `rabbitmq/tls-gen` usingthis command:```make CN=localhost -C one_intermediate```All SSL tests now provide a client certificate, because the RabbitMQconfiguration has changed to require them via via...```ssl_options.fail_if_no_peer_cert = true```
9849f55 toc91c7f5Compareafae979 intorabbitmq:mainUh oh!
There was an error while loading.Please reload this page.
Proposed Changes
This allows clients to send the full intermediate chain during the TLS handshake instead of relying on OS stores or AIA fetches, addressing issue#1864. It improves interoperability when servers don’t have intermediates installed or when environments lack internet access.
Keep behavior unchanged for netstandard2.0; the new API is only compiled for net8.0.
Split Public API “Unshipped” files per TFM and wire them via AdditionalFiles to satisfy the PublicApiAnalyzer for both net8.0 and netstandard2.0.
Types of Changes
What types of changes does your code introduce to this project?
Put an
xin the boxes that applyChecklist
Put an
xin the boxes that apply. You can also fill these out after creatingthe PR. If you're unsure about any of them, don't hesitate to ask on the
mailing list. We're here to help! This is simply a reminder of what we are
going to look for before merging your code.
CONTRIBUTING.mddocumentFurther Comments
N/A