certstore

README

certstore

Certstore is a Go library for accessing user identities stored in platform certificate stores. On Windows and macOS, certstore can enumerate user identities and sign messages with their private keys.

Example

package main

import (
	"crypto"
	"encoding/hex"
	"errors"
	"fmt"

	"crypto/rand"
	"crypto/sha256"

	"github.com/mastahyeti/certstore"
)

func main() {
	sig, err := signWithMyIdentity("Ben Toews", "hello, world!")
	if err != nil {
		panic(err)
	}

	fmt.Println(hex.EncodeToString(sig))
}

func signWithMyIdentity(cn, msg string) ([]byte, error) {
	// Open the certificate store for use. This must be Close()'ed once you're
	// finished with the store and any identities it contains.
	store, err := certstore.Open()
	if err != nil {
		return nil, err
	}
	defer store.Close()

	// Get an Identity slice, containing every identity in the store. Each of
	// these must be Close()'ed when you're done with them.
	idents, err := store.Identities()
	if err != nil {
		return nil, err
	}

	// Iterate through the identities, looking for the one we want.
	var me certstore.Identity
	for _, ident := range idents {
		defer ident.Close()

		crt, errr := ident.Certificate()
		if errr != nil {
			return nil, errr
		}

		if crt.Subject.CommonName == "Ben Toews" {
			me = ident
		}
	}

	if me == nil {
		return nil, errors.New("Couldn't find my identity")
	}

	// Get a crypto.Signer for the identity.
	signer, err := me.Signer()
	if err != nil {
		return nil, err
	}

	// Digest and sign our message.
	digest := sha256.Sum256([]byte(msg))
	signature, err := signer.Sign(rand.Reader, digest[:], crypto.SHA256)
	if err != nil {
		return nil, err
	}

	return signature, nil
}

Documentation

Index

• Constants
• Variables
• type Identity
• type Store
  • func Open() (Store, error)

Constants

const (

	// ERROR_SUCCESS
	ERROR_SUCCESS = 0x00000000

	// CRYPT_E_NOT_FOUND — Cannot find object or property.
	CRYPT_E_NOT_FOUND = 0x80092004

	// NTE_BAD_ALGID — Invalid algorithm specified.
	NTE_BAD_ALGID = 0x80090008
)

Variables

var (
	// Store name
	CERT_STORE_PROV_SYSTEM_W = C.GET_CERT_STORE_PROV_SYSTEM_W()

	// NCRYPT Object Property Names
	NCRYPT_ALGORITHM_GROUP_PROPERTY        = C.GET_NCRYPT_ALGORITHM_GROUP_PROPERTY()
	NCRYPT_ALGORITHM_PROPERTY              = C.GET_NCRYPT_ALGORITHM_PROPERTY()
	NCRYPT_BLOCK_LENGTH_PROPERTY           = C.GET_NCRYPT_BLOCK_LENGTH_PROPERTY()
	NCRYPT_CERTIFICATE_PROPERTY            = C.GET_NCRYPT_CERTIFICATE_PROPERTY()
	NCRYPT_DH_PARAMETERS_PROPERTY          = C.GET_NCRYPT_DH_PARAMETERS_PROPERTY()
	NCRYPT_EXPORT_POLICY_PROPERTY          = C.GET_NCRYPT_EXPORT_POLICY_PROPERTY()
	NCRYPT_IMPL_TYPE_PROPERTY              = C.GET_NCRYPT_IMPL_TYPE_PROPERTY()
	NCRYPT_KEY_TYPE_PROPERTY               = C.GET_NCRYPT_KEY_TYPE_PROPERTY()
	NCRYPT_KEY_USAGE_PROPERTY              = C.GET_NCRYPT_KEY_USAGE_PROPERTY()
	NCRYPT_LAST_MODIFIED_PROPERTY          = C.GET_NCRYPT_LAST_MODIFIED_PROPERTY()
	NCRYPT_LENGTH_PROPERTY                 = C.GET_NCRYPT_LENGTH_PROPERTY()
	NCRYPT_LENGTHS_PROPERTY                = C.GET_NCRYPT_LENGTHS_PROPERTY()
	NCRYPT_MAX_NAME_LENGTH_PROPERTY        = C.GET_NCRYPT_MAX_NAME_LENGTH_PROPERTY()
	NCRYPT_NAME_PROPERTY                   = C.GET_NCRYPT_NAME_PROPERTY()
	NCRYPT_PIN_PROMPT_PROPERTY             = C.GET_NCRYPT_PIN_PROMPT_PROPERTY()
	NCRYPT_PIN_PROPERTY                    = C.GET_NCRYPT_PIN_PROPERTY()
	NCRYPT_PROVIDER_HANDLE_PROPERTY        = C.GET_NCRYPT_PROVIDER_HANDLE_PROPERTY()
	NCRYPT_READER_PROPERTY                 = C.GET_NCRYPT_READER_PROPERTY()
	NCRYPT_ROOT_CERTSTORE_PROPERTY         = C.GET_NCRYPT_ROOT_CERTSTORE_PROPERTY()
	NCRYPT_SECURE_PIN_PROPERTY             = C.GET_NCRYPT_SECURE_PIN_PROPERTY()
	NCRYPT_SECURITY_DESCR_PROPERTY         = C.GET_NCRYPT_SECURITY_DESCR_PROPERTY()
	NCRYPT_SECURITY_DESCR_SUPPORT_PROPERTY = C.GET_NCRYPT_SECURITY_DESCR_SUPPORT_PROPERTY()
	NCRYPT_SMARTCARD_GUID_PROPERTY         = C.GET_NCRYPT_SMARTCARD_GUID_PROPERTY()
	NCRYPT_UI_POLICY_PROPERTY              = C.GET_NCRYPT_UI_POLICY_PROPERTY()
	NCRYPT_UNIQUE_NAME_PROPERTY            = C.GET_NCRYPT_UNIQUE_NAME_PROPERTY()
	NCRYPT_USE_CONTEXT_PROPERTY            = C.GET_NCRYPT_USE_CONTEXT_PROPERTY()
	NCRYPT_USE_COUNT_ENABLED_PROPERTY      = C.GET_NCRYPT_USE_COUNT_ENABLED_PROPERTY()
	NCRYPT_USE_COUNT_PROPERTY              = C.GET_NCRYPT_USE_COUNT_PROPERTY()
	NCRYPT_USER_CERTSTORE_PROPERTY         = C.GET_NCRYPT_USER_CERTSTORE_PROPERTY()
	NCRYPT_VERSION_PROPERTY                = C.GET_NCRYPT_VERSION_PROPERTY()
	NCRYPT_WINDOW_HANDLE_PROPERTY          = C.GET_NCRYPT_WINDOW_HANDLE_PROPERTY()

	// BCRYPT BLOB Types
	BCRYPT_DH_PRIVATE_BLOB     = C.GET_BCRYPT_DH_PRIVATE_BLOB()
	BCRYPT_DH_PUBLIC_BLOB      = C.GET_BCRYPT_DH_PUBLIC_BLOB()
	BCRYPT_DSA_PRIVATE_BLOB    = C.GET_BCRYPT_DSA_PRIVATE_BLOB()
	BCRYPT_DSA_PUBLIC_BLOB     = C.GET_BCRYPT_DSA_PUBLIC_BLOB()
	BCRYPT_ECCPRIVATE_BLOB     = C.GET_BCRYPT_ECCPRIVATE_BLOB()
	BCRYPT_ECCPUBLIC_BLOB      = C.GET_BCRYPT_ECCPUBLIC_BLOB()
	BCRYPT_PUBLIC_KEY_BLOB     = C.GET_BCRYPT_PUBLIC_KEY_BLOB()
	BCRYPT_PRIVATE_KEY_BLOB    = C.GET_BCRYPT_PRIVATE_KEY_BLOB()
	BCRYPT_RSAFULLPRIVATE_BLOB = C.GET_BCRYPT_RSAFULLPRIVATE_BLOB()
	BCRYPT_RSAPRIVATE_BLOB     = C.GET_BCRYPT_RSAPRIVATE_BLOB()
	BCRYPT_RSAPUBLIC_BLOB      = C.GET_BCRYPT_RSAPUBLIC_BLOB()

	// BCRYPT Algorithm Names
	BCRYPT_3DES_ALGORITHM              = C.GET_BCRYPT_3DES_ALGORITHM()
	BCRYPT_3DES_112_ALGORITHM          = C.GET_BCRYPT_3DES_112_ALGORITHM()
	BCRYPT_AES_ALGORITHM               = C.GET_BCRYPT_AES_ALGORITHM()
	BCRYPT_AES_CMAC_ALGORITHM          = C.GET_BCRYPT_AES_CMAC_ALGORITHM()
	BCRYPT_AES_GMAC_ALGORITHM          = C.GET_BCRYPT_AES_GMAC_ALGORITHM()
	BCRYPT_CAPI_KDF_ALGORITHM          = C.GET_BCRYPT_CAPI_KDF_ALGORITHM()
	BCRYPT_DES_ALGORITHM               = C.GET_BCRYPT_DES_ALGORITHM()
	BCRYPT_DESX_ALGORITHM              = C.GET_BCRYPT_DESX_ALGORITHM()
	BCRYPT_DH_ALGORITHM                = C.GET_BCRYPT_DH_ALGORITHM()
	BCRYPT_DSA_ALGORITHM               = C.GET_BCRYPT_DSA_ALGORITHM()
	BCRYPT_ECDH_P256_ALGORITHM         = C.GET_BCRYPT_ECDH_P256_ALGORITHM()
	BCRYPT_ECDH_P384_ALGORITHM         = C.GET_BCRYPT_ECDH_P384_ALGORITHM()
	BCRYPT_ECDH_P521_ALGORITHM         = C.GET_BCRYPT_ECDH_P521_ALGORITHM()
	BCRYPT_ECDSA_P256_ALGORITHM        = C.GET_BCRYPT_ECDSA_P256_ALGORITHM()
	BCRYPT_ECDSA_P384_ALGORITHM        = C.GET_BCRYPT_ECDSA_P384_ALGORITHM()
	BCRYPT_ECDSA_P521_ALGORITHM        = C.GET_BCRYPT_ECDSA_P521_ALGORITHM()
	BCRYPT_MD2_ALGORITHM               = C.GET_BCRYPT_MD2_ALGORITHM()
	BCRYPT_MD4_ALGORITHM               = C.GET_BCRYPT_MD4_ALGORITHM()
	BCRYPT_MD5_ALGORITHM               = C.GET_BCRYPT_MD5_ALGORITHM()
	BCRYPT_RC2_ALGORITHM               = C.GET_BCRYPT_RC2_ALGORITHM()
	BCRYPT_RC4_ALGORITHM               = C.GET_BCRYPT_RC4_ALGORITHM()
	BCRYPT_RNG_ALGORITHM               = C.GET_BCRYPT_RNG_ALGORITHM()
	BCRYPT_RNG_DUAL_EC_ALGORITHM       = C.GET_BCRYPT_RNG_DUAL_EC_ALGORITHM()
	BCRYPT_RNG_FIPS186_DSA_ALGORITHM   = C.GET_BCRYPT_RNG_FIPS186_DSA_ALGORITHM()
	BCRYPT_RSA_ALGORITHM               = C.GET_BCRYPT_RSA_ALGORITHM()
	BCRYPT_RSA_SIGN_ALGORITHM          = C.GET_BCRYPT_RSA_SIGN_ALGORITHM()
	BCRYPT_SHA1_ALGORITHM              = C.GET_BCRYPT_SHA1_ALGORITHM()
	BCRYPT_SHA256_ALGORITHM            = C.GET_BCRYPT_SHA256_ALGORITHM()
	BCRYPT_SHA384_ALGORITHM            = C.GET_BCRYPT_SHA384_ALGORITHM()
	BCRYPT_SHA512_ALGORITHM            = C.GET_BCRYPT_SHA512_ALGORITHM()
	BCRYPT_SP800108_CTR_HMAC_ALGORITHM = C.GET_BCRYPT_SP800108_CTR_HMAC_ALGORITHM()
	BCRYPT_SP80056A_CONCAT_ALGORITHM   = C.GET_BCRYPT_SP80056A_CONCAT_ALGORITHM()
	BCRYPT_PBKDF2_ALGORITHM            = C.GET_BCRYPT_PBKDF2_ALGORITHM()
	BCRYPT_ECDSA_ALGORITHM             = C.GET_BCRYPT_ECDSA_ALGORITHM()
	BCRYPT_ECDH_ALGORITHM              = C.GET_BCRYPT_ECDH_ALGORITHM()
	BCRYPT_XTS_AES_ALGORITHM           = C.GET_BCRYPT_XTS_AES_ALGORITHM()
)

var (
	// ErrUnsupportedHash is returned by Signer.Sign() when the provided hash
	// algorithm isn't supported.
	ErrUnsupportedHash = errors.New("unsupported hash algorithm")
)

Types

type Identity

type Identity interface {
	// Certificate gets the identity's certificate.
	Certificate() (*x509.Certificate, error)

	// CertificateChain attempts to get the identity's full certificate chain.
	CertificateChain() ([]*x509.Certificate, error)

	// Signer gets a crypto.Signer that uses the identity's private key.
	Signer() (crypto.Signer, error)

	// Delete deletes this identity from the system.
	Delete() error

	// Close any manually managed memory held by the Identity.
	Close()
}

Identity is a X.509 certificate and its corresponding private key.

type Store

type Store interface {
	// Identities gets a list of identities from the store.
	Identities() ([]Identity, error)

	// Import imports a PKCS#12 (PFX) blob containing a certificate and private
	// key.
	Import(data []byte, password string) error

	// Close closes the store.
	Close()
}

Store represents the system's certificate store.

func Open

func Open() (Store, error)

Open opens the system's certificate store.