Use of Windows certificate store for authentication by JacobBarthelmeh · Pull Request #900 · wolfSSL/wolfssh

JacobBarthelmeh · 2026-03-25T12:38:01Z

No description provided.

Copilot

Pull request overview

This PR adds Windows Certificate Store integration to wolfSSH so host keys and client authentication keys can be sourced from the Windows cert store (including CI coverage on Windows).

Changes:

Add a Windows-only API to load a private key by locating a certificate in the Windows Certificate Store, and use CNG to sign during SSH handshakes/auth.
Extend cert manager plumbing and wolfsshd configuration to support system/user CA loading and cert-store-based host keys.
Update Windows build projects and add a GitHub Actions workflow to exercise file-vs-store interop permutations.

Reviewed changes

Copilot reviewed 22 out of 22 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
wolfssh/test.h	Prefer wolfCrypt Base16 when available; otherwise keep local Base16 decode helper.
wolfssh/ssh.h	Add `wolfSSH_CTX_UsePrivateKey_fromStore()` Windows-only public API.
wolfssh/internal.h	Add CTX private-key metadata for cert-store backed keys and internal helper prototypes.
wolfssh/certman.h	Expose cert-manager setter and Windows cert-store spec parser API.
src/ssh.c	Implement loading a CTX private key from the Windows Certificate Store.
src/internal.c	Add cert-store signing path (CNG) and cert-derived RSA public-key extraction for KEX/auth flows.
src/certman.c	Implement `wolfSSH_SetCertManager()` and `wolfSSH_ParseCertStoreSpec()`.
ide/winvs/wolfsshd/wolfsshd.vcxproj	Link against `crypt32`/`ncrypt` for cert-store features.
ide/winvs/wolfssh/wolfssh.vcxproj	Link against `crypt32`/`ncrypt` for cert-store features.
ide/winvs/wolfsftp-client/wolfsftp-client.vcxproj	Link against `crypt32`/`ncrypt` for cert-store features.
ide/winvs/unit-test/unit-test.vcxproj	Link against `crypt32`/`ncrypt` for cert-store features; normalize XML header.
ide/winvs/echoserver/echoserver.vcxproj	Link against `crypt32`/`ncrypt` for cert-store features.
ide/winvs/client/client.vcxproj	Link against `crypt32`/`ncrypt` for cert-store features.
ide/winvs/api-test/api-test.vcxproj	Link against `crypt32`/`ncrypt` for cert-store features; normalize XML header.
examples/sftpclient/sftpclient.c	Add `-W store:subject:flags` support for client key from Windows cert store.
examples/echoserver/echoserver.c	Add `-W` support for server host key from Windows cert store; skip key-file root search when using store.
examples/client/common.h	Declare helper functions for cert-store key loading/auth setup.
examples/client/common.c	Implement cert-store key loading wrapper + auth globals setup for x509v3 publickey auth.
apps/wolfsshd/wolfsshd.c	Add host-key-from-store support and optional system/user CA store loading into wolfSSH cert manager.
apps/wolfsshd/configuration.h	Add config getters for host-key store and Windows user-CA store options.
apps/wolfsshd/configuration.c	Add parsing/storage for new config directives and defaults.
.github/workflows/windows-cert-store-test.yml	Add Windows CI workflow to validate store/file combinations.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 21 out of 22 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 22 out of 23 changed files in this pull request and generated 9 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #900

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

Copilot

Pull request overview

Copilot reviewed 22 out of 23 changed files in this pull request and generated 8 comments.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #900

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

…t store.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #900

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

Copilot

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated no new comments.

…with store cert

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #900

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

Copilot

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated 2 comments.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #900

Scan targets checked: wolfssh-src
Failed targets: wolfssh-bugs

⚠️ Review incomplete — one or more scan targets failed before findings could be produced. See the Fenrir PR review detail page for logs.

aidangarske

🐺 Skoll Code Review

Overall recommendation: REQUEST_CHANGES
Findings: 5 total — 5 posted, 0 skipped

Posted findings

[High] Store-backed host keys never negotiate RFC6187 certificates — src/ssh.c:2896-3012
[High] Imported cert manager can dangle when up_ref fails — src/certman.c:100-115
[High] System CA store can become a Windows SSH user-auth trust root without identity binding — apps/wolfsshd/wolfsshd.c:567-607
[High] CA-store config directives are accepted but ignored when unsupported — apps/wolfsshd/wolfsshd.c:618-627
[Medium] Core cert-store parsing and state transitions lack unit coverage — src/certman.c:630-717

Review generated by Skoll.

…rname, build check for WOLFSSL_SYS_CA_CERTS, fix for CM ref count

…cc curve, tie in of loading whole cert store for sys CA's

Copilot

Pull request overview

Copilot reviewed 25 out of 25 changed files in this pull request and generated 4 comments.

+            if (WSTRCMP(flagsStr, "CURRENT_USER") == 0) {
+                *dwFlags = CERT_SYSTEM_STORE_CURRENT_USER;
+            }
+            else if (WSTRCMP(flagsStr, "LOCAL_MACHINE") == 0) {
+                *dwFlags = CERT_SYSTEM_STORE_LOCAL_MACHINE;
+            }
+            else {
+                *dwFlags = (word32)atoi(flagsStr);
+            }


+                } else if (WSTRCMP(hostKeyStoreFlags, "LOCAL_MACHINE") == 0) {
+                    dwFlags = CERT_SYSTEM_STORE_LOCAL_MACHINE;
+                } else {
+                    dwFlags = (word32)atoi(hostKeyStoreFlags);
+                }


wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #900

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot · 2026-07-10T23:53:43Z

    }

-    #ifdef WOLFSSL_FPKI
+    #if defined(WOLFSSL_FPKI) || defined(_WIN32)


🔵 [Low] Outer _WIN32 guard vs inner WIN32 guard mismatch in cert auth path · Incorrect bitwise vs logical operators

The outer block is guarded by defined(_WIN32) (line 1543) but the SetupUserTokenWin call inside is guarded by #ifdef WIN32 (line 1642). On a Windows toolchain where _WIN32 is defined but WIN32 is not, the CN check succeeds yet the token-setup branch is skipped, causing cert auth to fall to the unconditional rejection path.

Fix: Change the outer guard to use WIN32 for consistency with the existing inner guard, or change the inner guard to _WIN32.

JacobBarthelmeh self-assigned this Mar 25, 2026

Copilot AI review requested due to automatic review settings March 25, 2026 12:38

Copilot started reviewing on behalf of JacobBarthelmeh March 25, 2026 12:39 View session

JacobBarthelmeh force-pushed the winSysCerts branch from bd1396d to ca912b0 Compare March 25, 2026 12:43

Copilot AI reviewed Mar 25, 2026

View reviewed changes

Comment thread src/internal.c Outdated

Comment thread src/certman.c

Comment thread src/certman.c

Comment thread wolfssh/internal.h Outdated

Comment thread src/ssh.c Outdated

Comment thread src/ssh.c Outdated

Comment thread src/ssh.c

Comment thread src/internal.c

Copilot AI review requested due to automatic review settings April 14, 2026 03:24

Copilot started reviewing on behalf of JacobBarthelmeh April 14, 2026 03:27 View session

Copilot AI reviewed Apr 14, 2026

View reviewed changes

Comment thread wolfssh/certman.h

Comment thread src/ssh.c Outdated

Comment thread src/ssh.c

Comment thread apps/wolfsshd/wolfsshd.c

Comment thread apps/wolfsshd/configuration.c

JacobBarthelmeh mentioned this pull request Apr 14, 2026

add windows certificate store documentation wolfSSL/documentation#261

Open

Copilot AI review requested due to automatic review settings April 14, 2026 16:30

JacobBarthelmeh force-pushed the winSysCerts branch from 66c8726 to b545c32 Compare April 14, 2026 16:30

Copilot AI reviewed Apr 14, 2026

View reviewed changes

Copilot started reviewing on behalf of JacobBarthelmeh April 14, 2026 17:09 View session

ejohnstown mentioned this pull request Jun 12, 2026

Add support for loading user CA certs from a configurable Windows cert store. #688

Closed

ejohnstown marked this pull request as draft June 25, 2026 17:23

JacobBarthelmeh force-pushed the winSysCerts branch from b545c32 to de28863 Compare July 2, 2026 05:38

JacobBarthelmeh requested a review from wolfSSL-Fenrir-bot July 2, 2026 05:39

JacobBarthelmeh force-pushed the winSysCerts branch from de28863 to 6b8a1ca Compare July 2, 2026 05:46

wolfSSL-Fenrir-bot reviewed Jul 2, 2026

View reviewed changes

JacobBarthelmeh requested review from Copilot and wolfSSL-Fenrir-bot July 2, 2026 07:21

Copilot started reviewing on behalf of JacobBarthelmeh July 2, 2026 07:22 View session

Copilot AI reviewed Jul 2, 2026

View reviewed changes

Comment thread src/internal.c Outdated

Comment thread src/ssh.c

Comment thread src/ssh.c

Comment thread wolfssh/internal.h Outdated

Comment thread src/internal.c

Comment thread src/internal.c

Comment thread src/internal.c

Comment thread src/internal.c

wolfSSL-Fenrir-bot reviewed Jul 2, 2026

View reviewed changes

JacobBarthelmeh marked this pull request as ready for review July 2, 2026 22:27

JacobBarthelmeh assigned wolfSSL-Bot and unassigned JacobBarthelmeh Jul 2, 2026

JacobBarthelmeh and others added 3 commits July 6, 2026 16:18

add TrustedSystemCAKeys sshd option for system CA load

4b679ef

add macro guard for system ca certs load

fccb41f

Add support for loading user CA certs from a configurable Windows cer…

227e6da

…t store.

ejohnstown self-requested a review July 7, 2026 19:04

ejohnstown previously approved these changes Jul 7, 2026

View reviewed changes

ejohnstown requested review from Copilot and wolfSSL-Fenrir-bot July 7, 2026 19:13

Copilot started reviewing on behalf of ejohnstown July 7, 2026 19:24 View session

wolfSSL-Fenrir-bot reviewed Jul 7, 2026

View reviewed changes

Copilot AI reviewed Jul 7, 2026

View reviewed changes

remove unused macros and added a hardening sanity check on RSA sigSz …

7e43eba

…with store cert

JacobBarthelmeh dismissed ejohnstown’s stale review via 7e43eba July 7, 2026 19:58

JacobBarthelmeh requested a review from wolfSSL-Fenrir-bot July 7, 2026 19:58

wolfSSL-Fenrir-bot reviewed Jul 7, 2026

View reviewed changes

add check on return value for CreateString

78a78df

JacobBarthelmeh requested review from Copilot and wolfSSL-Fenrir-bot July 7, 2026 20:33

Copilot started reviewing on behalf of JacobBarthelmeh July 7, 2026 20:35 View session

Copilot AI reviewed Jul 7, 2026

View reviewed changes

Comment thread configure.ac Outdated

Comment thread src/ssh.c

wolfSSL-Fenrir-bot reviewed Jul 7, 2026

View reviewed changes

dgarske marked this pull request as ready for review July 7, 2026 21:42

aidangarske requested changes Jul 9, 2026

View reviewed changes

Comment thread src/ssh.c Outdated

Comment thread src/certman.c

Comment thread apps/wolfsshd/wolfsshd.c Outdated

Comment thread apps/wolfsshd/wolfsshd.c

Comment thread src/certman.c

aidangarske assigned JacobBarthelmeh and unassigned wolfSSL-Bot Jul 9, 2026

additional unit tests, advertise x509 and pubkey, use CN to match use…

07a3d42

…rname, build check for WOLFSSL_SYS_CA_CERTS, fix for CM ref count

JacobBarthelmeh marked this pull request as draft July 10, 2026 20:46

additional build test, uniform enum name, fail on unkown cert store e…

0966ca2

…cc curve, tie in of loading whole cert store for sys CA's

JacobBarthelmeh requested review from Copilot and wolfSSL-Fenrir-bot July 10, 2026 23:32

Copilot started reviewing on behalf of JacobBarthelmeh July 10, 2026 23:38 View session

Copilot AI reviewed Jul 10, 2026

View reviewed changes

wolfSSL-Fenrir-bot reviewed Jul 10, 2026

View reviewed changes

fix enum value and revert curve fallback

193be64

Uh oh!

Conversation

JacobBarthelmeh commented Mar 25, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #900

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #900

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #900

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #900

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #900