mirror of
https://github.com/usestrix/firewall.git
synced 2026-11-09 18:08:49 -10:00
ian-at-strixandIan Graham Martinez
7cafa16cc4
* Hold the CA key in the TPM on Windows A non-exportable machine key in the TPM, or in software where there is none, signs as the Secure Enclave key does on macOS. * Require the TPM for the Windows CA key A failure to open the TPM fell back to a software key, which minted a new CA and kept it for good. Fail instead, as macOS does without a Secure Enclave. * Use the windows crate for the TPM key --------- Co-authored-by: Ian Graham Martinez <[email protected]>
22 lines
752 B
Rust
22 lines
752 B
Rust
#![cfg(windows)]
|
|
|
|
use firewall::mitm::CertificateAuthority;
|
|
use firewall::os::windows::CaKey;
|
|
use rcgen::PublicKeyData;
|
|
|
|
/// Skipped on machines without a TPM.
|
|
#[test]
|
|
fn key_signs_a_verifiable_ca() {
|
|
let key = match CaKey::create_test_key() {
|
|
Ok(key) => key,
|
|
Err(error) => return eprintln!("skipping, no TPM key: {error}"),
|
|
};
|
|
let ca = CertificateAuthority::generate(&["registry.npmjs.org"], &key);
|
|
let spki = key.subject_public_key_info();
|
|
key.delete_from_tpm().expect("delete the test key");
|
|
let ca = ca.expect("mint a ca");
|
|
let public = ca.crt.public_key().expect("ca public key");
|
|
assert!(ca.crt.verify(&public).expect("verify the ca"));
|
|
assert_eq!(public.public_key_to_der().unwrap(), spki);
|
|
}
|