Skip to content

Cross-platform SqlColumnEncryptionCertificateStoreProvider support #3014

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 17 commits into from
Aug 28, 2025
Merged

Cross-platform SqlColumnEncryptionCertificateStoreProvider support #3014

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
4782c30
Enabling certificate store provider for Unix platforms
edwardneal Nov 18, 2024
4a3cc2f
Initial round of cross-platform test enablement
edwardneal Nov 18, 2024
d53b7ad
Account for exception message changes between .NET Framework and .NET…
edwardneal Nov 18, 2024
313e6e7
Initial work to enable Unix support.
edwardneal Nov 19, 2024
7d4c221
Moved certificates to external .pfx files, set a password in an effor…
edwardneal Nov 19, 2024
35533a7
Moved certificates to external .pfx files, set a password in an effor…
edwardneal Nov 19, 2024
d932272
Merge branch 'feat/xplat-column-encryption-certificate-store-provider…
edwardneal Nov 19, 2024
c199ddd
Added extra Unix-specific exceptions
edwardneal Nov 19, 2024
bc78fae
macOS issue when handling a certificate without a private key.
edwardneal Nov 19, 2024
4c9e6d4
Merge main
edwardneal May 29, 2025
3f990f5
Correct merge issue - re-remove Unix-specific file
edwardneal May 29, 2025
309dcf5
Address test failures on Windows and Linux
edwardneal May 30, 2025
3cc7cb0
Always add a certificate's CN as a SAN
edwardneal May 30, 2025
e01cb98
Merge main
edwardneal Jun 21, 2025
de4bc32
Account for MacOS KeyStorageFlags quirk
edwardneal Jun 21, 2025
d13d4d6
Merge main
edwardneal Jul 4, 2025
4919a2e
Merge main
edwardneal Jul 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Added extra Unix-specific exceptions 
Converting more unusually-embedded PFX files into embedded resources
  • Loading branch information
@edwardneal
edwardneal committed Nov 19, 2024
commit c199ddd9bbd5bbfc8cdfa43c4eb85570e95dfec1
48 changes: 40 additions & 8 deletions src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SqlUtil.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1696,14 +1696,29 @@ internal static Exception LargeCertificatePathLength(int actualLength, int maxLe

internal static Exception NullCertificatePath(string[] validLocations, bool isSystemOp)
{
Debug.Assert(2 == validLocations.Length);
if (isSystemOp)
if (Environment.OSVersion.Platform == PlatformID.Win32NT)
{
return ADP.ArgumentNull(TdsEnums.TCE_PARAM_MASTERKEY_PATH, StringsHelper.GetString(Strings.TCE_NullCertificatePathSysErr, validLocations[0], validLocations[1], @"/"));
Debug.Assert(validLocations.Length == 2);
if (isSystemOp)
{
return ADP.ArgumentNull(TdsEnums.TCE_PARAM_MASTERKEY_PATH, StringsHelper.GetString(Strings.TCE_NullCertificatePathSysErr, validLocations[0], validLocations[1], @"/"));
}
else
{
return ADP.ArgumentNull(TdsEnums.TCE_PARAM_MASTERKEY_PATH, StringsHelper.GetString(Strings.TCE_NullCertificatePath, validLocations[0], validLocations[1], @"/"));
}
}
else
{
return ADP.ArgumentNull(TdsEnums.TCE_PARAM_MASTERKEY_PATH, StringsHelper.GetString(Strings.TCE_NullCertificatePath, validLocations[0], validLocations[1], @"/"));
Debug.Assert(validLocations.Length == 1);
if (isSystemOp)
{
return ADP.ArgumentNull(TdsEnums.TCE_PARAM_MASTERKEY_PATH, StringsHelper.GetString(Strings.TCE_NullCertificatePathSysErr_Unix, validLocations[0], @"/"));
}
else
{
return ADP.ArgumentNull(TdsEnums.TCE_PARAM_MASTERKEY_PATH, StringsHelper.GetString(Strings.TCE_NullCertificatePath_Unix, validLocations[0], @"/"));
}
}
}

Expand Down Expand Up @@ -1733,14 +1748,29 @@ internal static Exception NullCngKeyPath(bool isSystemOp)

internal static Exception InvalidCertificatePath(string actualCertificatePath, string[] validLocations, bool isSystemOp)
{
Debug.Assert(2 == validLocations.Length);
if (isSystemOp)
if (Environment.OSVersion.Platform == PlatformID.Win32NT)
{
return ADP.Argument(StringsHelper.GetString(Strings.TCE_InvalidCertificatePathSysErr, actualCertificatePath, validLocations[0], validLocations[1], @"/"), TdsEnums.TCE_PARAM_MASTERKEY_PATH);
Debug.Assert(validLocations.Length == 2);
if (isSystemOp)
{
return ADP.Argument(StringsHelper.GetString(Strings.TCE_InvalidCertificatePathSysErr, actualCertificatePath, validLocations[0], validLocations[1], @"/"), TdsEnums.TCE_PARAM_MASTERKEY_PATH);
}
else
{
return ADP.Argument(StringsHelper.GetString(Strings.TCE_InvalidCertificatePath, actualCertificatePath, validLocations[0], validLocations[1], @"/"), TdsEnums.TCE_PARAM_MASTERKEY_PATH);
}
}
else
{
return ADP.Argument(StringsHelper.GetString(Strings.TCE_InvalidCertificatePath, actualCertificatePath, validLocations[0], validLocations[1], @"/"), TdsEnums.TCE_PARAM_MASTERKEY_PATH);
Debug.Assert(validLocations.Length == 1);
if (isSystemOp)
{
return ADP.Argument(StringsHelper.GetString(Strings.TCE_InvalidCertificatePathSysErr_Unix, actualCertificatePath, validLocations[0], @"/"), TdsEnums.TCE_PARAM_MASTERKEY_PATH);
}
else
{
return ADP.Argument(StringsHelper.GetString(Strings.TCE_InvalidCertificatePath_Unix, actualCertificatePath, validLocations[0], @"/"), TdsEnums.TCE_PARAM_MASTERKEY_PATH);
}
}
}

Expand Down Expand Up @@ -1856,6 +1886,7 @@ internal static Exception InvalidCertificateLocation(string certificateLocation,
{
if (Environment.OSVersion.Platform == PlatformID.Win32NT)
{
Debug.Assert(validLocations.Length == 2);
if (isSystemOp)
{
return ADP.Argument(StringsHelper.GetString(Strings.TCE_InvalidCertificateLocationSysErr, certificateLocation, certificatePath, validLocations[0], validLocations[1], @"/"), TdsEnums.TCE_PARAM_MASTERKEY_PATH);
Expand All @@ -1867,6 +1898,7 @@ internal static Exception InvalidCertificateLocation(string certificateLocation,
}
else
{
Debug.Assert(validLocations.Length == 1);
if (isSystemOp)
{
return ADP.Argument(StringsHelper.GetString(Strings.TCE_InvalidCertificateLocationSysErr_Unix, certificateLocation, certificatePath, validLocations[0], @"/"), TdsEnums.TCE_PARAM_MASTERKEY_PATH);
Expand Down
52 changes: 48 additions & 4 deletions src/Microsoft.Data.SqlClient/src/Resources/Strings.Designer.cs
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

12 changes: 12 additions & 0 deletions src/Microsoft.Data.SqlClient/src/Resources/Strings.resx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4035,9 +4035,15 @@
<data name="TCE_NullCertificatePath" xml:space="preserve">
<value>Certificate path cannot be null. Use the following format: &lt;certificate location&gt;{2}&lt;certificate store&gt;{2}&lt;certificate thumbprint&gt;, where &lt;certificate location&gt; is either '{0}' or '{1}'.</value>
</data>
<data name="TCE_NullCertificatePath_Unix" xml:space="preserve">
<value>Certificate path cannot be null. Use the following format: &lt;certificate location&gt;{1}&lt;certificate store&gt;{1}&lt;certificate thumbprint&gt;, where &lt;certificate location&gt; is '{0}'.</value>
</data>
<data name="TCE_NullCertificatePathSysErr" xml:space="preserve">
<value>Internal error. Certificate path cannot be null. Use the following format: &lt;certificate location&gt;{2}&lt;certificate store&gt;{2}&lt;certificate thumbprint&gt;, where &lt;certificate location&gt; is either '{0}' or '{1}'.</value>
</data>
<data name="TCE_NullCertificatePathSysErr_Unix" xml:space="preserve">
<value>Internal error. Certificate path cannot be null. Use the following format: &lt;certificate location&gt;{1}&lt;certificate store&gt;{1}&lt;certificate thumbprint&gt;, where &lt;certificate location&gt; is '{0}'.</value>
</data>
<data name="TCE_NullCspPath" xml:space="preserve">
<value>Column master key path cannot be null. Use the following format for a key stored in a Microsoft cryptographic service provider (CSP): &lt;CSP Provider Name&gt;{0}&lt;Key Identifier&gt;.</value>
</data>
Expand All @@ -4053,9 +4059,15 @@
<data name="TCE_InvalidCertificatePath" xml:space="preserve">
<value>Invalid certificate path: '{0}'. Use the following format: &lt;certificate location&gt;{3}&lt;certificate store&gt;{3}&lt;certificate thumbprint&gt;, where &lt;certificate location&gt; is either '{1}' or '{2}'.</value>
</data>
<data name="TCE_InvalidCertificatePath_Unix" xml:space="preserve">
<value>Invalid certificate path: '{0}'. Use the following format: &lt;certificate location&gt;{2}&lt;certificate store&gt;{2}&lt;certificate thumbprint&gt;, where &lt;certificate location&gt; is '{1}'.</value>
</data>
<data name="TCE_InvalidCertificatePathSysErr" xml:space="preserve">
<value>Internal error. Invalid certificate path: '{0}'. Use the following format: &lt;certificate location&gt;{3}&lt;certificate store&gt;{3}&lt;certificate thumbprint&gt;, where &lt;certificate location&gt; is either '{1}' or '{2}'.</value>
</data>
<data name="TCE_InvalidCertificatePathSysErr_Unix" xml:space="preserve">
<value>Internal error. Invalid certificate path: '{0}'. Use the following format: &lt;certificate location&gt;{2}&lt;certificate store&gt;{2}&lt;certificate thumbprint&gt;, where &lt;certificate location&gt; is '{1}'.</value>
</data>
<data name="TCE_InvalidCspPath" xml:space="preserve">
<value>Invalid column master key path: '{0}'. Use the following format for a key stored in a Microsoft cryptographic service provider (CSP): &lt;CSP Provider Name&gt;{1}&lt;Key Identifier&gt;.</value>
</data>
Expand Down
Loading
Loading