FluentCertificates.Builder 0.5.0

📖 FluentCertificates Overview

⚠️ Note: while version numbers are v0.x.y, this software is under initial development and there'll be breaking-changes in its API from version to version.

FluentCertificates is a library using the Immutable Fluent Builder pattern for easily creating, finding and exporting certificates. Makes it simple to generate your own certificate chains, or just stand-alone self-signed certificates.

This project is published in three NuGet packages:

• FluentCertificates: Just brings in both the FluentCertificates.Builder and FluentCertificates.Finder packages.
• FluentCertificates.Builder: Provides CertificateBuilder for building certificates and also includes a bunch of convenient extension-methods. Examples below
• FluentCertificates.Finder: Provides CertificateFinder for finding certificates across a collection of X509Stores. Examples below

Unfortunately documentation is incomplete. You may find more examples within the project's unit tests.

CertificateBuilder examples

Create a CertificateRequest for signing, exporting and passing to a 3rd party CA:

var request = new CertificateBuilder()
    .SetUsage(CertificateUsage.Server)
    .SetSubject(b => b.SetCommonName("*.fake.domain"))
    .SetDnsNames("*.fake.domain", "fake.domain")
    .ToCertificateRequest();

Build a self-signed web server certificate:

//Using a fluent style
var cert = new CertificateBuilder()
    .SetUsage(CertificateUsage.Server)
    .SetFriendlyName("Example self-signed web-server certificate")
    .SetSubject(b => b.SetCommonName("*.fake.domain"))
    .SetDnsNames("*.fake.domain", "fake.domain")
    .SetNotAfter(DateTimeOffset.UtcNow.AddMonths(1))
    .Build();

//And just to demonstrate using object initializers (I'll use fluent style from now on though)
var builder = new CertificateBuilder() {
    Usage = CertificateUsage.Server,
    FriendlyName = "Example self-signed web-server certificate",
    Subject = new X500NameBuilder().SetCommonName("*.fake.domain"),
    DnsNames = new[] { "*.fake.domain", "fake.domain" },
    NotAfter = DateTimeOffset.UtcNow.AddMonths(1)
};
var cert = builder.Build();

Build a CA (certificate authority):

//A CA's expiry date must be later than that of any certificates it will issue
var issuer = new CertificateBuilder()
    .SetUsage(CertificateUsage.CA)
    .SetFriendlyName("Example root CA")
    .SetSubject(b => b.SetCommonName("Example root CA"))
    .SetNotAfter(DateTimeOffset.UtcNow.AddYears(100))
    .Build();

Build a client-auth certificate signed by a CA:

//Note: the 'issuer' certificate used must have a private-key attached in order to sign this new certificate
var cert = new CertificateBuilder()
    .SetUsage(CertificateUsage.Client)
    .SetFriendlyName("Example client-auth certificate")
    .SetSubject(b => b.SetCommonName("User: Michael"))
    .SetNotAfter(DateTimeOffset.UtcNow.AddYears(1))
    .SetIssuer(issuer)
    .Build();

Advanced: Build a certificate with customized extensions:

var cert = new CertificateBuilder()
    .SetFriendlyName("Example certificate with customized extensions")
    .SetSubject(b => b.SetCommonName("Example certificate with customized extensions"))
    .AddExtension(new X509BasicConstraintsExtension(false, false, 0, true))
    .AddExtension(new X509KeyUsageExtension(X509KeyUsageFlags.DigitalSignature | X509KeyUsageFlags.KeyEncipherment | X509KeyUsageFlags.DataEncipherment, true))
    .AddExtension(new X509EnhancedKeyUsageExtension(new OidCollection { new(KeyPurposeID.AnyExtendedKeyUsage.Id) }, false))
    .SetIssuer(issuer)
    .Build();

CertificateFinder examples

TODO: document this

X500NameBuilder examples

TODO: document this; see unit tests for more examples

X509Certificate2 extension-methods

TODO: document this; see unit tests for more examples

X509Certificate2Collection extension-methods

TODO: document this |Extension-Method|Description| |-|-| |ToEnumerable|| |ExportAsPkcs7|| |ExportAsPkcs12|| |ExportAsPem|| |ToPemString||

IEnumerable<X509Certificate2> extension-methods

TODO: document this |Extension-Method|Description| |-|-| |ToCollection|| |FilterPrivateKeys|| |ExportAsPkcs7|| |ExportAsPkcs12|| |ExportAsPem|| |ToPemString||

X509Chain extension-methods

TODO: document this |Extension-Method|Description| |-|-| |ToCollection|| |ToEnumerable|| |ExportAsPkcs7|| |ExportAsPkcs12|| |ExportAsPem|| |ToPemString||

X509Extension extension-methods

CertificateRequest extension-methods