Use of Windows certificate store for authentication by JacobBarthelmeh · Pull Request #900 · wolfSSL/wolfssh

JacobBarthelmeh · 2026-03-25T12:38:01Z

No description provided.

Copilot

Pull request overview

This PR adds Windows Certificate Store integration to wolfSSH so host keys and client authentication keys can be sourced from the Windows cert store (including CI coverage on Windows).

Changes:

Add a Windows-only API to load a private key by locating a certificate in the Windows Certificate Store, and use CNG to sign during SSH handshakes/auth.
Extend cert manager plumbing and wolfsshd configuration to support system/user CA loading and cert-store-based host keys.
Update Windows build projects and add a GitHub Actions workflow to exercise file-vs-store interop permutations.

Reviewed changes

Copilot reviewed 22 out of 22 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
wolfssh/test.h	Prefer wolfCrypt Base16 when available; otherwise keep local Base16 decode helper.
wolfssh/ssh.h	Add `wolfSSH_CTX_UsePrivateKey_fromStore()` Windows-only public API.
wolfssh/internal.h	Add CTX private-key metadata for cert-store backed keys and internal helper prototypes.
wolfssh/certman.h	Expose cert-manager setter and Windows cert-store spec parser API.
src/ssh.c	Implement loading a CTX private key from the Windows Certificate Store.
src/internal.c	Add cert-store signing path (CNG) and cert-derived RSA public-key extraction for KEX/auth flows.
src/certman.c	Implement `wolfSSH_SetCertManager()` and `wolfSSH_ParseCertStoreSpec()`.
ide/winvs/wolfsshd/wolfsshd.vcxproj	Link against `crypt32`/`ncrypt` for cert-store features.
ide/winvs/wolfssh/wolfssh.vcxproj	Link against `crypt32`/`ncrypt` for cert-store features.
ide/winvs/wolfsftp-client/wolfsftp-client.vcxproj	Link against `crypt32`/`ncrypt` for cert-store features.
ide/winvs/unit-test/unit-test.vcxproj	Link against `crypt32`/`ncrypt` for cert-store features; normalize XML header.
ide/winvs/echoserver/echoserver.vcxproj	Link against `crypt32`/`ncrypt` for cert-store features.
ide/winvs/client/client.vcxproj	Link against `crypt32`/`ncrypt` for cert-store features.
ide/winvs/api-test/api-test.vcxproj	Link against `crypt32`/`ncrypt` for cert-store features; normalize XML header.
examples/sftpclient/sftpclient.c	Add `-W store:subject:flags` support for client key from Windows cert store.
examples/echoserver/echoserver.c	Add `-W` support for server host key from Windows cert store; skip key-file root search when using store.
examples/client/common.h	Declare helper functions for cert-store key loading/auth setup.
examples/client/common.c	Implement cert-store key loading wrapper + auth globals setup for x509v3 publickey auth.
apps/wolfsshd/wolfsshd.c	Add host-key-from-store support and optional system/user CA store loading into wolfSSH cert manager.
apps/wolfsshd/configuration.h	Add config getters for host-key store and Windows user-CA store options.
apps/wolfsshd/configuration.c	Add parsing/storage for new config directives and defaults.
.github/workflows/windows-cert-store-test.yml	Add Windows CI workflow to validate store/file combinations.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 21 out of 22 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 22 out of 23 changed files in this pull request and generated 9 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #900

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

Copilot

Pull request overview

Copilot reviewed 22 out of 23 changed files in this pull request and generated 8 comments.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #900

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

…t store.

add Windows cert store test case add windows build link with ncrypt for cert store use make windows cert feature default disabled and simplify macro guard

…ith cert store search

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #900

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

Copilot

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated no new comments.

…with store cert

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #900

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

Copilot

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated 2 comments.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #900

Scan targets checked: wolfssh-src
Failed targets: wolfssh-bugs

⚠️ Review incomplete — one or more scan targets failed before findings could be produced. See the Fenrir PR review detail page for logs.

JacobBarthelmeh self-assigned this Mar 25, 2026

Copilot AI review requested due to automatic review settings March 25, 2026 12:38

Copilot started reviewing on behalf of JacobBarthelmeh March 25, 2026 12:39 View session

JacobBarthelmeh force-pushed the winSysCerts branch from bd1396d to ca912b0 Compare March 25, 2026 12:43

Copilot AI reviewed Mar 25, 2026

View reviewed changes

Comment thread src/internal.c Outdated

Comment thread src/certman.c

Comment thread src/certman.c

Comment thread wolfssh/internal.h Outdated

Comment thread src/ssh.c Outdated

Comment thread src/ssh.c

Comment thread src/ssh.c

Comment thread src/internal.c

Copilot AI review requested due to automatic review settings April 14, 2026 03:24

Copilot started reviewing on behalf of JacobBarthelmeh April 14, 2026 03:27 View session

Copilot AI reviewed Apr 14, 2026

View reviewed changes

Comment thread wolfssh/certman.h

Comment thread src/ssh.c Outdated

Comment thread src/ssh.c

Comment thread apps/wolfsshd/wolfsshd.c

Comment thread apps/wolfsshd/configuration.c

JacobBarthelmeh mentioned this pull request Apr 14, 2026

add windows certificate store documentation wolfSSL/documentation#261

Open

Copilot AI review requested due to automatic review settings April 14, 2026 16:30

JacobBarthelmeh force-pushed the winSysCerts branch from 66c8726 to b545c32 Compare April 14, 2026 16:30

Copilot AI reviewed Apr 14, 2026

View reviewed changes

Copilot started reviewing on behalf of JacobBarthelmeh April 14, 2026 17:09 View session

ejohnstown mentioned this pull request Jun 12, 2026

Add support for loading user CA certs from a configurable Windows cert store. #688

Closed

ejohnstown marked this pull request as draft June 25, 2026 17:23

JacobBarthelmeh force-pushed the winSysCerts branch from b545c32 to de28863 Compare July 2, 2026 05:38

JacobBarthelmeh requested a review from wolfSSL-Fenrir-bot July 2, 2026 05:39

JacobBarthelmeh force-pushed the winSysCerts branch from de28863 to 6b8a1ca Compare July 2, 2026 05:46

wolfSSL-Fenrir-bot reviewed Jul 2, 2026

View reviewed changes

JacobBarthelmeh requested review from Copilot and wolfSSL-Fenrir-bot July 2, 2026 07:21

Copilot started reviewing on behalf of JacobBarthelmeh July 2, 2026 07:22 View session

Copilot AI reviewed Jul 2, 2026

View reviewed changes

Comment thread src/internal.c Outdated

Comment thread src/ssh.c

Comment thread src/ssh.c

Comment thread wolfssh/internal.h Outdated

Comment thread src/internal.c

Comment thread src/internal.c

Comment thread src/internal.c

Comment thread src/internal.c

wolfSSL-Fenrir-bot reviewed Jul 2, 2026

View reviewed changes

JacobBarthelmeh marked this pull request as ready for review July 2, 2026 22:27

JacobBarthelmeh assigned wolfSSL-Bot and unassigned JacobBarthelmeh Jul 2, 2026

JacobBarthelmeh and others added 3 commits July 6, 2026 16:18

add TrustedSystemCAKeys sshd option for system CA load

4b679ef

add macro guard for system ca certs load

fccb41f

Add support for loading user CA certs from a configurable Windows cer…

227e6da

…t store.

kareem-wolfssl and others added 4 commits July 6, 2026 16:18

Prefix wolfSSH specific options with wolfSSH_.

225517e

add Windows cert store use with signing and add example arguments

b700995

add Windows cert store test case add windows build link with ncrypt for cert store use make windows cert feature default disabled and simplify macro guard

use word32 type instead of DWORD and fix for memory management

7b4b61f

remove legacy support and address review items

7b7aff5

JacobBarthelmeh force-pushed the winSysCerts branch from 4d116bd to 7b7aff5 Compare July 6, 2026 22:39

ejohnstown requested changes Jul 6, 2026

View reviewed changes

Comment thread src/internal.c Outdated

Comment thread src/internal.c Outdated

JacobBarthelmeh marked this pull request as draft July 7, 2026 05:11

JacobBarthelmeh added 2 commits July 6, 2026 23:13

refactor of get r/s from ecc cert, harden find cert by id, match CN w…

0348664

…ith cert store search

trim down CI test for windows cert store

f4b5a9b

ejohnstown self-requested a review July 7, 2026 19:04

ejohnstown previously approved these changes Jul 7, 2026

View reviewed changes

ejohnstown requested review from Copilot and wolfSSL-Fenrir-bot July 7, 2026 19:13

Copilot started reviewing on behalf of ejohnstown July 7, 2026 19:24 View session

wolfSSL-Fenrir-bot reviewed Jul 7, 2026

View reviewed changes

Copilot AI reviewed Jul 7, 2026

View reviewed changes

remove unused macros and added a hardening sanity check on RSA sigSz …

7e43eba

…with store cert

JacobBarthelmeh dismissed ejohnstown’s stale review via 7e43eba July 7, 2026 19:58

JacobBarthelmeh requested a review from wolfSSL-Fenrir-bot July 7, 2026 19:58

wolfSSL-Fenrir-bot reviewed Jul 7, 2026

View reviewed changes

add check on return value for CreateString

78a78df

JacobBarthelmeh requested review from Copilot and wolfSSL-Fenrir-bot July 7, 2026 20:33

Copilot started reviewing on behalf of JacobBarthelmeh July 7, 2026 20:35 View session

Copilot AI reviewed Jul 7, 2026

View reviewed changes

Comment thread configure.ac

Comment thread src/ssh.c

wolfSSL-Fenrir-bot reviewed Jul 7, 2026

View reviewed changes

dgarske marked this pull request as ready for review July 7, 2026 21:42

Uh oh!

Conversation

JacobBarthelmeh commented Mar 25, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #900

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #900

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #900

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #900

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment