Intermediate MTLS certificates ignored by certificate authentication

[vurhanau]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

ASP.Net Core server fails to do certificate authentication when a client sends leaf + intermediate MTLS certs.
Error:

warn: Microsoft.AspNetCore.Authentication.Certificate.CertificateAuthenticationHandler[2]
      Certificate validation failed, subject was OID.2.5.4.45=abc, O=someorg, C=US. PartialChain One or more certificates required to validate this certificate cannot be found.

Server:

builder.WebHost.UseKestrel(kestrel =>
{
    kestrel.Listen(IPAddress.Any, port, listenOptions =>
    {
        listenOptions.UseHttps(new TlsHandshakeCallbackOptions
        {
            OnConnection = ctx => ValueTask.FromResult(
                new SslServerAuthenticationOptions
                {
                    ClientCertificateRequired = true,
                    RemoteCertificateValidationCallback = (_, cert, chain, _) => MyValidationCallback(cert, chain),
                    ServerCertificateContext = SslStreamCertificateContext.Create(leafCert, intermediateCerts, true),
                }),
        });
    });
});

Server authentication:

builder.Services.AddAuthentication(CertificateAuthenticationDefaults.AuthenticationScheme)
                .AddCertificate(opts =>
                {
                    opts.RevocationMode = X509RevocationMode.NoCheck;
                    opts.ChainTrustValidationMode = X509ChainTrustMode.CustomRootTrust;
                    opts.CustomTrustStore = GetX509Authorities(); // add root CA, intermediate CA is not available here - client sends it
                });

Client:

using HttpClient http = new(new SocketsHttpHandler()
{
    SslOptions = new SslClientAuthenticationOptions
    {
        RemoteCertificateValidationCallback = (_, cert, chain, _) => MyClientValidationCallback(cert, chain),
        ClientCertificateContext = SslStreamCertificateContext.Create(clientLeafCert, intermediateClientCerts, true),
    },
});

Microsoft.AspNetCore.Authentication.Certificate version is 8.0.1

Expected Behavior

Intermediate X509 client certs should be added to X509 chain to construct a proper CA chain.
Certificate authentication handler should validate client X509 leaf certificate successfully when all CA certs in the chain.

Steps To Reproduce

No response

Exceptions (if any)

No response

.NET Version

8.0.100

Anything else?

No response

[mkArtakMSFT]

Thanks for contacting us. Have you tried this: #48099 ?
If that doesn't help, please generate some test certificates and build a minimal repro project utilizing those certs and provide it so that we can investigate this.

[vurhanau]

Re-opening this issue with a simple project to demonstrate the issue: https://github.com/vurhanau/aspnetcore-certchain

CertificateAuthenticationHandler.BuildChain() method ignores certificate chain sent by the client.
There are cases when intermediate CA certificate is sent by the client and this certificate is not known by the server ahead of time.

@mkArtakMSFT let me know if anything else is needed to fix this.

[Tyrrx]

Intermediate certificates should be accessible in general not only during the Kestrel validation callback.
@mkArtakMSFT #48099 is not a viable solution. It is about disabling the chain building.