Use of Windows certificate store for authentication by JacobBarthelmeh · Pull Request #900 · wolfSSL/wolfssh

JacobBarthelmeh · 2026-03-25T12:38:01Z

No description provided.

Copilot

Pull request overview

This PR adds Windows Certificate Store integration to wolfSSH so host keys and client authentication keys can be sourced from the Windows cert store (including CI coverage on Windows).

Changes:

Add a Windows-only API to load a private key by locating a certificate in the Windows Certificate Store, and use CNG to sign during SSH handshakes/auth.
Extend cert manager plumbing and wolfsshd configuration to support system/user CA loading and cert-store-based host keys.
Update Windows build projects and add a GitHub Actions workflow to exercise file-vs-store interop permutations.

Reviewed changes

Copilot reviewed 22 out of 22 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
wolfssh/test.h	Prefer wolfCrypt Base16 when available; otherwise keep local Base16 decode helper.
wolfssh/ssh.h	Add `wolfSSH_CTX_UsePrivateKey_fromStore()` Windows-only public API.
wolfssh/internal.h	Add CTX private-key metadata for cert-store backed keys and internal helper prototypes.
wolfssh/certman.h	Expose cert-manager setter and Windows cert-store spec parser API.
src/ssh.c	Implement loading a CTX private key from the Windows Certificate Store.
src/internal.c	Add cert-store signing path (CNG) and cert-derived RSA public-key extraction for KEX/auth flows.
src/certman.c	Implement `wolfSSH_SetCertManager()` and `wolfSSH_ParseCertStoreSpec()`.
ide/winvs/wolfsshd/wolfsshd.vcxproj	Link against `crypt32`/`ncrypt` for cert-store features.
ide/winvs/wolfssh/wolfssh.vcxproj	Link against `crypt32`/`ncrypt` for cert-store features.
ide/winvs/wolfsftp-client/wolfsftp-client.vcxproj	Link against `crypt32`/`ncrypt` for cert-store features.
ide/winvs/unit-test/unit-test.vcxproj	Link against `crypt32`/`ncrypt` for cert-store features; normalize XML header.
ide/winvs/echoserver/echoserver.vcxproj	Link against `crypt32`/`ncrypt` for cert-store features.
ide/winvs/client/client.vcxproj	Link against `crypt32`/`ncrypt` for cert-store features.
ide/winvs/api-test/api-test.vcxproj	Link against `crypt32`/`ncrypt` for cert-store features; normalize XML header.
examples/sftpclient/sftpclient.c	Add `-W store:subject:flags` support for client key from Windows cert store.
examples/echoserver/echoserver.c	Add `-W` support for server host key from Windows cert store; skip key-file root search when using store.
examples/client/common.h	Declare helper functions for cert-store key loading/auth setup.
examples/client/common.c	Implement cert-store key loading wrapper + auth globals setup for x509v3 publickey auth.
apps/wolfsshd/wolfsshd.c	Add host-key-from-store support and optional system/user CA store loading into wolfSSH cert manager.
apps/wolfsshd/configuration.h	Add config getters for host-key store and Windows user-CA store options.
apps/wolfsshd/configuration.c	Add parsing/storage for new config directives and defaults.
.github/workflows/windows-cert-store-test.yml	Add Windows CI workflow to validate store/file combinations.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 21 out of 22 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 22 out of 23 changed files in this pull request and generated 9 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #900

Scan targets checked:wolfssh-bugs, wolfssh-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

Copilot

Pull request overview

Copilot reviewed 22 out of 23 changed files in this pull request and generated 8 comments.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #900

Scan targets checked:wolfssh-bugs, wolfssh-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #900

Scan targets checked:wolfssh-bugs, wolfssh-src

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #900

Scan targets checked:wolfssh-bugs, wolfssh-src

Findings: 5
5 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #900

Scan targets checked:wolfssh-bugs, wolfssh-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

aidangarske

Skoll Multi-Scan Review

Modes:review + review-security + bugsOverall recommendation:REQUEST_CHANGES
Findings: 13 total — 13 posted, 0 skipped

Posted findings

[High] [review+review-security+bugs] Unknown or undecodable ECC curves are silently registered as P-256 — src/ssh.c:3106-3121
[High] [bugs+review] Certificate-store keys can advertise algorithms excluded from the build — src/ssh.c:3075-3105
[High] [review+bugs] Switching between TPM and certificate-store keys leaves both backends active — src/ssh.c:2981-3017
[High] [review+review-security+bugs] Windows certificate-store libraries are missing from most Visual Studio configurations — ide/winvs/wolfsshd/wolfsshd.vcxproj:245-459
[High] [review-security] Match blocks cannot restrict the new CA trust sources — apps/wolfsshd/configuration.c:1348-1372
[High] [review] Certificate CN matching conflicts with case-insensitive Windows account names — apps/wolfsshd/auth.c:1792-1797
[Medium] [review+review-security] Unsupported certificate-store provider is accepted and then silently ignored — apps/wolfsshd/wolfsshd.c:383-429
[Medium] [review-security] Raw numeric location flags can trigger destructive certificate-store operations — src/certman.c:724-739
[Medium] [review] Cert-store authentication leaves the shared client private-key pointer in an invalid reusable state — examples/client/common.c:1261-1263
[Medium] [review] The workflow never exercises the X.509 host-key slot — .github/workflows/windows-cert-store-test.yml:522-545
[Medium] [bugs] HostKeyStoreSubject cannot contain whitespace — apps/wolfsshd/configuration.c:1384-1389
[Low] [review-security] CN lookup selects an arbitrary certificate when renewals share a subject — src/ssh.c:2867-2897
[Low] [review-security] Configure accepts Cygwin even though the headers reject it — configure.ac:290-296

Review generated by Skoll

…t store.

add Windows cert store test case make windows cert feature default disabled and simplify macro guard additional unit tests, advertise x509 and pubkey, use CN to match username, build check for WOLFSSL_SYS_CA_CERTS, fix for CM ref count additional build test, uniform enum name, fail on unkown cert store ecc curve, tie in of loading whole cert store for sys CA's

…case sensitive name match

…nged default from MY to required to be set

…dead code adjustments

JacobBarthelmeh self-assigned this Mar 25, 2026

CopilotAI review requested due to automatic review settings March 25, 2026 12:38

Copilotstarted reviewing on behalf of JacobBarthelmeh March 25, 2026 12:39 View session

JacobBarthelmeh force-pushed the winSysCerts branch from bd1396d to ca912b0Compare March 25, 2026 12:43

CopilotAI reviewed Mar 25, 2026
View reviewed changes

Comment threadsrc/internal.c Outdated
Comment threadsrc/certman.c
Comment threadsrc/certman.c
Comment threadwolfssh/internal.h Outdated
Comment threadsrc/ssh.c Outdated
Comment threadsrc/ssh.c Outdated
Comment threadsrc/ssh.c Outdated
Comment threadsrc/internal.c

CopilotAI review requested due to automatic review settings April 14, 2026 03:24

Copilotstarted reviewing on behalf of JacobBarthelmeh April 14, 2026 03:27 View session

CopilotAI reviewed Apr 14, 2026
View reviewed changes

Comment threadwolfssh/certman.h
Comment threadsrc/ssh.c Outdated
Comment threadsrc/ssh.c
Comment threadapps/wolfsshd/wolfsshd.c
Comment threadapps/wolfsshd/configuration.c

JacobBarthelmeh mentioned this pull request Apr 14, 2026
add windows certificate store documentation wolfSSL/documentation#261
Open

CopilotAI review requested due to automatic review settings April 14, 2026 16:30

JacobBarthelmeh force-pushed the winSysCerts branch from 66c8726 to b545c32Compare April 14, 2026 16:30

CopilotAI reviewed Apr 14, 2026
View reviewed changes

Copilotstarted reviewing on behalf of JacobBarthelmeh April 14, 2026 17:09 View session

ejohnstown mentioned this pull request Jun 12, 2026
Add support for loading user CA certs from a configurable Windows cert store. #688
Closed

ejohnstown marked this pull request as draft June 25, 2026 17:23

JacobBarthelmeh force-pushed the winSysCerts branch from b545c32 to de28863Compare July 2, 2026 05:38

JacobBarthelmeh requested a review from wolfSSL-Fenrir-bot July 2, 2026 05:39

JacobBarthelmeh force-pushed the winSysCerts branch from de28863 to 6b8a1caCompare July 2, 2026 05:46

wolfSSL-Fenrir-bot reviewed Jul 2, 2026
View reviewed changes

JacobBarthelmeh requested review from Copilot and wolfSSL-Fenrir-bot July 2, 2026 07:21

Copilotstarted reviewing on behalf of JacobBarthelmeh July 2, 2026 07:22 View session

CopilotAI reviewed Jul 2, 2026
View reviewed changes

Comment threadsrc/internal.c Outdated
Comment threadsrc/ssh.c Outdated
Comment threadsrc/ssh.c
Comment threadwolfssh/internal.h Outdated
Comment threadsrc/internal.c
Comment threadsrc/internal.c
Comment threadsrc/internal.c Outdated
Comment threadsrc/internal.c Outdated

wolfSSL-Fenrir-bot reviewed Jul 2, 2026
View reviewed changes

JacobBarthelmeh marked this pull request as ready for review July 2, 2026 22:27

JacobBarthelmeh assigned wolfSSL-Bot and unassigned JacobBarthelmeh Jul 2, 2026

JacobBarthelmeh force-pushed the winSysCerts branch from 4d116bd to 7b7aff5Compare July 6, 2026 22:39

ejohnstown requested changes Jul 6, 2026
View reviewed changes

Comment threadsrc/internal.c Outdated
Comment threadsrc/internal.c Outdated

JacobBarthelmeh marked this pull request as draft July 7, 2026 05:11

wolfSSL-Fenrir-bot reviewed Jul 21, 2026
View reviewed changes

JacobBarthelmeh force-pushed the winSysCerts branch from d8cb047 to 692099cCompare July 22, 2026 21:52

JacobBarthelmeh requested a review from wolfSSL-Fenrir-bot July 22, 2026 21:54

wolfSSL-Fenrir-bot reviewed Jul 22, 2026
View reviewed changes

JacobBarthelmeh force-pushed the winSysCerts branch from 692099c to 38297a0Compare July 23, 2026 16:53

JacobBarthelmeh requested review from Copilot and wolfSSL-Fenrir-bot July 23, 2026 16:54

CopilotAI reviewed Jul 23, 2026

wolfSSL-Fenrir-bot reviewed Jul 23, 2026
View reviewed changes

Comment threadapps/wolfsshd/auth.c Outdated
Comment threadapps/wolfsshd/wolfsshd.c Outdated

JacobBarthelmeh marked this pull request as ready for review July 23, 2026 17:56

JacobBarthelmeh requested a review from aidangarske July 23, 2026 17:56

JacobBarthelmeh assigned aidangarske and unassigned JacobBarthelmeh Jul 23, 2026

JacobBarthelmeh force-pushed the winSysCerts branch from 38297a0 to 7dc6ac4Compare July 24, 2026 21:21

aidangarske reviewed Jul 27, 2026
View reviewed changes

JacobBarthelmehand others added 6 commits August 3, 2026 23:11

add TrustedSystemCAKeys sshd option for system CA load
255bb94

add macro guard for system ca certs load
58705cc

Add support for loading user CA certs from a configurable Windows cer…
51468f5
…t store.

Prefix wolfSSH specific options with wolfSSH_.
febb79a

reset of tpm flag, handling of duplicate expiered cert in store, non-…
e8297ac
…case sensitive name match

JacobBarthelmeh force-pushed the winSysCerts branch from eb03207 to e8297acCompare August 4, 2026 05:22

JacobBarthelmeh marked this pull request as draft August 4, 2026 05:30

JacobBarthelmeh added 3 commits August 4, 2026 09:25

fix for flags handling, ocsp case, macro guards, unused variable, cha…
d26a556
…nged default from MY to required to be set

enable SHA1 with windows cert store test case
51629a7

refactoring, expand test cases, adjust to authorized key file, minor …
cca116e
…dead code adjustments

JacobBarthelmeh force-pushed the winSysCerts branch from 18ca6b5 to cca116eCompare August 5, 2026 03:46

expanding test cases and minor refactors
97482a2

JacobBarthelmeh assigned JacobBarthelmeh and unassigned aidangarske Aug 5, 2026

Uh oh!

Conversation

JacobBarthelmeh commented Mar 25, 2026

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #900

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #900

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #900

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #900

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #900

Uh oh!

Uh oh!

Uh oh!

aidangarske left a comment

Choose a reason for hiding this comment