Use of Windows certificate store for authentication by JacobBarthelmeh · Pull Request #900 · wolfSSL/wolfssh

JacobBarthelmeh · 2026-03-25T12:38:01Z

No description provided.

Copilot

Pull request overview

This PR adds Windows Certificate Store integration to wolfSSH so host keys and client authentication keys can be sourced from the Windows cert store (including CI coverage on Windows).

Changes:

Add a Windows-only API to load a private key by locating a certificate in the Windows Certificate Store, and use CNG to sign during SSH handshakes/auth.
Extend cert manager plumbing and wolfsshd configuration to support system/user CA loading and cert-store-based host keys.
Update Windows build projects and add a GitHub Actions workflow to exercise file-vs-store interop permutations.

Reviewed changes

Copilot reviewed 22 out of 22 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
wolfssh/test.h	Prefer wolfCrypt Base16 when available; otherwise keep local Base16 decode helper.
wolfssh/ssh.h	Add `wolfSSH_CTX_UsePrivateKey_fromStore()` Windows-only public API.
wolfssh/internal.h	Add CTX private-key metadata for cert-store backed keys and internal helper prototypes.
wolfssh/certman.h	Expose cert-manager setter and Windows cert-store spec parser API.
src/ssh.c	Implement loading a CTX private key from the Windows Certificate Store.
src/internal.c	Add cert-store signing path (CNG) and cert-derived RSA public-key extraction for KEX/auth flows.
src/certman.c	Implement `wolfSSH_SetCertManager()` and `wolfSSH_ParseCertStoreSpec()`.
ide/winvs/wolfsshd/wolfsshd.vcxproj	Link against `crypt32`/`ncrypt` for cert-store features.
ide/winvs/wolfssh/wolfssh.vcxproj	Link against `crypt32`/`ncrypt` for cert-store features.
ide/winvs/wolfsftp-client/wolfsftp-client.vcxproj	Link against `crypt32`/`ncrypt` for cert-store features.
ide/winvs/unit-test/unit-test.vcxproj	Link against `crypt32`/`ncrypt` for cert-store features; normalize XML header.
ide/winvs/echoserver/echoserver.vcxproj	Link against `crypt32`/`ncrypt` for cert-store features.
ide/winvs/client/client.vcxproj	Link against `crypt32`/`ncrypt` for cert-store features.
ide/winvs/api-test/api-test.vcxproj	Link against `crypt32`/`ncrypt` for cert-store features; normalize XML header.
examples/sftpclient/sftpclient.c	Add `-W store:subject:flags` support for client key from Windows cert store.
examples/echoserver/echoserver.c	Add `-W` support for server host key from Windows cert store; skip key-file root search when using store.
examples/client/common.h	Declare helper functions for cert-store key loading/auth setup.
examples/client/common.c	Implement cert-store key loading wrapper + auth globals setup for x509v3 publickey auth.
apps/wolfsshd/wolfsshd.c	Add host-key-from-store support and optional system/user CA store loading into wolfSSH cert manager.
apps/wolfsshd/configuration.h	Add config getters for host-key store and Windows user-CA store options.
apps/wolfsshd/configuration.c	Add parsing/storage for new config directives and defaults.
.github/workflows/windows-cert-store-test.yml	Add Windows CI workflow to validate store/file combinations.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 21 out of 22 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 22 out of 23 changed files in this pull request and generated 9 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #900

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

Copilot

Pull request overview

Copilot reviewed 22 out of 23 changed files in this pull request and generated 8 comments.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #900

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

Copilot

Pull request overview

Copilot reviewed 25 out of 25 changed files in this pull request and generated 4 comments.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #900

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #900

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #900

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 5
5 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #900

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

…t store.

add Windows cert store test case make windows cert feature default disabled and simplify macro guard additional unit tests, advertise x509 and pubkey, use CN to match username, build check for WOLFSSL_SYS_CA_CERTS, fix for CM ref count additional build test, uniform enum name, fail on unkown cert store ecc curve, tie in of loading whole cert store for sys CA's

JacobBarthelmeh self-assigned this Mar 25, 2026

Copilot AI review requested due to automatic review settings March 25, 2026 12:38

Copilot started reviewing on behalf of JacobBarthelmeh March 25, 2026 12:39 View session

JacobBarthelmeh force-pushed the winSysCerts branch from bd1396d to ca912b0 Compare March 25, 2026 12:43

Copilot AI reviewed Mar 25, 2026

View reviewed changes

Comment thread src/internal.c Outdated

Comment thread src/certman.c

Comment thread src/certman.c

Comment thread wolfssh/internal.h Outdated

Comment thread src/ssh.c Outdated

Comment thread src/ssh.c Outdated

Comment thread src/ssh.c

Comment thread src/internal.c

Copilot AI review requested due to automatic review settings April 14, 2026 03:24

Copilot started reviewing on behalf of JacobBarthelmeh April 14, 2026 03:27 View session

Copilot AI reviewed Apr 14, 2026

View reviewed changes

Comment thread wolfssh/certman.h

Comment thread src/ssh.c Outdated

Comment thread src/ssh.c

Comment thread apps/wolfsshd/wolfsshd.c

Comment thread apps/wolfsshd/configuration.c

JacobBarthelmeh mentioned this pull request Apr 14, 2026

add windows certificate store documentation wolfSSL/documentation#261

Open

Copilot AI review requested due to automatic review settings April 14, 2026 16:30

JacobBarthelmeh force-pushed the winSysCerts branch from 66c8726 to b545c32 Compare April 14, 2026 16:30

Copilot AI reviewed Apr 14, 2026

View reviewed changes

Copilot started reviewing on behalf of JacobBarthelmeh April 14, 2026 17:09 View session

ejohnstown mentioned this pull request Jun 12, 2026

Add support for loading user CA certs from a configurable Windows cert store. #688

Closed

ejohnstown marked this pull request as draft June 25, 2026 17:23

JacobBarthelmeh force-pushed the winSysCerts branch from b545c32 to de28863 Compare July 2, 2026 05:38

JacobBarthelmeh requested a review from wolfSSL-Fenrir-bot July 2, 2026 05:39

JacobBarthelmeh force-pushed the winSysCerts branch from de28863 to 6b8a1ca Compare July 2, 2026 05:46

wolfSSL-Fenrir-bot reviewed Jul 2, 2026

View reviewed changes

JacobBarthelmeh requested review from Copilot and wolfSSL-Fenrir-bot July 2, 2026 07:21

Copilot started reviewing on behalf of JacobBarthelmeh July 2, 2026 07:22 View session

Copilot AI reviewed Jul 2, 2026

View reviewed changes

Comment thread src/internal.c Outdated

Comment thread src/ssh.c

Comment thread src/ssh.c

Comment thread wolfssh/internal.h Outdated

Comment thread src/internal.c

Comment thread src/internal.c

Comment thread src/internal.c

Comment thread src/internal.c

wolfSSL-Fenrir-bot reviewed Jul 2, 2026

View reviewed changes

JacobBarthelmeh marked this pull request as ready for review July 2, 2026 22:27

JacobBarthelmeh assigned wolfSSL-Bot and unassigned JacobBarthelmeh Jul 2, 2026

JacobBarthelmeh force-pushed the winSysCerts branch from 4d116bd to 7b7aff5 Compare July 6, 2026 22:39

ejohnstown requested changes Jul 6, 2026

View reviewed changes

Comment thread src/internal.c Outdated

Comment thread src/internal.c Outdated

JacobBarthelmeh marked this pull request as draft July 7, 2026 05:11

aidangarske unassigned wolfSSL-Bot Jul 9, 2026

JacobBarthelmeh marked this pull request as draft July 10, 2026 20:46

JacobBarthelmeh requested review from Copilot and wolfSSL-Fenrir-bot July 10, 2026 23:32

Copilot started reviewing on behalf of JacobBarthelmeh July 10, 2026 23:38 View session

Copilot AI reviewed Jul 10, 2026

View reviewed changes

Comment thread apps/wolfsshd/configuration.c Outdated

Comment thread src/internal.c

Comment thread src/certman.c

Comment thread apps/wolfsshd/wolfsshd.c

wolfSSL-Fenrir-bot reviewed Jul 10, 2026

View reviewed changes

JacobBarthelmeh force-pushed the winSysCerts branch 3 times, most recently from 8dff9ae to d8cb047 Compare July 21, 2026 22:29

JacobBarthelmeh requested a review from wolfSSL-Fenrir-bot July 21, 2026 22:32

wolfSSL-Fenrir-bot reviewed Jul 21, 2026

View reviewed changes

JacobBarthelmeh force-pushed the winSysCerts branch from d8cb047 to 692099c Compare July 22, 2026 21:52

JacobBarthelmeh requested a review from wolfSSL-Fenrir-bot July 22, 2026 21:54

wolfSSL-Fenrir-bot reviewed Jul 22, 2026

View reviewed changes

JacobBarthelmeh force-pushed the winSysCerts branch from 692099c to 38297a0 Compare July 23, 2026 16:53

JacobBarthelmeh requested review from Copilot and wolfSSL-Fenrir-bot July 23, 2026 16:54

Copilot AI reviewed Jul 23, 2026

wolfSSL-Fenrir-bot reviewed Jul 23, 2026

View reviewed changes

Comment thread apps/wolfsshd/auth.c

Comment thread apps/wolfsshd/wolfsshd.c

JacobBarthelmeh marked this pull request as ready for review July 23, 2026 17:56

JacobBarthelmeh requested a review from aidangarske July 23, 2026 17:56

JacobBarthelmeh assigned aidangarske and unassigned JacobBarthelmeh Jul 23, 2026

JacobBarthelmeh and others added 5 commits July 24, 2026 15:21

add TrustedSystemCAKeys sshd option for system CA load

69fc23a

add macro guard for system ca certs load

41d4d7d

Add support for loading user CA certs from a configurable Windows cer…

f32359d

…t store.

Prefix wolfSSH specific options with wolfSSH_.

6c36285

JacobBarthelmeh force-pushed the winSysCerts branch from 38297a0 to 7dc6ac4 Compare July 24, 2026 21:21

Uh oh!

Conversation

JacobBarthelmeh commented Mar 25, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #900

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #900

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #900

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #900

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #900