Skip to content
Back

IDeviceCertificateAuthority

Interface in Oadm.Sdk.Certificates · Oadm.Sdk.dll

The OADM CA, offered by the PKI plugin through IPluginServices: one CA signs every device certificate. Keys RSA 2048 or more, or EC P-256 or more; requests signed with SHA-1 or MD5 are refused.

public interface IDeviceCertificateAuthority

Properties

Section titled “Properties”

Authorities

Section titled “Authorities”
IReadOnlyList<CertificateAuthorityInfo> Authorities { get; }

Default implementation

Every CA PKI holds (docs/spec/pki.md, SDK 0.4.0): the current OADM CA, previous ones, the Axis device ID and imported CAs. Services select from it by CertificateAuthorityInfo.Id (stable across restarts). Changes raise IDeviceCertificateAuthority.Changed. Default: none.

Chain

Section titled “Chain”
IReadOnlyList<byte[]> Chain { get; }

The CA certificate and the certificates above it, DER, issuing CA first; empty without a CA.

IsReady

Section titled “IsReady”
bool IsReady { get; }

A CA with its private key exists, so IDeviceCertificateAuthority.SignAsync can sign.

PreviousChains

Section titled “PreviousChains”
IReadOnlyList<IReadOnlyList<byte[]>> PreviousChains { get; }

Default implementation

The previous OADM CAs (replaced, kept while their device certificates may still be valid), newest first: each one as DER, the CA certificate first, then the certificates above it. A server that checks device certificates (the 802.1X server) trusts them next to IDeviceCertificateAuthority.Chain. They change when a CA is replaced or a previous one removed: read them again after IDeviceCertificateAuthority.Changed and now and then. Default: none.

Revocations

Section titled “Revocations”
IReadOnlyList<CertificateRevocation> Revocations { get; }

Default implementation

The revocation list: revoked certificates that could still be valid, newest first.

Methods

Section titled “Methods”

FindRevocation

Section titled “FindRevocation”
CertificateRevocation? FindRevocation(string serialNumber)

Default implementation

The revocation of serialNumber, null when it is not revoked (for the refusal’s text).

GetIssuedCertificateAsync

Section titled “GetIssuedCertificateAsync”
Task<byte[]?> GetIssuedCertificateAsync(string serialNumber, CancellationToken ct)

Default implementation

The certificate (DER) with serialNumber when the list holds it; null otherwise.

IsRevoked

Section titled “IsRevoked”
bool IsRevoked(string serialNumber)

Default implementation

True when the certificate with serialNumber is on the revocation list (any notation, see CertificateSerials.Normalize). A hash lookup in memory: ask it for every authentication or renewal. Default (a CA without a list): false.

ListIssuedAsync

Section titled “ListIssuedAsync”
Task<IssuedCertificatePage> ListIssuedAsync(IssuedCertificateQuery query, CancellationToken ct)

Default implementation

One page of the list of issued certificates (filters, search, newest first). Default: an empty page.

PurposeOf

Section titled “PurposeOf”
string? PurposeOf(string serialNumber)

Default implementation

The use (DeviceCertificatePurposes) of the certificate with serialNumber when the list of issued certificates holds it (any notation), null when it does not. A lookup in memory: ask it for every authentication (the 802.1X server refuses a listed certificate of another use). Default (a CA without a list): null.

RevokeAsync

Section titled “RevokeAsync”
Task<RevokeResult> RevokeAsync(IReadOnlyCollection<string> serialNumbers, RevocationReason reason, string userName, CancellationToken ct)

Default implementation

Puts the certificates on the revocation list (no undo; only for users with all devices: the caller checks). Expired ones are counted, never added; a serial the list does not hold (a certificate of the CA from before the list) is added without a device. Raises IDeviceCertificateAuthority.RevocationChanged once. Default: not supported.

SetUsedBy

Section titled “SetUsedBy”
void SetUsedBy(string serviceId, string serviceName, IReadOnlyCollection<string> authorityIds)

Default implementation

Tells PKI which of its CAs serviceName (shown as “Used by”) uses now; an empty list clears it. PKI refuses to remove a CA a service uses. Default: nothing.

SignAsync

Section titled “SignAsync”
Task<IssuedDeviceCertificate> SignAsync(DeviceCertificateRequest request, CancellationToken ct)

Signs a request. Throws CertificateRequestRefusedException with a plain reason. A certificate with a DeviceCertificateRequest.DeviceId goes into the list of issued certificates.

Events

Section titled “Events”

Changed

Section titled “Changed”
event EventHandler? Changed

Raised after the CA was generated, imported or replaced. Runs on a server thread; keep it short.

RevocationChanged

Section titled “RevocationChanged”
event EventHandler? RevocationChanged

Default implementation

Raised after certificates were revoked or left the revocation list. Runs on a server thread; keep it short. The event belongs to this offer: subscribe again when IPluginServices.Find returns another instance (PKI restarted), and ask IDeviceCertificateAuthority.IsRevoked of the current offer.