FluentCertificates.Builder 0.5.2

📖 FluentCertificates Overview

⚠️ Note: while version numbers are v0.x.y, this software is under initial development and there'll be breaking-changes in its API from version to version.

FluentCertificates is a library using the Immutable Fluent Builder pattern for easily creating, finding and exporting certificates. Makes it simple to generate your own certificate chains, or just stand-alone self-signed certificates.

This project is published in three NuGet packages:

• FluentCertificates: Just brings in both the FluentCertificates.Builder and FluentCertificates.Finder packages.
• FluentCertificates.Builder: Provides CertificateBuilder for building certificates and also includes a bunch of convenient extension-methods. Examples below
• FluentCertificates.Finder: Provides CertificateFinder for finding certificates across a collection of X509Stores. Examples below

Unfortunately documentation is incomplete. You may find more examples within the project's unit tests.

CertificateBuilder examples

CertificateBuilder requires the FluentCertificates.Builder package and is found under the FluentCertificates namespace.

Create a CertificateRequest for signing, exporting and passing to a 3rd party CA:

var request = new CertificateBuilder()
    .SetUsage(CertificateUsage.Server)
    .SetSubject(b => b.SetCommonName("*.fake.domain"))
    .SetDnsNames("*.fake.domain", "fake.domain")
    .ToCertificateRequest();

Build a self-signed web server certificate:

//Using a fluent style
var cert = new CertificateBuilder()
    .SetUsage(CertificateUsage.Server)
    .SetFriendlyName("Example self-signed web-server certificate")
    .SetSubject(b => b.SetCommonName("*.fake.domain"))
    .SetDnsNames("*.fake.domain", "fake.domain")
    .SetNotAfter(DateTimeOffset.UtcNow.AddMonths(1))
    .Build();

//And just to demonstrate using object initializers (I'll use fluent style from now on though)
var builder = new CertificateBuilder() {
    Usage = CertificateUsage.Server,
    FriendlyName = "Example self-signed web-server certificate",
    Subject = new X500NameBuilder().SetCommonName("*.fake.domain"),
    DnsNames = new[] { "*.fake.domain", "fake.domain" },
    NotAfter = DateTimeOffset.UtcNow.AddMonths(1)
};
var cert = builder.Build();

Build a CA (certificate authority):

//A CA's expiry date must be later than that of any certificates it will issue
var issuer = new CertificateBuilder()
    .SetUsage(CertificateUsage.CA)
    .SetFriendlyName("Example root CA")
    .SetSubject(b => b.SetCommonName("Example root CA"))
    .SetNotAfter(DateTimeOffset.UtcNow.AddYears(100))
    .Build();

Build a client-auth certificate signed by a CA:

//Note: the 'issuer' certificate used must have a private-key attached in order to sign this new certificate
var cert = new CertificateBuilder()
    .SetUsage(CertificateUsage.Client)
    .SetFriendlyName("Example client-auth certificate")
    .SetSubject(b => b.SetCommonName("User: Michael"))
    .SetNotAfter(DateTimeOffset.UtcNow.AddYears(1))
    .SetIssuer(issuer)
    .Build();

Advanced: Build a certificate with customized extensions:

var cert = new CertificateBuilder()
    .SetFriendlyName("Example certificate with customized extensions")
    .SetSubject(b => b.SetCommonName("Example certificate with customized extensions"))
    .AddExtension(new X509BasicConstraintsExtension(false, false, 0, true))
    .AddExtension(new X509KeyUsageExtension(X509KeyUsageFlags.DigitalSignature | X509KeyUsageFlags.KeyEncipherment | X509KeyUsageFlags.DataEncipherment, true))
    .AddExtension(new X509EnhancedKeyUsageExtension(new OidCollection { new(KeyPurposeID.AnyExtendedKeyUsage.Id) }, false))
    .SetIssuer(issuer)
    .Build();

CertificateFinder examples

CertificateFinder requires the FluentCertificates.Finder package and is found under the FluentCertificates namespace.

TODO: document this

X500NameBuilder examples

X500NameBuilder requires the FluentCertificates.Builder package and is found under the FluentCertificates namespace.

TODO: document this; see unit tests for more examples

X509Certificate2 extension-methods

These extension methods require the FluentCertificates.Builder package and are found under the FluentCertificates.Extensions namespace.

TODO: document these; see unit tests for more examples

X509Chain extension-methods

These extension methods require the FluentCertificates.Builder package and are found under the FluentCertificates.Extensions namespace.

TODO: document these

X509Certificate2Collection extension-methods

These extension methods require the FluentCertificates.Builder package and are found under the FluentCertificates.Extensions namespace.

TODO: document these

IEnumerable<X509Certificate2> extension-methods

These extension methods require the FluentCertificates.Builder package and are found under the FluentCertificates.Extensions namespace.

TODO: document these

AsymmetricAlgorithm extension-methods

These extension methods require the FluentCertificates.Builder package and are found under the FluentCertificates.Extensions namespace.

TODO: document these

CertificateRequest extension-methods

These extension methods require the FluentCertificates.Builder package and are found under the FluentCertificates.Extensions namespace.

X509Extension extension-methods

These extension methods require the FluentCertificates.Builder package and are found under the FluentCertificates.Extensions namespace.