cpp_client_telemetry
cpp_client_telemetry copied to clipboard
add custom root cert pinning support
This changes adds support to custom trusted root certificate pinning support for HTTP Wininet library. Consumers will be able to ping root CA certificate based on certificate thumbprint and leaf and intermediate certificate can be validated based on subject metadata.
Following 6APIs are added to HttpClient_WinInet. SetCustomRootCheck ==> SDK consumers need to set call this api to set or un set custom root certificate validation. IsCustomRootCheckRequired ==> Return current state of custom root check validation. AddCustomRootCertSHA256Thumbprint ==> Adds one trusted root certificate SHA256 thumbprint. Consumers can add multiple trusted root certificates. AddCustomTrustedSubjectOrg == > Adds one trusted subject organization. This is only used to validate leaf and intermediary CA certificates. As these can rotate often consumers can leverage subject metadata based pinning.
IsTrustedSubjectOrg ==> Used internally by WinInetRequestWrapper to validate the ongoing http request certificate chain. IsTrustedRootCert==> Used internally by WinInetRequestWrapper to validate the ongoing http request certificate chain.