Documentation
¶
Overview ¶
Package certstore signs with a private key held in the Windows certificate store, named by its certificate's SHA-1 thumbprint, without ever reading the key out of the store (ADR-0172, amended).
Why ¶
An app registration's certificate usually lives in the store of the host that signs in with it, its key marked non-exportable — the property that makes it hard to steal. That is the certificate PowerShell's Connect-MgGraph -CertificateThumbprint, the Teams Phone Worker and every script before them use. A key that cannot be exported cannot be handed to a Worker as PEM either, so the only way a Go Worker can use the same certificate is to ask the store to sign, which is what this package does: it finds the certificate, and its signer hands each digest to CNG (NCryptSignHash).
The rules ¶
The store is searched as Connect-MicrosoftTeams and the Teams Phone Worker search it: CurrentUser\My of the account the process runs as, then LocalMachine\My. The key is tried once when the certificate is opened, so a key the account may not use, or one that is not the certificate's, is a startup error rather than a failed token request in the middle of a run. The key must be a CNG key — every key a current Windows creates or imports is one — and RSA, because the client assertion is RS256.
Index ¶
Constants ¶
const Supported = supported
Supported says whether this platform has a certificate store to sign with.
Variables ¶
var ErrUnsupported = errors.New("certstore: a certificate thumbprint names a certificate in the Windows certificate store, and this process is not running on Windows; give the certificate and its key as PEM instead")
ErrUnsupported is Open's answer outside Windows.
Functions ¶
func Open ¶
Open finds the certificate with this thumbprint and returns it with a signer for its private key, tried once already. Outside Windows it answers ErrUnsupported.
func ParseThumbprint ¶
ParseThumbprint reads a SHA-1 thumbprint as Windows shows it: forty hexadecimal characters in either case, whatever else surrounds them.
Types ¶
This section is empty.
Source Files