Class McpClientCertificateTrustProfile

Namespace

MailFathom.Infrastructure.Security.ClientCertificates

Assembly

MailFathom.Infrastructure.dll

One client application a deployment trusts, and the certificate policy that identifies it.

public sealed class McpClientCertificateTrustProfile

Inheritance

object

McpClientCertificateTrustProfile

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

A profile is named after the client rather than after the authority that signed for it, because that is what an operator reasons about: the ChatGPT connector, the reporting service, the workstation fleet. Several profiles stand beside each other so one client's authority rotating, widening, or being withdrawn changes what that client may present and nothing about the others — which one global certificate setting could not express.

The trust anchors are configured references rather than loaded certificates, so the material is retrieved when a request is judged rather than held for the life of the process. Rotating an authority is then adding its successor beside it and removing the predecessor once clients have moved, with both accepted in between and no restart in the middle. Anchors are public certificates and are recorded by subject and thumbprint; the reference machinery carries them for provisioning and erasure alone, and their validity is the X.509 one rather than a configured lifetime.

A profile always names the client it identifies through ExpectedDnsNames. A trusted authority on its own would accept every certificate that authority has ever issued, which for a public or shared certificate authority is a great many clients that are not this deployment's.

Fields

MaximumNameLength

The greatest number of characters a profile name may carry.

Properties

ExpectedDnsNames

Gets the DNS names of which a presented certificate must carry at least one as a subject alternative name.

Name

Gets the operator-chosen name of the client this profile identifies, which is safe to record.

Requirement

Gets whether a request that presents no certificate at all is refused.

TrustAnchors

Gets the configured certificate authorities a presented certificate must chain to, several of them so an authority can be rotated by overlap.

Methods

Create(string, McpClientCertificateRequirement, IEnumerable<ConfiguredSecret>, IEnumerable<string>)

Creates a profile from settings that have already been validated.

IsAcceptedDnsName(string?)

Reports whether a configured value may be an expected subject alternative name.

IsAcceptedName(string?)

Reports whether a configured value may name a profile.

NamesClient(IEnumerable<string>)

Reports whether a certificate carrying given DNS names is the client this profile identifies.