credentials_tls: Keep thumbprint rather than client certificate

By storing the client certificate the certificate became detached from
its private key stored in user certificate store. This rendered client
certificates useless for client TLS authentication.

Now, the client certificate thumbprint is stored instead. The client
certificate is looked up in the user certificate store as required.

This breaks profile XML and BLOB backward compatibility. Since the
client certificate support was broken, nobody probably used those in
the settings before.

Signed-off-by: Simon Rozman <simon@rozman.si>
This commit is contained in:
2020-02-06 11:15:34 +01:00
parent 75488ba870
commit 6e97a04bfe
6 changed files with 107 additions and 175 deletions

View File

@@ -142,12 +142,7 @@ namespace eap
_In_opt_z_ LPCTSTR pszTargetName);
public:
winstd::cert_context m_cert; ///< Client certificate
private:
/// \cond internal
static const unsigned char s_entropy[1024];
/// \endcond
std::vector<unsigned char> m_cert_hash; ///< Client certificate SHA-1 thumbprint
};
/// @}