NETStandard TLS Parity - Githubissues

nats-io / nats.net.v2

Full Async C# / .NET client for NATS

https://nats-io.github.io/nats.net.v2/

Apache License 2.0

202 stars 40 forks source link

NETStandard TLS Parity #527

Closed caleblloyd closed 1 week ago

caleblloyd commented 1 week ago

~~Imports BouncyCastle when target is NETStandard for PEM Reading~~
Removes obsolete NatsTlsOpts methods
Adds ability to load a Client Cert/Key Bundle from PKCS#12 .pfx file
API Parity for NatsTlsOpts between NETStandard and NET6/8, except Client Cert/Key PEM functions are excluded from NETStandard

mtmk commented 1 week ago

I'm wondering Bouncy dependency is going to be an issue for some people. Be nice if we can bring in a simple implementation for reading PEM. it doesn't need to be super efficient at all.

caleblloyd commented 1 week ago

We could potentially require a different dependency for Bouncy Castle instead of bundling into Nats.Client.Core? Then throw NotSuppportedException with a message that you have to install another dependency to use the pem-related fields on NETStandard

Not my favorite approach but cuts down on the package size

caleblloyd commented 1 week ago

After further discussion on Slack, @mtmk and I thought that it would be best to

Remove Bouncy Castle dependency
Add support for reading PEM-encoded CA Certs on NETStandard
Remove support for reading PEM-encoded Client Cert/Key on NETStandard. Too tricky to build an X509Certificate2 without any of the PEM methods to load/associate PEM-encoded Private Keys
Add support for using PKCS#12 .pem files for client certificates on all targets

Those changes are ready for review