Class BowireProxyCertificateAuthority

Namespace
Kuestenlogik.Bowire.Proxy
Assembly
Kuestenlogik.Bowire.dll

Self-signed CA that bowire proxy uses to mint leaf certificates for HTTPS interception (Tier-3 Stage B in the security-testing ADR). On first use the CA generates an RSA-2048 self-signed root with a 5-year validity, persists it to ~/.bowire/proxy-ca.pfx (private key) and exports a trust-installable ~/.bowire/proxy-ca.crt beside it. Every CONNECT target host gets a leaf cert minted on-the-fly: same algorithm, 90-day validity, SAN populated with the requested hostname (and an IP:127.0.0.1 alt-name when intercepting loopback traffic). Leaf certs are cached per-host so re-visited targets reuse the same fingerprint.

public sealed class BowireProxyCertificateAuthority : IDisposable
Inheritance
BowireProxyCertificateAuthority
Implements
Inherited Members

Remarks

The CA is the trust anchor an operator installs into the local trust store; without that step every intercepted HTTPS request fails the client's chain check. The workbench surfaces the install instructions via the bowire proxy --export-ca CLI flag, which writes the .crt to a caller-chosen path.

Thread-safety: leaf minting runs concurrently for parallel CONNECT calls. The cache uses ConcurrentDictionary<TKey, TValue> + a lazy factory so each host generates exactly one leaf even under simultaneous handshakes for the same target.

Properties

CaCertPath

Path of the DER-encoded public CA certificate (for trust-store install).

public string CaCertPath { get; }

Property Value

string

CaPfxPath

Path of the PKCS#12 file holding the CA private key.

public string CaPfxPath { get; }

Property Value

string

CachedLeafCount

Number of leaf certs currently cached.

public int CachedLeafCount { get; }

Property Value

int

Certificate

The CA certificate (public + private key).

public X509Certificate2 Certificate { get; }

Property Value

X509Certificate2

DefaultDirectory

Default directory holding the persisted CA + leaf crt — ~/.bowire.

public static string DefaultDirectory { get; }

Property Value

string

Methods

Dispose() 

public void Dispose()

ExportPublicCertificate(string)

Copy the public CA certificate to destination (DER-encoded .crt). Convenience for bowire proxy --export-ca.

public void ExportPublicCertificate(string destination)

Parameters

destination string

GetOrMintLeaf(string)

Mint a leaf certificate for hostname. Cached per hostname so two handshakes against the same target reuse the same fingerprint (TLS sessions / HSTS / HPKP-style pinning only fire on cert change).

public X509Certificate2 GetOrMintLeaf(string hostname)

Parameters

hostname string

Returns

X509Certificate2

LoadOrCreate(string?)

Load the CA from directory (default DefaultDirectory) — or create + persist a fresh one if no PFX is present.

public static BowireProxyCertificateAuthority LoadOrCreate(string? directory = null)

Parameters

directory string

Returns

BowireProxyCertificateAuthority