{"action":"created","comment":{"url":"https://api.github.com/repos/dotnet/corefx/pulls/comments/42239069","id":42239069,"diff_hunk":"@@ -0,0 +1,133 @@\n+// Copyright (c) Microsoft. All rights reserved.\n+// Licensed under the MIT license. See LICENSE file in the project root for full license information.\n+\n+using System;\n+using System.Collections.Generic;\n+using System.Diagnostics;\n+using System.Security.Cryptography;\n+using System.Security.Cryptography.X509Certificates;\n+\n+namespace System.Net.Http\n+{\n+    /// <summary>\n+    /// Defines Extension methods which are meant to be re-used across WinHttp & UnixHttp Handlers\n+    /// </summary>\n+    internal static class TLSCertificateExtensions\n+    {\n+        private const string ClientCertificateOid = \"1.3.6.1.5.5.7.3.2\";\n+\n+        /// <summary>\n+        ///   returns true if the X509 Certificate can be used  as SSL Client Certificate.\n+        /// </summary>\n+        private static bool IsClientCertificate(X509Certificate2 cert)\n+        {\n+            Debug.Assert(cert != null, \"certificate cannot be null\");\n+\n+            bool hasClientCertExt = false;\n+            bool forDigitalSignature = false;\n+            bool noExtendedRestrictions = true;\n+            bool noUsageRestrictions = true;\n+            foreach(X509Extension extension in cert.Extensions)\n+            {\n+                // check if the extension is an enhanced usage ext.\n+                // But do this only if needed. No point going over it, if we already have established that our cert has the\n+                // required extension.\n+                if (!hasClientCertExt)\n+                {\n+                    X509EnhancedKeyUsageExtension enhancedUsageExt = extension as X509EnhancedKeyUsageExtension;\n+                    if (enhancedUsageExt != null)\n+                    {\n+                        noExtendedRestrictions = false;\n+                        foreach(Oid oid in enhancedUsageExt.EnhancedKeyUsages)\n+                        {\n+                            if (string.Equals(ClientCertificateOid, oid.Value))\n+                            {\n+                                hasClientCertExt = true;\n+                                break;\n+                            }\n+                        }\n+                    }\n+                }\n+\n+                /// Check if the extension is a key usage extension.\n+                /// No point going over it if we have already established that out cert has digital signature\n+                if (!forDigitalSignature)\n+                {\n+                    X509KeyUsageExtension usageExt = extension as X509KeyUsageExtension;\n+                    if (usageExt != null)\n+                    {\n+                        noUsageRestrictions = false;\n+                        forDigitalSignature = (usageExt.KeyUsages & X509KeyUsageFlags.DigitalSignature) != 0;\n+                    }\n+                }\n+\n+                if(hasClientCertExt && forDigitalSignature)\n+                {\n+                    return true;\n+                }\n+            }\n+            Debug.Assert(!hasClientCertExt || !forDigitalSignature, \"if cert can be used as digital signature && it has ClientCertificateOid extension, it is a client cert\");\n+\n+            return noExtendedRestrictions && noUsageRestrictions;\n+        }\n+\n+        /// <summary>\n+        ///   Returns a new collection containing valid client certificates from the given X509Certificate2Collection\n+        /// </summary>\n+        internal static bool TryFindClientCertificate(this X509Certificate2Collection certificates,\n+                                                      ISet<string> allowedIssuers,\n+                                                      out X509Certificate2 clientCertificate,\n+                                                      out X509Chain clientCertChain)\n+        {","path":"src/Common/src/System/Net/Http/TlsCertificateExtensions.cs","position":81,"original_position":81,"commit_id":"f06054fa2e55fa39e09c79e0f6232d9874c92d39","original_commit_id":"f06054fa2e55fa39e09c79e0f6232d9874c92d39","user":{"login":"kapilash","id":113322,"avatar_url":"https://avatars.githubusercontent.com/u/113322?v=3","gravatar_id":"","url":"https://api.github.com/users/kapilash","html_url":"https://github.com/kapilash","followers_url":"https://api.github.com/users/kapilash/followers","following_url":"https://api.github.com/users/kapilash/following{/other_user}","gists_url":"https://api.github.com/users/kapilash/gists{/gist_id}","starred_url":"https://api.github.com/users/kapilash/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kapilash/subscriptions","organizations_url":"https://api.github.com/users/kapilash/orgs","repos_url":"https://api.github.com/users/kapilash/repos","events_url":"https://api.github.com/users/kapilash/events{/privacy}","received_events_url":"https://api.github.com/users/kapilash/received_events","type":"User","site_admin":false},"body":"I am returning both clientCertificate as well as the certificate chain. ```clientCertChain[0]``` should be the certificate so there should be no reason for us to return the certificate as well. But ```clientCertChain[0]``` does not have a private key. I do not know if this is a bug or expected behavior or if I am missing something. That is the reason am sending out the certificate as well.","created_at":"2015-10-16T12:59:59Z","updated_at":"2015-10-16T12:59:59Z","html_url":"https://github.com/dotnet/corefx/pull/3329#discussion_r42239069","pull_request_url":"https://api.github.com/repos/dotnet/corefx/pulls/3329","_links":{"self":{"href":"https://api.github.com/repos/dotnet/corefx/pulls/comments/42239069"},"html":{"href":"https://github.com/dotnet/corefx/pull/3329#discussion_r42239069"},"pull_request":{"href":"https://api.github.com/repos/dotnet/corefx/pulls/3329"}}},"pull_request":{"url":"https://api.github.com/repos/dotnet/corefx/pulls/3329","id":45490909,"html_url":"https://github.com/dotnet/corefx/pull/3329","diff_url":"https://github.com/dotnet/corefx/pull/3329.diff","patch_url":"https://github.com/dotnet/corefx/pull/3329.patch","issue_url":"https://api.github.com/repos/dotnet/corefx/issues/3329","number":3329,"state":"open","locked":false,"title":"Client Certificate Options for Client Handler","user":{"login":"kapilash","id":113322,"avatar_url":"https://avatars.githubusercontent.com/u/113322?v=3","gravatar_id":"","url":"https://api.github.com/users/kapilash","html_url":"https://github.com/kapilash","followers_url":"https://api.github.com/users/kapilash/followers","following_url":"https://api.github.com/users/kapilash/following{/other_user}","gists_url":"https://api.github.com/users/kapilash/gists{/gist_id}","starred_url":"https://api.github.com/users/kapilash/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kapilash/subscriptions","organizations_url":"https://api.github.com/users/kapilash/orgs","repos_url":"https://api.github.com/users/kapilash/repos","events_url":"https://api.github.com/users/kapilash/events{/privacy}","received_events_url":"https://api.github.com/users/kapilash/received_events","type":"User","site_admin":false},"body":"When HttpClientHandler.ClientCertificateOption is set to \r\nClientCertificateOptions.Automatic, curl handler passes on the X509\r\ncertificates from X509 store to libcurl","created_at":"2015-09-20T06:31:04Z","updated_at":"2015-10-16T12:59:59Z","closed_at":null,"merged_at":null,"merge_commit_sha":"0b06ff819eb7567d320a58ae6ad96609e799c755","assignee":{"login":"kapilash","id":113322,"avatar_url":"https://avatars.githubusercontent.com/u/113322?v=3","gravatar_id":"","url":"https://api.github.com/users/kapilash","html_url":"https://github.com/kapilash","followers_url":"https://api.github.com/users/kapilash/followers","following_url":"https://api.github.com/users/kapilash/following{/other_user}","gists_url":"https://api.github.com/users/kapilash/gists{/gist_id}","starred_url":"https://api.github.com/users/kapilash/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kapilash/subscriptions","organizations_url":"https://api.github.com/users/kapilash/orgs","repos_url":"https://api.github.com/users/kapilash/repos","events_url":"https://api.github.com/users/kapilash/events{/privacy}","received_events_url":"https://api.github.com/users/kapilash/received_events","type":"User","site_admin":false},"milestone":null,"commits_url":"https://api.github.com/repos/dotnet/corefx/pulls/3329/commits","review_comments_url":"https://api.github.com/repos/dotnet/corefx/pulls/3329/comments","review_comment_url":"https://api.github.com/repos/dotnet/corefx/pulls/comments{/number}","comments_url":"https://api.github.com/repos/dotnet/corefx/issues/3329/comments","statuses_url":"https://api.github.com/repos/dotnet/corefx/statuses/f06054fa2e55fa39e09c79e0f6232d9874c92d39","head":{"label":"kapilash:client_certs_other_props","ref":"client_certs_other_props","sha":"f06054fa2e55fa39e09c79e0f6232d9874c92d39","user":{"login":"kapilash","id":113322,"avatar_url":"https://avatars.githubusercontent.com/u/113322?v=3","gravatar_id":"","url":"https://api.github.com/users/kapilash","html_url":"https://github.com/kapilash","followers_url":"https://api.github.com/users/kapilash/followers","following_url":"https://api.github.com/users/kapilash/following{/other_user}","gists_url":"https://api.github.com/users/kapilash/gists{/gist_id}","starred_url":"https://api.github.com/users/kapilash/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kapilash/subscriptions","organizations_url":"https://api.github.com/users/kapilash/orgs","repos_url":"https://api.github.com/users/kapilash/repos","events_url":"https://api.github.com/users/kapilash/events{/privacy}","received_events_url":"https://api.github.com/users/kapilash/received_events","type":"User","site_admin":false},"repo":{"id":32931025,"name":"corefx","full_name":"kapilash/corefx","owner":{"login":"kapilash","id":113322,"avatar_url":"https://avatars.githubusercontent.com/u/113322?v=3","gravatar_id":"","url":"https://api.github.com/users/kapilash","html_url":"https://github.com/kapilash","followers_url":"https://api.github.com/users/kapilash/followers","following_url":"https://api.github.com/users/kapilash/following{/other_user}","gists_url":"https://api.github.com/users/kapilash/gists{/gist_id}","starred_url":"https://api.github.com/users/kapilash/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kapilash/subscriptions","organizations_url":"https://api.github.com/users/kapilash/orgs","repos_url":"https://api.github.com/users/kapilash/repos","events_url":"https://api.github.com/users/kapilash/events{/privacy}","received_events_url":"https://api.github.com/users/kapilash/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/kapilash/corefx","description":"This repo contains the .NET Core foundational libraries, called CoreFX. It includes classes for collections, file systems, console, XML, async and many others.","fork":true,"url":"https://api.github.com/repos/kapilash/corefx","forks_url":"https://api.github.com/repos/kapilash/corefx/forks","keys_url":"https://api.github.com/repos/kapilash/corefx/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kapilash/corefx/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kapilash/corefx/teams","hooks_url":"https://api.github.com/repos/kapilash/corefx/hooks","issue_events_url":"https://api.github.com/repos/kapilash/corefx/issues/events{/number}","events_url":"https://api.github.com/repos/kapilash/corefx/events","assignees_url":"https://api.github.com/repos/kapilash/corefx/assignees{/user}","branches_url":"https://api.github.com/repos/kapilash/corefx/branches{/branch}","tags_url":"https://api.github.com/repos/kapilash/corefx/tags","blobs_url":"https://api.github.com/repos/kapilash/corefx/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kapilash/corefx/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kapilash/corefx/git/refs{/sha}","trees_url":"https://api.github.com/repos/kapilash/corefx/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kapilash/corefx/statuses/{sha}","languages_url":"https://api.github.com/repos/kapilash/corefx/languages","stargazers_url":"https://api.github.com/repos/kapilash/corefx/stargazers","contributors_url":"https://api.github.com/repos/kapilash/corefx/contributors","subscribers_url":"https://api.github.com/repos/kapilash/corefx/subscribers","subscription_url":"https://api.github.com/repos/kapilash/corefx/subscription","commits_url":"https://api.github.com/repos/kapilash/corefx/commits{/sha}","git_commits_url":"https://api.github.com/repos/kapilash/corefx/git/commits{/sha}","comments_url":"https://api.github.com/repos/kapilash/corefx/comments{/number}","issue_comment_url":"https://api.github.com/repos/kapilash/corefx/issues/comments{/number}","contents_url":"https://api.github.com/repos/kapilash/corefx/contents/{+path}","compare_url":"https://api.github.com/repos/kapilash/corefx/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kapilash/corefx/merges","archive_url":"https://api.github.com/repos/kapilash/corefx/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kapilash/corefx/downloads","issues_url":"https://api.github.com/repos/kapilash/corefx/issues{/number}","pulls_url":"https://api.github.com/repos/kapilash/corefx/pulls{/number}","milestones_url":"https://api.github.com/repos/kapilash/corefx/milestones{/number}","notifications_url":"https://api.github.com/repos/kapilash/corefx/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kapilash/corefx/labels{/name}","releases_url":"https://api.github.com/repos/kapilash/corefx/releases{/id}","created_at":"2015-03-26T14:08:29Z","updated_at":"2015-04-18T03:20:57Z","pushed_at":"2015-10-16T11:22:52Z","git_url":"git://github.com/kapilash/corefx.git","ssh_url":"git@github.com:kapilash/corefx.git","clone_url":"https://github.com/kapilash/corefx.git","svn_url":"https://github.com/kapilash/corefx","homepage":"","size":35582,"stargazers_count":0,"watchers_count":0,"language":"C#","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"dotnet:master","ref":"master","sha":"6f1c2a86fb8fa1bdaee7c6e70a684d27842d804c","user":{"login":"dotnet","id":9141961,"avatar_url":"https://avatars.githubusercontent.com/u/9141961?v=3","gravatar_id":"","url":"https://api.github.com/users/dotnet","html_url":"https://github.com/dotnet","followers_url":"https://api.github.com/users/dotnet/followers","following_url":"https://api.github.com/users/dotnet/following{/other_user}","gists_url":"https://api.github.com/users/dotnet/gists{/gist_id}","starred_url":"https://api.github.com/users/dotnet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dotnet/subscriptions","organizations_url":"https://api.github.com/users/dotnet/orgs","repos_url":"https://api.github.com/users/dotnet/repos","events_url":"https://api.github.com/users/dotnet/events{/privacy}","received_events_url":"https://api.github.com/users/dotnet/received_events","type":"Organization","site_admin":false},"repo":{"id":26295345,"name":"corefx","full_name":"dotnet/corefx","owner":{"login":"dotnet","id":9141961,"avatar_url":"https://avatars.githubusercontent.com/u/9141961?v=3","gravatar_id":"","url":"https://api.github.com/users/dotnet","html_url":"https://github.com/dotnet","followers_url":"https://api.github.com/users/dotnet/followers","following_url":"https://api.github.com/users/dotnet/following{/other_user}","gists_url":"https://api.github.com/users/dotnet/gists{/gist_id}","starred_url":"https://api.github.com/users/dotnet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dotnet/subscriptions","organizations_url":"https://api.github.com/users/dotnet/orgs","repos_url":"https://api.github.com/users/dotnet/repos","events_url":"https://api.github.com/users/dotnet/events{/privacy}","received_events_url":"https://api.github.com/users/dotnet/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/dotnet/corefx","description":"This repo contains the .NET Core foundational libraries, called CoreFX. It includes classes for collections, file systems, console, XML, async and many others.","fork":false,"url":"https://api.github.com/repos/dotnet/corefx","forks_url":"https://api.github.com/repos/dotnet/corefx/forks","keys_url":"https://api.github.com/repos/dotnet/corefx/keys{/key_id}","collaborators_url":"https://api.github.com/repos/dotnet/corefx/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/dotnet/corefx/teams","hooks_url":"https://api.github.com/repos/dotnet/corefx/hooks","issue_events_url":"https://api.github.com/repos/dotnet/corefx/issues/events{/number}","events_url":"https://api.github.com/repos/dotnet/corefx/events","assignees_url":"https://api.github.com/repos/dotnet/corefx/assignees{/user}","branches_url":"https://api.github.com/repos/dotnet/corefx/branches{/branch}","tags_url":"https://api.github.com/repos/dotnet/corefx/tags","blobs_url":"https://api.github.com/repos/dotnet/corefx/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/dotnet/corefx/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/dotnet/corefx/git/refs{/sha}","trees_url":"https://api.github.com/repos/dotnet/corefx/git/trees{/sha}","statuses_url":"https://api.github.com/repos/dotnet/corefx/statuses/{sha}","languages_url":"https://api.github.com/repos/dotnet/corefx/languages","stargazers_url":"https://api.github.com/repos/dotnet/corefx/stargazers","contributors_url":"https://api.github.com/repos/dotnet/corefx/contributors","subscribers_url":"https://api.github.com/repos/dotnet/corefx/subscribers","subscription_url":"https://api.github.com/repos/dotnet/corefx/subscription","commits_url":"https://api.github.com/repos/dotnet/corefx/commits{/sha}","git_commits_url":"https://api.github.com/repos/dotnet/corefx/git/commits{/sha}","comments_url":"https://api.github.com/repos/dotnet/corefx/comments{/number}","issue_comment_url":"https://api.github.com/repos/dotnet/corefx/issues/comments{/number}","contents_url":"https://api.github.com/repos/dotnet/corefx/contents/{+path}","compare_url":"https://api.github.com/repos/dotnet/corefx/compare/{base}...{head}","merges_url":"https://api.github.com/repos/dotnet/corefx/merges","archive_url":"https://api.github.com/repos/dotnet/corefx/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/dotnet/corefx/downloads","issues_url":"https://api.github.com/repos/dotnet/corefx/issues{/number}","pulls_url":"https://api.github.com/repos/dotnet/corefx/pulls{/number}","milestones_url":"https://api.github.com/repos/dotnet/corefx/milestones{/number}","notifications_url":"https://api.github.com/repos/dotnet/corefx/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/dotnet/corefx/labels{/name}","releases_url":"https://api.github.com/repos/dotnet/corefx/releases{/id}","created_at":"2014-11-06T23:42:48Z","updated_at":"2015-10-16T07:58:35Z","pushed_at":"2015-10-16T12:36:57Z","git_url":"git://github.com/dotnet/corefx.git","ssh_url":"git@github.com:dotnet/corefx.git","clone_url":"https://github.com/dotnet/corefx.git","svn_url":"https://github.com/dotnet/corefx","homepage":"http://dotnet.github.io/core/","size":81493,"stargazers_count":8450,"watchers_count":8450,"language":"C#","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":1848,"mirror_url":null,"open_issues_count":644,"forks":1848,"open_issues":644,"watchers":8450,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/dotnet/corefx/pulls/3329"},"html":{"href":"https://github.com/dotnet/corefx/pull/3329"},"issue":{"href":"https://api.github.com/repos/dotnet/corefx/issues/3329"},"comments":{"href":"https://api.github.com/repos/dotnet/corefx/issues/3329/comments"},"review_comments":{"href":"https://api.github.com/repos/dotnet/corefx/pulls/3329/comments"},"review_comment":{"href":"https://api.github.com/repos/dotnet/corefx/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/dotnet/corefx/pulls/3329/commits"},"statuses":{"href":"https://api.github.com/repos/dotnet/corefx/statuses/f06054fa2e55fa39e09c79e0f6232d9874c92d39"}}}}