Do not add certificates to root store
Do not add certificates to root store
Microsoft docsDescription
This rule detects code that adds a certificate into the Trusted Root Certification Authorities certificate store. By default, the Trusted Root Certification Authorities certificate store is configured with a set of public CAs that has met the requirements of the Microsoft Root Certificate Program. Since all trusted root certification authorities (CA's) can issue certificates for any domain, an attacker can pick a weak or coercible CA that you install by yourself to target for an attack – and a single vulnerable, malicious or coercible CA undermines the security of the entire system.
Cause
Adding certificates to the operating system's trusted root certificates increases the risk of legitimizing untrusted certification authority.
By default, this rule analyzes the entire codebase, but this is configurable.
How to fix violations
Do not install certificates into the Trusted Root Certification Authorities certificate store.
Example
using System.Security.Cryptography.X509Certificates;
class TestClass
{
public void TestMethod()
{
var storeName = StoreName.Root;
var x509Store = new X509Store(storeName);
x509Store.Add(new X509Certificate2());
}
}
using System.Security.Cryptography.X509Certificates;
class TestClass
{
public void TestMethod()
{
var storeName = StoreName.My;
var x509Store = new X509Store(storeName);
x509Store.Add(new X509Certificate2());
}
}When to suppress
It is not recommended to suppress this rule.