Ensure certificates are not added to root store
Ensure certificates are not added to root store
Microsoft docsDescription
This rule detects code that potentially adds a certificate into the Trusted Root Certification Authorities certificate store. By default, the Trusted Root Certification Authorities certificate store is configured with a set of public certification authorities (CAs) that has met the requirements of the Microsoft Root Certificate Program. Since all trusted root CAs can issue certificates for any domain, an attacker can pick a weak or coercible CA that you install by yourself to target for an attack – and a single vulnerable, malicious or coercible CA undermines the security of the entire system.
Cause
Adding certificates to the operating system's trusted root certificates increases the risk of legitimizing untrusted certification authority.
By default, this rule analyzes the entire codebase, but this is configurable.
How to fix violations
Do not install certificates into the Trusted Root Certification Authorities certificate store.
Example
using System;
using System.Security.Cryptography.X509Certificates;
class TestClass
{
public void TestMethod()
{
var storeName = StoreName.Root;
Random r = new Random();
if (r.Next(6) == 4)
{
storeName = StoreName.My;
}
var x509Store = new X509Store(storeName);
x509Store.Add(new X509Certificate2());
}
}
using System.Security.Cryptography.X509Certificates;
class TestClass
{
public void TestMethod()
{
var storeName = StoreName.My;
var x509Store = new X509Store(storeName);
x509Store.Add(new X509Certificate2());
}
}When to suppress
It is not recommended to suppress this rule.