# Technical Specification: Certificate Authority (CA) and Certificate Management

## 1. Purpose:
The purpose of this technical specification is to outline the process of creating certificates for a Certificate Authority (CA) and for server and client entities using the CA. The focus is on establishing a secure communication channel using Mutual TLS (mTLS) authentication.

## 2. Background:
In a Public Key Infrastructure (PKI), a Certificate Authority (CA) is responsible for issuing digital certificates used to verify the identity of users, servers, and other entities in a networked environment. These certificates are crucial for establishing secure communication channels, especially in scenarios like Mutual TLS (mTLS), where both server and client authenticate each other using their certificates.

## 3. Components:

### 3.1. CAManager:

- **Purpose:** Generates a CA certificate.
- **Implementation:**
-- Utilizes RSA encryption with a key size of 4096 bits.
-- Constructs a certificate request for the CA certificate with specified attributes (Common Name, Organizational Unit, Organization, Country).
-- Sets Basic Constraints extension to indicate the CA nature of the certificate.
-- Self-signs the certificate.
-- Exports the CA certificate to a PFX file and saves it.
-- Exports the CA certificate and private key to PEM files.

### 3.2. CertManager:

- **Purpose:** Generates server and client certificates signed by the CA certificate.
- **Implementation:**
-- Creates an RSA provider for the client certificate.
-- Constructs a certificate request for the client certificate with specified attributes.
-- Adds Key Usage extension for digital signature and key encipherment.
-- Uses the CA certificate to sign the client certificate request.
-- Generates serial numbers for the certificates.
-- Exports the server and client certificates to PFX files and saves them.
-- Exports the certificates and private keys to PEM files.

## 4. Code Samples:

using System;
using System.IO;
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;

namespace ca_certs
{
    public class CAManager
    {
        public X509Certificate2 Create()
        {
            using (var rsaProvider = RSA.Create(4096))
            {
                // Create a new certificate request for the CA certificate
                var request = new CertificateRequest(new X500DistinguishedName("CN=ca.burganbank, OU=Digital Banking, O=Burgan Bank Turkey, C=TR"), rsaProvider, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);

                // Set the Basic Constraints extension to indicate that this is a CA certificate
                request.CertificateExtensions.Add(
                    new X509BasicConstraintsExtension(true, true, 0, true));

                // Self-sign the certificate request
                var certificate = request.CreateSelfSigned(DateTimeOffset.Now.AddDays(-1), DateTimeOffset.Now.AddYears(5));
                
                // Copy private key
               certificate = certificate.CopyWithPrivateKey(rsaProvider);
   
                // Export the CA certificate to a PFX file
                var caCertBytes = certificate.Export(X509ContentType.Pfx, "password");

                // Save the CA certificate to a file
                File.WriteAllBytes("ca.pfx", caCertBytes);

                // Export the certificate in PEM format
                var certPem = "-----BEGIN CERTIFICATE-----\r\n" +
                              Convert.ToBase64String(certificate.Export(X509ContentType.Cert), Base64FormattingOptions.InsertLineBreaks) +
                              "\r\n-----END CERTIFICATE-----";

                // Export the private key in PEM format
                var rsaPrivateKey = rsaProvider.ExportRSAPrivateKey();
                var keyPem = "-----BEGIN RSA PRIVATE KEY-----\r\n" +
                             Convert.ToBase64String(rsaPrivateKey, Base64FormattingOptions.InsertLineBreaks) +
                             "\r\n-----END RSA PRIVATE KEY-----";

                // Save the certificate and private key to PEM files
                File.WriteAllText("ca.pem", certPem);
                File.WriteAllText("ca.key", keyPem);

                return certificate;
            }
        }
    }

    public class CertManager
    {
        public X509Certificate2 Create(X509Certificate2 caCert, string certCN, string certName)
        {
            // Create a new RSA provider for the client certificate
            using (var rsaProvider = RSA.Create(4096))
            {
                // Create a new certificate request for the client certificate
                var request = new CertificateRequest(new X500DistinguishedName($"CN={certCN}, OU=Digital Banking, O=Burgan Bank Turkey, C=TR"), rsaProvider, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);

                var keyUsage = new X509KeyUsageExtension(
                    X509KeyUsageFlags.DigitalSignature | X509KeyUsageFlags.KeyEncipherment, true  // Add NonRepudiation if needed
                );

                request.CertificateExtensions.Add(keyUsage);

                // Use the CA certificate to sign the client certificate request
                var certificate = request.Create(caCert, DateTimeOffset.Now.AddMinutes(-1), DateTimeOffset.Now.AddYears(1), GenerateSerialNumber());
                
                // Copy private key
               certificate = certificate.CopyWithPrivateKey(rsaProvider);
               
                // Export the client certificate to a PFX file
                var clientCertBytes = certificate.Export(X509ContentType.Pfx, "password");

                // Save the client certificate to a file
                File.WriteAllBytes($"{certName}.pfx", clientCertBytes);

                // Export the certificate in PEM format
                var certPem = "-----BEGIN CERTIFICATE-----\r\n" +
                              Convert.ToBase64String(certificate.Export(X509ContentType.Cert), Base64FormattingOptions.InsertLineBreaks) +
                              "\r\n-----END CERTIFICATE-----";

                // Export the private key in PEM format
                var rsaPrivateKey = rsaProvider.ExportRSAPrivateKey();
                var keyPem = "-----BEGIN RSA PRIVATE KEY-----\r\n" +
                             Convert.ToBase64String(rsaPrivateKey, Base64FormattingOptions.InsertLineBreaks) +
                             "\r\n-----END RSA PRIVATE KEY-----";

                // Save the certificate and private key to PEM files
                File.WriteAllText($"{certName}.pem", certPem);
                File.WriteAllText($"{certName}.key", keyPem);

                return certificate;
            }
        }

        // Generate a new serial number for a certificate
        byte[] GenerateSerialNumber()
        {
            // Create a new RNGCryptoServiceProvider to generate random bytes
            using (var rng = new RNGCryptoServiceProvider())
            {
                // Create a byte array with the size of a certificate serial number (20 bytes)
                var serialNumber = new byte[20];

                // Fill the byte array with random values
                rng.GetBytes(serialNumber);

                // Return the generated serial number
                return serialNumber;
            }
        }
    }
}

// CAManager usage example
CAManager cAManager = new CAManager();
var caCert = cAManager.Create();

// CertManager usage example
CertManager certManager = new CertManager();
var serverCert = certManager.Create(caCert, "localhost", "server");
var clientCert = certManager.Create(caCert, "12345", "client");

## 5. Additional Notes:

- It's essential to protect the private keys associated with certificates.
- Certificate expiration dates should be monitored and renewed as necessary.
- Proper storage and management of certificates are crucial for maintaining security.
- Implementing certificate revocation mechanisms is recommended to handle compromised or expired certificates effectively.
## 6. Conclusion:
This technical specification provides a clear guideline for generating CA certificates and server/client certificates for secure communication using mTLS. By following these procedures, entities can establish a robust PKI infrastructure to enhance the security of their networked systems.