CA5381: Ensure certificates are not added to root store

Article
04/22/2023

Property	Value
Rule ID	CA5381
Title	Ensure certificates are not added to root store
Category	Security
Fix is breaking or non-breaking	Non-breaking
Enabled by default in .NET 9	No

Cause

Adding certificates to the operating system's trusted root certificates increases the risk of legitimizing untrusted certification authority.

By default, this rule analyzes the entire codebase, but this is configurable.

Rule description

This rule detects code that potentially adds a certificate into the Trusted Root Certification Authorities certificate store. By default, the Trusted Root Certification Authorities certificate store is configured with a set of public certification authorities (CAs) that has met the requirements of the Microsoft Root Certificate Program. Since all trusted root CAs can issue certificates for any domain, an attacker can pick a weak or coercible CA that you install by yourself to target for an attack – and a single vulnerable, malicious or coercible CA undermines the security of the entire system.

How to fix violations

Do not install certificates into the Trusted Root Certification Authorities certificate store.

When to suppress warnings

It is not recommended to suppress this rule.

Configure code to analyze

Use the following options to configure which parts of your codebase to run this rule on.

Exclude specific symbols
Exclude specific types and their derived types

You can configure these options for just this rule, for all rules it applies to, or for all rules in this category (Security) that it applies to. For more information, see Code quality rule configuration options.

Exclude specific symbols

You can exclude specific symbols, such as types and methods, from analysis. For example, to specify that the rule should not run on any code within types named MyType, add the following key-value pair to an .editorconfig file in your project:

dotnet_code_quality.CAXXXX.excluded_symbol_names = MyType

Allowed symbol name formats in the option value (separated by |):

Symbol name only (includes all symbols with the name, regardless of the containing type or namespace).
Fully qualified names in the symbol's documentation ID format. Each symbol name requires a symbol-kind prefix, such as M: for methods, T: for types, and N: for namespaces.
.ctor for constructors and .cctor for static constructors.

Examples:

Option Value	Summary
`dotnet_code_quality.CAXXXX.excluded_symbol_names = MyType`	Matches all symbols named `MyType`.
`dotnet_code_quality.CAXXXX.excluded_symbol_names = MyType1\|MyType2`	Matches all symbols named either `MyType1` or `MyType2`.
`dotnet_code_quality.CAXXXX.excluded_symbol_names = M:NS.MyType.MyMethod(ParamType)`	Matches specific method `MyMethod` with the specified fully qualified signature.
`dotnet_code_quality.CAXXXX.excluded_symbol_names = M:NS1.MyType1.MyMethod1(ParamType)\|M:NS2.MyType2.MyMethod2(ParamType)`	Matches specific methods `MyMethod1` and `MyMethod2` with the respective fully qualified signatures.

Exclude specific types and their derived types

You can exclude specific types and their derived types from analysis. For example, to specify that the rule should not run on any methods within types named MyType and their derived types, add the following key-value pair to an .editorconfig file in your project:

dotnet_code_quality.CAXXXX.excluded_type_names_with_derived_types = MyType

Allowed symbol name formats in the option value (separated by |):

Type name only (includes all types with the name, regardless of the containing type or namespace).
Fully qualified names in the symbol's documentation ID format, with an optional T: prefix.

Examples:

Option Value	Summary
`dotnet_code_quality.CAXXXX.excluded_type_names_with_derived_types = MyType`	Matches all types named `MyType` and all of their derived types.
`dotnet_code_quality.CAXXXX.excluded_type_names_with_derived_types = MyType1\|MyType2`	Matches all types named either `MyType1` or `MyType2` and all of their derived types.
`dotnet_code_quality.CAXXXX.excluded_type_names_with_derived_types = M:NS.MyType`	Matches specific type `MyType` with given fully qualified name and all of its derived types.
`dotnet_code_quality.CAXXXX.excluded_type_names_with_derived_types = M:NS1.MyType1\|M:NS2.MyType2`	Matches specific types `MyType1` and `MyType2` with the respective fully qualified names, and all of their derived types.

Pseudo-code examples

Violation

The following pseudo-code sample illustrates the pattern detected by this rule.

using System;
using System.Security.Cryptography.X509Certificates;

class TestClass
{
    public void TestMethod()
    {
        var storeName = StoreName.Root;
        Random r = new Random();

        if (r.Next(6) == 4)
        {
            storeName = StoreName.My;
        }

        var x509Store = new X509Store(storeName);
        x509Store.Add(new X509Certificate2());
    }
}

Solution

using System.Security.Cryptography.X509Certificates;

class TestClass
{
    public void TestMethod()
    {
        var storeName = StoreName.My;
        var x509Store = new X509Store(storeName);
        x509Store.Add(new X509Certificate2());
    }
}

Share via