TransportIdentity

public sealed class TransportIdentity : IDisposable

Holds the gateway's X.509 certificate, RSA private signing key, and public-key fingerprint for client pinning. Load a supplied certificate and key from Privacy-Enhanced Mail (PEM) text, or generate and optionally store a self-signed identity with Create. Certificates use Distinguished Encoding Rules (DER) for their binary representation. Client verification checks the handshake signature and configured fingerprint; it does not validate a certificate chain or hostname.

Properties

Certificate

public byte[] Certificate { get; }

The DER-encoded X.509 certificate sent during the encryption handshake.

Key

public RSA Key { get; }

The private RSA key used to sign gateway handshake messages.

Fingerprint

public string Fingerprint { get; }

SHA-256 hash of the certificate's SubjectPublicKeyInfo as 64 lowercase hexadecimal characters. Set NebulaConfig.GatewayFingerprint to this value to pin the gateway's public key. Reissuing a certificate with the same public key preserves the fingerprint.

Methods

Sign

public byte[] Sign(byte[] data);

Dispose

public void Dispose();

FingerprintOf

public static string FingerprintOf(byte[] certificateDer);

Computes the SHA-256 fingerprint of a DER-encoded certificate's SubjectPublicKeyInfo.

Verify

public static bool Verify(byte[] certificateDer, byte[] data, byte[] signature);

Verifies an RSA PKCS#1 SHA-256 signature using the public key in certificateDer. Does not validate certificate trust.

Create

public static TransportIdentity Create(string certificatePem, string keyPem, string certificatePath, string keyPath, string selfSignedPath, string subject);

Creates a gateway identity. Uses both PEM strings when supplied; otherwise uses the certificate file and optional separate key file. With neither source configured, loads the self-signed identity from selfSignedPath or generates one and attempts to store it there.

FromPem

public static TransportIdentity FromPem(string certificatePem, string keyPem);

Loads a PEM certificate and RSA private key. Supports PKCS#1 RSA PRIVATE KEY and unencrypted PKCS#8 PRIVATE KEY blocks. Both arguments may contain the same combined PEM document.

SelfSigned

public static TransportIdentity SelfSigned(string subject);

Generates a 2048-bit RSA key and a self-signed certificate with a ten-year validity period.

ToPem

public string ToPem();

Exports the certificate and unencrypted private key as one PEM document. Treat the result as a secret.

FingerprintMatches

public static bool FingerprintMatches(string expected, string actual);

Compares fingerprints after removing non-hexadecimal characters and ignoring case. Returns false for an empty normalized fingerprint.