Idenitfy if certificate is a host, intermediate, or root cert

Question

I need a way to, given a list of X509Certificate2 objects, classify each as being either a root, intermediate, or host cert.

I've got a TCP service running in a docker container on AWS. I have set up a secret-management system and external provisioning system to provide certs to this service for TLS. However, the certs are PEM and this is infamously painful in c#. After strugging about 5 times over the last 8 years to even load PEM certs when a private key is involved, I have finally solved that cleanly with some new syntax provided in dotnet core. So yay.

Now my application has the certs with the private keys, and the chain, but still cannot make use of them because of the AuthenticateAsServer method interface which does not allow you to provide a chain. Rather you provide a certificate and then it will dig a chain out of the cert store if it can and then you have to look on the other end to see if the chain came out. (I will spare you an hour long tirade of my feelings about this pattern) Since I cannot provide a chain my only option is to install the chain prior to calling AuthenticateAsServer so that the super opaque black box will find them and send them.

Here is the problem. My chain is a big string of the kind you would get by cat'ing together the relevant OpenSSL created cert files. I've already written some code to split that text up into cert chunks and then initialize a collection of X509Certificate2 objects that I can foreach through and install each into a store. But which store? I need a way to check each one and know which store it should go into.

Here is my working idea in psuedocode

bool isSelfSigned = cert.Issuer == cert.Subject;
bool isCa = HasBasicConstraintCA();

if (isCa)
{
   if (isSelfSigned) root=true;
   else intermediate=true;
}
else if(some hopefully affirmative condition)
{
   host=true;
}

Is this reasonable considering the situation? Am I going to hit any unexpected traps with this logic?

Is there any affirmative condition I can check for the host cert, other than it isn't either of the other two?

Answer 1

Your logic is almost correct; Please note that for end-entity certificates ( in your term host certificate) following values are possible;

1. no basicConstraint flag present
2. basicConstraint:CA:False is present

In both above cases it can be interpreted as end-entity ( host ) certificates. Please make sure your HasBasicConstraintCA() function checks for both cases. Apart the logic looks simple and wonderful.