zeroc-ice 3.6.5 → 3.7.0

data/ext/ice/cpp/src/IceSSL/SecureTransportUtil.h

@@ -0,0 +1,46 @@
+// **********************************************************************
+//
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+//
+// This copy of Ice is licensed to you under the terms described in the
+// ICE_LICENSE file included in this distribution.
+//
+// **********************************************************************
+
+#ifndef ICESSL_SECURE_TRANSPORT_UTIL_H
+#define ICESSL_SECURE_TRANSPORT_UTIL_H
+
+#include <IceSSL/SecureTransport.h>
+#include <IceSSL/Util.h>
+
+namespace IceSSL
+{
+
+namespace SecureTransport
+{
+
+std::string sslErrorToString(CFErrorRef);
+std::string sslErrorToString(OSStatus);
+
+#  if defined(ICE_USE_SECURE_TRANSPORT_MACOS)
+//
+// Retrieve a certificate property
+//
+CFDictionaryRef getCertificateProperty(SecCertificateRef, CFTypeRef);
+#  endif
+
+//
+// Read certificate from a file.
+//
+CFArrayRef loadCertificateChain(const std::string&, const std::string&, const std::string&, const std::string&,
+                                const std::string&, const PasswordPromptPtr&, int);
+
+SecCertificateRef loadCertificate(const std::string&);
+CFArrayRef loadCACertificates(const std::string&);
+CFArrayRef findCertificateChain(const std::string&, const std::string&, const std::string&);
+
+} // SecureTransport namespace end
+
+} // IceSSL namespace end
+
+#endif

data/ext/ice/cpp/src/IceSSL/TrustManager.cpp

@@ -1,6 +1,6 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.
@@ -9,6 +9,7 @@
 
 #include <IceSSL/TrustManager.h>
 #include <IceSSL/RFC2253.h>
+#include <IceSSL/ConnectionInfo.h>
 
 #include <Ice/Properties.h>
 #include <Ice/Communicator.h>
@@ -62,7 +63,7 @@ TrustManager::TrustManager(const Ice::CommunicatorPtr& communicator) :
 }
 
 bool
-TrustManager::verify(const NativeConnectionInfoPtr& info)
+TrustManager::verify(const ConnectionInfoPtr& info, const std::string& desc)
 {
     list<list<DistinguishedName> > reject, accept;
 
@@ -131,27 +132,22 @@ TrustManager::verify(const NativeConnectionInfoPtr& info)
     //
     // If there is no certificate then we match false.
     //
-    if(info->nativeCerts.size() != 0)
+    if(info->certs.size() != 0)
     {
-        DistinguishedName subject = info->nativeCerts[0]->getSubjectDN();
+        DistinguishedName subject = info->certs[0]->getSubjectDN();
         if(_traceLevel > 0)
         {
             Ice::Trace trace(_communicator->getLogger(), "Security");
             if(info->incoming)
             {
-                trace << "trust manager evaluating client:\n"
-                      << "subject = " << string(subject) << '\n'
-                      << "adapter = " << info->adapterName << '\n'
-                      << "local addr = " << info->localAddress << ":" << info->localPort << '\n'
-                      << "remote addr = " << info->remoteAddress << ":" << info->remotePort;
+                trace << "trust manager evaluating client:\n" << "subject = " << string(subject) << '\n'
+                      << "adapter = " << info->adapterName << '\n';
             }
             else
             {
-                trace << "trust manager evaluating server:\n"
-                      << "subject = " << string(subject) << '\n'
-                      << "local addr = " << info->localAddress << ":" << info->localPort << '\n'
-                      << "remote addr = " << info->remoteAddress << ":" << info->remotePort;
+                trace << "trust manager evaluating server:\n" << "subject = " << string(subject) << '\n';
             }
+            trace << desc;
         }
 
         //

data/ext/ice/cpp/src/IceSSL/TrustManager.h

@@ -1,14 +1,14 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.
 //
 // **********************************************************************
 
-#ifndef ICE_SSL_TRUST_MANAGER_H
-#define ICE_SSL_TRUST_MANAGER_H
+#ifndef ICESSL_TRUST_MANAGER_H
+#define ICESSL_TRUST_MANAGER_H
 
 #include <Ice/CommunicatorF.h>
 #include <IceSSL/TrustManagerF.h>
@@ -25,7 +25,7 @@ public:
 
     TrustManager(const Ice::CommunicatorPtr&);
 
-    bool verify(const NativeConnectionInfoPtr&);
+    bool verify(const ConnectionInfoPtr&, const std::string&);
 
 private:
 

data/ext/ice/cpp/src/IceSSL/TrustManagerF.h

@@ -1,14 +1,14 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.
 //
 // **********************************************************************
 
-#ifndef ICE_SSL_TRUST_MANAGER_F_H
-#define ICE_SSL_TRUST_MANAGER_F_H
+#ifndef ICESSL_TRUST_MANAGER_F_H
+#define ICESSL_TRUST_MANAGER_F_H
 
 #include <IceUtil/Shared.h>
 

data/ext/ice/cpp/src/IceSSL/UWPCertificateI.cpp

@@ -0,0 +1,271 @@
+// **********************************************************************
+//
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+//
+// This copy of Ice is licensed to you under the terms described in the
+// ICE_LICENSE file included in this distribution.
+//
+// **********************************************************************
+
+//
+// UWP Certificate implementation
+//
+
+#include <IceSSL/UWP.h>
+#include <IceSSL/CertificateI.h>
+#include <IceSSL/Util.h>
+
+#include <Ice/LocalException.h>
+#include <Ice/StringConverter.h>
+#include <Ice/Base64.h>
+#include <Ice/StringUtil.h>
+
+#include <ppltasks.h>
+#include <nserror.h>
+
+using namespace concurrency;
+using namespace Platform;
+using namespace Windows::Foundation;
+using namespace Windows::Storage;
+using namespace Windows::Storage::Streams;
+using namespace Windows::Security::Cryptography;
+
+using namespace Ice;
+using namespace IceSSL;
+
+using namespace std;
+
+namespace
+{
+
+class UWPCertificateI : public UWP::Certificate,
+                        public CertificateI
+{
+public:
+
+    UWPCertificateI(Windows::Security::Cryptography::Certificates::Certificate^);
+
+    virtual bool operator==(const IceSSL::Certificate&) const;
+
+    virtual vector<Ice::Byte> getAuthorityKeyIdentifier() const;
+    virtual vector<Ice::Byte> getSubjectKeyIdentifier() const;
+    virtual bool verify(const CertificatePtr&) const;
+    virtual string encode() const;
+
+    virtual chrono::system_clock::time_point getNotAfter() const;
+    virtual chrono::system_clock::time_point getNotBefore() const;
+    virtual string getSerialNumber() const;
+    virtual DistinguishedName getIssuerDN() const;
+    virtual vector<pair<int, string> > getIssuerAlternativeNames() const;
+    virtual DistinguishedName getSubjectDN() const;
+    virtual vector<pair<int, string> > getSubjectAlternativeNames() const;
+    virtual int getVersion() const;
+    virtual Windows::Security::Cryptography::Certificates::Certificate^ getCert() const;
+
+private:
+
+    Windows::Security::Cryptography::Certificates::Certificate^ _cert;
+};
+
+const Ice::Long TICKS_PER_MSECOND = 10000LL;
+const Ice::Long MSECS_TO_EPOCH = 11644473600000LL;
+
+vector<pair<int, string> >
+certificateAltNames(Windows::Security::Cryptography::Certificates::SubjectAlternativeNameInfo^ subAltNames)
+{
+    vector<pair<int, string> > altNames;
+    if(subAltNames)
+    {
+        for(auto iter = subAltNames->EmailName->First(); iter->HasCurrent; iter->MoveNext())
+        {
+            altNames.push_back(make_pair(AltNameEmail, wstringToString(iter->Current->Data())));
+        }
+        for(auto iter = subAltNames->DnsName->First(); iter->HasCurrent; iter->MoveNext())
+        {
+            altNames.push_back(make_pair(AltNameDNS, wstringToString(iter->Current->Data())));
+        }
+        for(auto iter = subAltNames->Url->First(); iter->HasCurrent; iter->MoveNext())
+        {
+            altNames.push_back(make_pair(AltNameURL, wstringToString(iter->Current->Data())));
+        }
+        for(auto iter = subAltNames->IPAddress->First(); iter->HasCurrent; iter->MoveNext())
+        {
+            altNames.push_back(make_pair(AltNAmeIP, wstringToString(iter->Current->Data())));
+        }
+    }
+    return altNames;
+}
+
+} // end anonymous namespace
+
+UWPCertificateI::UWPCertificateI(Windows::Security::Cryptography::Certificates::Certificate^ cert) : _cert(cert)
+{
+    if(!_cert)
+    {
+        throw IceUtil::IllegalArgumentException(__FILE__, __LINE__, "Invalid certificate reference");
+    }
+}
+
+bool
+UWPCertificateI::operator==(const IceSSL::Certificate& r) const
+{
+    const UWPCertificateI* p = dynamic_cast<const UWPCertificateI*>(&r);
+    if(!p)
+    {
+        return false;
+    }
+
+    return CryptographicBuffer::Compare(_cert->GetCertificateBlob(), p->_cert->GetCertificateBlob());
+}
+
+vector<Ice::Byte>
+UWPCertificateI::getAuthorityKeyIdentifier() const
+{
+    throw  FeatureNotSupportedException(__FILE__, __LINE__);
+}
+
+vector<Ice::Byte>
+UWPCertificateI::getSubjectKeyIdentifier() const
+{
+    throw FeatureNotSupportedException(__FILE__, __LINE__);
+}
+
+bool
+UWPCertificateI::verify(const CertificatePtr&) const
+{
+    throw FeatureNotSupportedException(__FILE__, __LINE__);
+}
+
+string
+UWPCertificateI::encode() const
+{
+    auto reader = Windows::Storage::Streams::DataReader::FromBuffer(_cert->GetCertificateBlob());
+    std::vector<unsigned char> data(reader->UnconsumedBufferLength);
+    if(!data.empty())
+    {
+        reader->ReadBytes(Platform::ArrayReference<unsigned char>(&data[0], static_cast<unsigned int>(data.size())));
+    }
+    ostringstream os;
+    os << "-----BEGIN CERTIFICATE-----\n";
+    os << IceInternal::Base64::encode(data);
+    os << "-----END CERTIFICATE-----\n";
+    return os.str();
+}
+
+chrono::system_clock::time_point
+UWPCertificateI::getNotAfter() const
+{
+    // Convert 100ns time from January 1, 1601 to ms from January 1, 1970
+    return chrono::system_clock::time_point(
+        chrono::milliseconds(_cert->ValidTo.UniversalTime / TICKS_PER_MSECOND - MSECS_TO_EPOCH));
+}
+
+chrono::system_clock::time_point
+UWPCertificateI::getNotBefore() const
+{
+    // Convert 100ns time from January 1, 1601 to ms from January 1, 1970
+    return chrono::system_clock::time_point(
+        chrono::milliseconds(_cert->ValidFrom.UniversalTime / TICKS_PER_MSECOND - MSECS_TO_EPOCH));
+}
+
+string
+UWPCertificateI::getSerialNumber() const
+{
+    ostringstream os;
+    os.fill(0);
+    os.width(2);
+    for(unsigned int i = 0; i < _cert->SerialNumber->Length; i++)
+    {
+        os << hex << static_cast<int>(_cert->SerialNumber[i]);
+    }
+    return IceUtilInternal::toUpper(os.str());
+}
+
+DistinguishedName
+UWPCertificateI::getIssuerDN() const
+{
+    return DistinguishedName("CN=" + wstringToString(_cert->Issuer->Data()));
+}
+
+vector<pair<int, string> >
+UWPCertificateI::getIssuerAlternativeNames() const
+{
+    throw FeatureNotSupportedException(__FILE__, __LINE__);
+}
+
+DistinguishedName
+UWPCertificateI::getSubjectDN() const
+{
+    return DistinguishedName("CN=" + wstringToString(_cert->Subject->Data()));
+}
+
+vector<pair<int, string> >
+UWPCertificateI::getSubjectAlternativeNames() const
+{
+    return certificateAltNames(_cert->SubjectAlternativeName);
+}
+
+int
+UWPCertificateI::getVersion() const
+{
+    throw FeatureNotSupportedException(__FILE__, __LINE__);
+}
+
+Windows::Security::Cryptography::Certificates::Certificate^
+UWPCertificateI::getCert() const
+{
+    return _cert;
+}
+
+UWP::CertificatePtr
+UWP::Certificate::create(Windows::Security::Cryptography::Certificates::Certificate^ cert)
+{
+    return ICE_MAKE_SHARED(UWPCertificateI, cert);
+}
+
+UWP::CertificatePtr
+UWP::Certificate::load(const std::string& file)
+{
+    try
+    {
+        auto uri = ref new Uri(ref new String(stringToWstring(file).c_str()));
+        auto file = create_task(StorageFile::GetFileFromApplicationUriAsync(uri)).get();
+        auto buffer = create_task(FileIO::ReadTextAsync(file)).get();
+        return UWP::Certificate::decode(wstringToString(buffer->Data()));
+    }
+    catch(Platform::Exception^ ex)
+    {
+        if(HRESULT_CODE(ex->HResult) == ERROR_FILE_NOT_FOUND)
+        {
+            throw CertificateReadException(__FILE__, __LINE__, "error opening file :" + file);
+        }
+        else
+        {
+            throw Ice::SyscallException(__FILE__, __LINE__, ex->HResult);
+        }
+    }
+}
+
+UWP::CertificatePtr
+UWP::Certificate::decode(const std::string& encoding)
+{
+    string::size_type size, startpos, endpos = 0;
+    startpos = encoding.find("-----BEGIN CERTIFICATE-----", endpos);
+    if (startpos != string::npos)
+    {
+        startpos += sizeof("-----BEGIN CERTIFICATE-----");
+        endpos = encoding.find("-----END CERTIFICATE-----", startpos);
+        size = endpos - startpos;
+    }
+    else
+    {
+        startpos = 0;
+        endpos = string::npos;
+        size = encoding.size();
+    }
+
+    vector<unsigned char> data(IceInternal::Base64::decode(string(&encoding[startpos], size)));
+    auto writer = ref new DataWriter();
+    writer->WriteBytes(Platform::ArrayReference<unsigned char>(&data[0], static_cast<unsigned int>(data.size())));
+    return make_shared<UWPCertificateI>(ref new Certificates::Certificate(writer->DetachBuffer()));
+}

data/ext/ice/cpp/src/IceSSL/UWPEngine.cpp

@@ -0,0 +1,343 @@
+// **********************************************************************
+//
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+//
+// This copy of Ice is licensed to you under the terms described in the
+// ICE_LICENSE file included in this distribution.
+//
+// **********************************************************************
+
+#include <IceSSL/Config.h>
+
+#include <IceSSL/UWPEngineF.h>
+#include <IceSSL/UWPEngine.h>
+#include <IceSSL/UWPTransceiverI.h>
+#include <IceSSL/Util.h>
+
+#include <Ice/Communicator.h>
+#include <Ice/StringConverter.h>
+#include <Ice/StringUtil.h>
+#include <Ice/Properties.h>
+#include <Ice/Network.h>
+#include <IceUtil/Shared.h>
+
+#include <string>
+
+using namespace std;
+using namespace Ice;
+using namespace IceUtil;
+using namespace IceSSL;
+
+using namespace concurrency;
+using namespace Platform;
+using namespace Windows::Foundation;
+using namespace Windows::Foundation::Collections;
+using namespace Windows::Storage;
+using namespace Windows::Storage::Streams;
+using namespace Windows::Security::Cryptography;
+using namespace Windows::Security::Cryptography::Core;
+using namespace Windows::Security::Cryptography::Certificates;
+
+IceUtil::Shared* UWP::upCast(UWP::SSLEngine* p) { return p; }
+
+namespace
+{
+
+//
+// Find a certificate in the Application Personal certificate store
+// with the given friendly name. Returns the matching certificate or
+// nullptr if none is found.
+//
+Certificates::Certificate^
+findPersonalCertificate(String^ friendlyName)
+{
+    CertificateQuery^ query = ref new CertificateQuery();
+    query->IncludeDuplicates = true;
+    query->IncludeExpiredCertificates = true;
+    query->FriendlyName = friendlyName;
+    query->StoreName = StandardCertificateStoreNames::Personal;
+
+    try
+    {
+        auto certificates = IceInternal::runSync(CertificateStores::FindAllAsync(query));
+        return certificates->Size > 0 ? certificates->GetAt(0) : nullptr;
+    }
+    catch(Platform::Exception^ ex)
+    {
+        throw PluginInitializationException(__FILE__, __LINE__,
+                                            "IceSSL: certificate error:\n" + wstringToString(ex->Message->Data()));
+    }
+}
+
+//
+// Import a certificate in the Application Personal certificate store
+// with the given friendly name. Returns true if there was a password
+// error and false otherwise. If the import fails because a different
+// error PluginInitializationException exception is throw.
+//
+bool
+importPfxData(String^ friendlyName, String^ data, String^ password)
+{
+    try
+    {
+        IceInternal::runSync(CertificateEnrollmentManager::ImportPfxDataAsync(
+            data,
+            password,
+            ExportOption::NotExportable,
+            KeyProtectionLevel::NoConsent,
+            InstallOptions::None,
+            friendlyName));
+        return false; // The import succcess
+    }
+    catch(Platform::Exception^ ex)
+    {
+        if(HRESULT_CODE(ex->HResult) == ERROR_DECRYPTION_FAILED)
+        {
+            return true; // Password error
+        }
+        else
+        {
+            throw PluginInitializationException(__FILE__, __LINE__,
+                                                "IceSSL: certificate error:\n" + wstringToString(ex->Message->Data()));
+        }
+    }
+}
+
+Certificates::Certificate^
+importPersonalCertificate(const string& file, function<string ()> password, bool passwordPrompt,
+                          int passwordRetryMax)
+{
+    auto uri = ref new Uri(ref new String(stringToWstring(file).c_str()));
+    try
+    {
+        auto file = IceInternal::runSync(StorageFile::GetFileFromApplicationUriAsync(uri));
+        auto buffer = IceInternal::runSync(FileIO::ReadBufferAsync(file));
+
+        //
+        // Create a hash of the certificate to use as a friendly name, this will allow us
+        // to uniquely identify the certificate in the store.
+        //
+        auto hasher = HashAlgorithmProvider::OpenAlgorithm(HashAlgorithmNames::Sha1);
+        auto hash = hasher->CreateHash();
+
+        hash->Append(buffer);
+        String^ friendlyName = CryptographicBuffer::EncodeToBase64String(hash->GetValueAndReset());
+
+        //
+        // If the certificate is already in the store we avoid importing it.
+        //
+        Certificates::Certificate^ cert = findPersonalCertificate(friendlyName);
+        if(cert)
+        {
+            return cert;
+        }
+        else
+        {
+            String^ data = CryptographicBuffer::EncodeToBase64String(buffer);
+            int count = 0;
+            bool passwordErr = false;
+            do
+            {
+                passwordErr = importPfxData(friendlyName, data,
+                                            ref new String(stringToWstring(password()).c_str()));
+            }
+            while(passwordPrompt && passwordErr && ++count < passwordRetryMax);
+            if(passwordErr)
+            {
+                throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: error decoding certificate");
+            }
+            return findPersonalCertificate(friendlyName);
+        }
+    }
+    catch(Platform::Exception^ ex)
+    {
+        if(HRESULT_CODE(ex->HResult) == ERROR_FILE_NOT_FOUND)
+        {
+            throw PluginInitializationException(__FILE__, __LINE__, "certificate file not found:\n" + file);
+        }
+        else
+        {
+            throw PluginInitializationException(__FILE__, __LINE__,
+                                                "IceSSL: certificate error:\n" + wstringToString(ex->Message->Data()));
+        }
+    }
+}
+
+IVectorView<Certificates::Certificate^>^
+findCertificates(const string& name, const string& value)
+{
+    CertificateQuery^ query = ref new CertificateQuery();
+    query->StoreName = ref new String(stringToWstring(name).c_str());
+    query->IncludeDuplicates = true;
+    query->IncludeExpiredCertificates = true;
+
+    if(value != "*")
+    {
+        if(value.find(':', 0) == string::npos)
+        {
+            throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: no key in `" + value + "'");
+        }
+        size_t start = 0;
+        size_t pos;
+        while((pos = value.find(':', start)) != string::npos)
+        {
+            string field = IceUtilInternal::toUpper(IceUtilInternal::trim(value.substr(start, pos - start)));
+            if(field != "ISSUER" && field != "THUMBPRINT" && field != "FRIENDLYNAME")
+            {
+                throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: unknown key in `" + value + "'");
+            }
+
+            start = pos + 1;
+            while(start < value.size() && (value[start] == ' ' || value[start] == '\t'))
+            {
+                ++start;
+            }
+
+            if(start == value.size())
+            {
+                throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: missing argument in `" + value + "'");
+            }
+
+            string arg;
+            if(value[start] == '"' || value[start] == '\'')
+            {
+                size_t end = start;
+                ++end;
+                while(end < value.size())
+                {
+                    if(value[end] == value[start] && value[end - 1] != '\\')
+                    {
+                        break;
+                    }
+                    ++end;
+                }
+                if(end == value.size() || value[end] != value[start])
+                {
+                    throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: unmatched quote in `" + value + "'");
+                }
+                ++start;
+                arg = value.substr(start, end - start);
+                start = end + 1;
+            }
+            else
+            {
+                size_t end = value.find_first_of(" \t", start);
+                if(end == string::npos)
+                {
+                    arg = value.substr(start);
+                    start = value.size();
+                }
+                else
+                {
+                    arg = value.substr(start, end - start);
+                    start = end + 1;
+                }
+            }
+
+            if(field == "ISSUER")
+            {
+                query->IssuerName = ref new String(stringToWstring(arg).c_str());
+            }
+            else if(field == "FRIENDLYNAME")
+            {
+                query->FriendlyName = ref new String(stringToWstring(arg).c_str());
+            }
+            else if(field == "THUMBPRINT")
+            {
+                vector<BYTE> buffer;
+                if(!parseBytes(arg, buffer))
+                {
+                    throw PluginInitializationException(__FILE__, __LINE__,
+                        "IceSSL: invalid `IceSSL.FindCert' property: can't decode the value");
+                }
+                query->Thumbprint = ref new Array<unsigned char>(&buffer[0], static_cast<unsigned int>(buffer.size()));
+            }
+        }
+    }
+
+    try
+    {
+        return IceInternal::runSync(CertificateStores::FindAllAsync(query));
+    }
+    catch(Platform::Exception^ ex)
+    {
+        throw PluginInitializationException(__FILE__, __LINE__,
+                                            "IceSSL: certificate error:\n" + wstringToString(ex->Message->Data()));
+    }
+}
+
+} // anonymous namespace end
+
+UWP::SSLEngine::SSLEngine(const Ice::CommunicatorPtr& communicator) : IceSSL::SSLEngine(communicator)
+{
+}
+
+void
+UWP::SSLEngine::initialize()
+{
+    Mutex::Lock lock(_mutex);
+    if(_initialized)
+    {
+        return;
+    }
+
+    IceSSL::SSLEngine::initialize();
+
+    const auto properties = communicator()->getProperties();
+
+    //
+    // Load client certificate
+    //
+    const int passwordRetryMax = properties->getPropertyAsIntWithDefault("IceSSL.PasswordRetryMax", 3);
+    setPassword(properties->getProperty("IceSSL.Password"));
+
+    string certFile = properties->getProperty("IceSSL.CertFile");
+    string findCert = properties->getProperty("IceSSL.FindCert");
+    if(!certFile.empty())
+    {
+        _certificate = dynamic_pointer_cast<UWP::Certificate>(UWP::Certificate::create(importPersonalCertificate(
+            certFile,
+            [this]()
+            {
+                return password(false);
+            },
+            getPasswordPrompt() != nullptr,
+            passwordRetryMax)));
+    }
+    else if(!findCert.empty())
+    {
+        auto certs = findCertificates(properties->getPropertyWithDefault("IceSSL.CertStore", "My"), findCert);
+        if(certs->Size == 0)
+        {
+            throw Ice::PluginInitializationException(__FILE__, __LINE__, "IceSSL: no certificates found");
+        }
+        _certificate = dynamic_pointer_cast<UWP::Certificate>(UWP::Certificate::create(certs->GetAt(0)));
+    }
+    _initialized = true;
+}
+
+bool
+UWP::SSLEngine::initialized() const
+{
+    return _initialized;
+}
+
+shared_ptr<UWP::Certificate>
+UWP::SSLEngine::certificate()
+{
+    return _certificate;
+}
+
+void
+UWP::SSLEngine::destroy()
+{
+}
+
+IceInternal::TransceiverPtr
+UWP::SSLEngine::createTransceiver(const InstancePtr& instance,
+                                  const IceInternal::TransceiverPtr& delegate,
+                                  const string& hostOrAdapterName,
+                                  bool incoming)
+{
+    return new UWP::TransceiverI(instance, delegate, hostOrAdapterName, incoming);
+}