crosspki 3.0.0

Flutter plugin for handling X509 certificates and key pairs from native platform key stores.

crosspki

Flutter plugin for handling X509 certificates and key pairs from native platform key stores.

Using

import 'dart:convert';
import 'package:crosspki/crosspki.dart';

// Simple signing
await CrossPki.importPkcs12(p12Content, p12Password);
final certificates = await CrossPki.listCertificatesWithKey();
final userCertificate = certificates.first;

final hash = base64Decode('3/1gIbsr1bCvZ2KQgJ7DpTGR3YHH9wpLKGiKNiGCmG8=');
final signature = await CrossPki.signHash(userCert.thumbprint, DigestAlgorithm.sha256, hash);

Android: certificates the key store refuses

Should the Android Key Store refuse to attach an issued certificate to its key, importCertificate keeps the certificate in the plugin's private storage, under the key's alias, and listCertificatesWithKey, signData/signHash and removeCertificate treat it like any other. Nothing changes for the caller. The Xamarin CrossPki met such refusals; this plugin is not known to cause them, so this is a safeguard.

The kept copy is a plain DER file in the app's private storage, under no_backup, so it is excluded from Auto Backup and device transfer, like the key it belongs to.

Apps coming from the Xamarin CrossPki, which parked such certificates in an app-provided ICertificateStorage, can feed each parked certificate back to importCertificate(content, keyId): it lands in the key store where the device now allows it, and in the plugin's fallback storage where it still does not.

Android: the key of flutter_secure_storage

flutter_secure_storage keeps an RSA key pair with a self-signed certificate in the Android Key Store, under <packageName>.FlutterSecureStoragePluginKey (or its OAEP / storageNamespace variants). The plugin never reports it as a certificate: listCertificatesWithKey skips it, and signData/signHash/removeCertificate cannot reach it by thumbprint, so removing a certificate through this plugin can never delete the key that app's secure storage depends on. Every other key store entry with a private key and an X.509 certificate is listed, as in the Xamarin CrossPki.

Platform differences

• removeCertificate with a thumbprint that is not installed does nothing on Android, and throws a CrossPkiException with CrossPkiErrorCodes.certificateNotFound on iOS.

LICENSE

PROPRIETARY COMMERCIAL LICENSE

This is proprietary software/module part of Lacuna Software PkiSuite. For licensing please visit https://lacunasoftware.com