2.31.0

Use X509CertificateLoader on .NET 9+ (#1543 )
* Use X509CertificateLoader on .NET 9+ Preserve older-target certificate loading and add tests for supported formats, passwords, and embedded certificates. * ! * Potential fix for pull request finding 'Missed 'using' opportunity' Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com> * enum * namespace WireMock.Compatiblity; --------- Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
2026-11-13 12:23:42 +01:00 · 2026-11-12 20:58:02 +01:00 · 2026-11-12 20:56:01 +01:00 · 2026-11-12 20:03:03 +01:00 · 2026-11-11 08:28:03 +01:00 · 2026-11-11 08:21:10 +01:00
24 changed files with 303 additions and 98 deletions
@@ -14,10 +14,10 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

      - name: Setup .NET 8 and 10
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
        with:
          dotnet-version: |
            8.0.x
@@ -12,7 +12,7 @@ jobs:

    steps:
    - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

    - name: Build projects
      shell: pwsh
@@ -20,10 +20,10 @@ jobs:
      IsRunningOnGitHubActions: 'true'

    steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

    - name: Setup .NET 8 and 10
-      uses: actions/setup-dotnet@v4
+      uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
      with:
        dotnet-version: |
          8.0.x
@@ -58,26 +58,72 @@ jobs:
        IsRunningOnGitHubActions: 'true'

    steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

    - name: Setup .NET 8 and 10
-      uses: actions/setup-dotnet@v4
+      uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
      with:
        dotnet-version: |
          8.0.x
          10.0.x

+    - name: Setup Java 17
+      uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+      with:
+        distribution: temurin
+        java-version: '17'
+
+    - name: Install .NET coverage and SonarScanner tools
+      run: |
+        dotnet tool install --global dotnet-sonarscanner
+        dotnet tool install --global dotnet-coverage
+        echo "$HOME/.dotnet/tools" >> "$GITHUB_PATH"
+
+    - name: Begin analysis on SonarCloud
+      env:
+        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        PR_NUMBER: ${{ github.event.pull_request.number }}
+        PR_BRANCH: ${{ github.head_ref }}
+        PR_BASE: ${{ github.base_ref }}
+      run: |
+        sonar_args=(
+          /k:"wiremock_WireMock.Net"
+          /o:"wiremock"
+          /d:sonar.host.url="https://sonarcloud.io"
+          /d:sonar.token="$SONAR_TOKEN"
+          /d:sonar.cs.vscoveragexml.reportsPaths="**/wiremock-coverage-*.xml"
+          /d:sonar.verbose=true
+        )
+        if [ "$GITHUB_EVENT_NAME" = "pull_request" ]; then
+          sonar_args+=(
+            /d:sonar.pullrequest.provider=github
+            /d:sonar.pullrequest.key="$PR_NUMBER"
+            /d:sonar.pullrequest.branch="$PR_BRANCH"
+            /d:sonar.pullrequest.base="$PR_BASE"
+          )
+        else
+          sonar_args+=(/d:sonar.branch.name="$GITHUB_REF_NAME")
+        fi
+        dotnet sonarscanner begin "${sonar_args[@]}"
+
+    - name: Build test projects for coverage
+      run: |
+        dotnet build ./test/WireMock.Net.Tests/WireMock.Net.Tests.csproj --configuration Release --framework net10.0
+        dotnet build ./test/WireMock.Net.TUnitTests/WireMock.Net.TUnitTests.csproj --configuration Release --framework net10.0
+        dotnet build ./test/WireMock.Net.Middleware.Tests/WireMock.Net.Middleware.Tests.csproj --configuration Release --framework net10.0
+        dotnet build ./test/WireMock.Net.Aspire.Tests/WireMock.Net.Aspire.Tests.csproj --configuration Release --framework net10.0
+
    # - name: 'WireMock.Net.TUnitTests (net8.0)'
    #   run: dotnet test --project './test/WireMock.Net.TUnitTests/WireMock.Net.TUnitTests.csproj' -c Release --framework net8.0

-    - name: 'WireMock.Net.TUnitTests (net10.0)'
-      run: dotnet test --project './test/WireMock.Net.TUnitTests/WireMock.Net.TUnitTests.csproj' -c Release --framework net10.0
+    - name: 'WireMock.Net.TUnitTests (net10.0) with coverage'
+      run: dotnet-coverage collect "dotnet test --project ./test/WireMock.Net.TUnitTests/WireMock.Net.TUnitTests.csproj --configuration Release --no-build --framework net10.0" -f xml -o "wiremock-coverage-tunit.xml"

    # - name: 'WireMock.Net.Tests (net8.0)'
    #   run: dotnet test --project './test/WireMock.Net.Tests/WireMock.Net.Tests.csproj' -c Release --framework net8.0

-    - name: 'WireMock.Net.Tests (net10.0)'
-      run: dotnet test --project './test/WireMock.Net.Tests/WireMock.Net.Tests.csproj' -c Release --framework net10.0
+    - name: 'WireMock.Net.Tests (net10.0) with coverage'
+      run: dotnet-coverage collect "dotnet test --project ./test/WireMock.Net.Tests/WireMock.Net.Tests.csproj --configuration Release --no-build --framework net10.0" -f xml -o "wiremock-coverage-xunit.xml"

    - name: 'WireMock.Net.Tests.UsingNuGet (net8.0)'
      run: dotnet test --project './test/WireMock.Net.Tests.UsingNuGet/WireMock.Net.Tests.UsingNuGet.csproj' -c Release --framework net8.0
@@ -88,14 +134,28 @@ jobs:
    # - name: 'WireMock.Net.Middleware.Tests (net8.0)'
    #   run: dotnet test --project './test/WireMock.Net.Middleware.Tests/WireMock.Net.Middleware.Tests.csproj' -c Release --framework net8.0

-    - name: 'WireMock.Net.Middleware.Tests (net10.0)'
-      run: dotnet test --project './test/WireMock.Net.Middleware.Tests/WireMock.Net.Middleware.Tests.csproj' -c Release --framework net10.0
+    - name: 'WireMock.Net.Middleware.Tests (net10.0) with coverage'
+      run: dotnet-coverage collect "dotnet test --project ./test/WireMock.Net.Middleware.Tests/WireMock.Net.Middleware.Tests.csproj --configuration Release --no-build --framework net10.0" -f xml -o "wiremock-coverage-middleware.xml"

    # - name: 'WireMock.Net.Aspire.Tests (net8.0)'
    #   run: dotnet test --project './test/WireMock.Net.Aspire.Tests/WireMock.Net.Aspire.Tests.csproj' -c Release --framework net8.0

-    - name: 'WireMock.Net.Aspire.Tests (net10.0)'
-      run: dotnet test --project './test/WireMock.Net.Aspire.Tests/WireMock.Net.Aspire.Tests.csproj' -c Release --framework net10.0
+    - name: 'WireMock.Net.Aspire.Tests (net10.0) with coverage'
+      run: dotnet-coverage collect "dotnet test --project ./test/WireMock.Net.Aspire.Tests/WireMock.Net.Aspire.Tests.csproj --configuration Release --no-build --framework net10.0" -f xml -o "wiremock-coverage-aspire.xml"
+
+    - name: Merge coverage files
+      run: dotnet coverage merge **/wiremock-coverage-*.xml --output ./test/wiremock-coverage.xml --output-format xml
+
+    - name: End analysis on SonarCloud
+      env:
+        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+      run: dotnet sonarscanner end /d:sonar.token="$SONAR_TOKEN"
+
+    - name: Upload coverage results to Codecov
+      uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
+      with:
+        token: ${{ secrets.CODECOV_TOKEN }}
+        files: ./test/wiremock-coverage.xml

    - name: 'dotnet-WireMock stops on CTRL-C'
      run: |
@@ -1,3 +1,11 @@
+# 2.31.0 (12 November 2026)
+- [#1538](https://github.com/wiremock/WireMock.Net/pull/1538) - Bump Microsoft.AspNetCore.WebUtilities from 2.3.0 to 2.3.14 [dependencies] contributed by [dependabot[bot]](https://github.com/apps/dependabot)
+- [#1540](https://github.com/wiremock/WireMock.Net/pull/1540) - Bump Aspire from 13.6.4 to 13.6.5 [dependencies] contributed by [StefH](https://github.com/StefH)
+- [#1542](https://github.com/wiremock/WireMock.Net/pull/1542) - Upgrade dependencies [dependencies] contributed by [StefH](https://github.com/StefH)
+- [#1543](https://github.com/wiremock/WireMock.Net/pull/1543) - Use X509CertificateLoader on .NET 9+ [bug] contributed by [StefH](https://github.com/StefH)
+- [#1365](https://github.com/wiremock/WireMock.Net/issues/1365) - Client certificate authentication works with .NET 8 and fails with .NET 9 [bug]
+- [#1541](https://github.com/wiremock/WireMock.Net/issues/1541) - WireMock.Shared depends on Microsoft.AspNetCore.Http 2.3.9 which has a high-severity vulnerability [dependencies]
+
 # 2.30.0 (07 November 2026)
 - [#1527](https://github.com/wiremock/WireMock.Net/pull/1527) - Publish standalone single-file binaries in GitHub Releases [feature] contributed by [tomas-pinto](https://github.com/tomas-pinto)
 - [#1528](https://github.com/wiremock/WireMock.Net/pull/1528) - Add .NET 10 target framework [feature] contributed by [StefH](https://github.com/StefH)
@@ -4,7 +4,7 @@
    </PropertyGroup>

    <PropertyGroup>
-        <VersionPrefix>2.30.0</VersionPrefix>
+        <VersionPrefix>2.31.0</VersionPrefix>
        <PackageIcon>WireMock.Net-Logo.png</PackageIcon>
        <PackageProjectUrl>https://github.com/wiremock/WireMock.Net</PackageProjectUrl>
        <PackageLicenseExpression>Apache-2.0</PackageLicenseExpression>
@@ -1,7 +1,9 @@
-# 2.30.0 (07 November 2026)
- #1527 Publish standalone single-file binaries in GitHub Releases [feature]
- #1528 Add .NET 10 target framework [feature]
- #1530 Use 10.x.x NuGets for .NET 10 [dependencies]
- #1532 Switch to IHost for .NET 10 + update dotnet-WireMock [feature]
+# 2.31.0 (12 November 2026)
+- #1538 Bump Microsoft.AspNetCore.WebUtilities from 2.3.0 to 2.3.14 [dependencies]
+- #1540 Bump Aspire from 13.6.4 to 13.6.5 [dependencies]
+- #1542 Upgrade dependencies [dependencies]
+- #1543 Use X509CertificateLoader on .NET 9+ [bug]
+- #1365 Client certificate authentication works with .NET 8 and fails with .NET 9 [bug]
+- #1541 WireMock.Shared depends on Microsoft.AspNetCore.Http 2.3.9 which has a high-severity vulnerability [dependencies]

 The full release notes can be found here: https://github.com/wiremock/WireMock.Net/blob/master/CHANGELOG.md
@@ -40,9 +40,9 @@ A C# .NET version based on [mock4net](https://github.com/alexvictoor/mock4net) w
 | ***Quality*** | &nbsp; |
 | &nbsp;&nbsp;**Build Azure** | [![Build Status Azure](https://stef.visualstudio.com/WireMock.Net/_apis/build/status/WireMock.Net)](https://stef.visualstudio.com/WireMock.Net/_build/latest?definitionId=61) |
 | &nbsp;&nbsp;**Build GitHub** | [![Run Tests](https://github.com/wiremock/WireMock.Net/actions/workflows/ci.yml/badge.svg)](https://github.com/wiremock/WireMock.Net/actions/workflows/ci.yml)
-| &nbsp;&nbsp;**Quality** | [![Sonar Quality Gate](https://sonarcloud.io/api/project_badges/measure?project=WireMock-Net_WireMock.Net&metric=alert_status)](https://sonarcloud.io/project/issues?id=WireMock-Net_WireMock.Net) [![CodeFactor](https://www.codefactor.io/repository/github/wiremock/wiremock.net/badge)](https://www.codefactor.io/repository/github/wiremock/wiremock.net) |
-| &nbsp;&nbsp;**SonarQube** | [![Sonar Bugs](https://sonarcloud.io/api/project_badges/measure?project=WireMock-Net_WireMock.Net&metric=bugs)](https://sonarcloud.io/project/issues?id=WireMock-Net_WireMock.Net&resolved=false&types=BUG) [![Sonar Code Smells](https://sonarcloud.io/api/project_badges/measure?project=WireMock-Net_WireMock.Net&metric=code_smells)](https://sonarcloud.io/project/issues?id=WireMock-Net_WireMock.Net&resolved=false&types=CODE_SMELL) |
-| &nbsp;&nbsp;**Coverage** | [![Sonar Coverage](https://sonarcloud.io/api/project_badges/measure?project=WireMock-Net_WireMock.Net&metric=coverage)](https://sonarcloud.io/component_measures?id=WireMock-Net_WireMock.Net&metric=coverage) [![codecov](https://codecov.io/gh/wiremock/WireMock.Net/branch/master/graph/badge.svg)](https://codecov.io/gh/wiremock/WireMock.Net)|
+| &nbsp;&nbsp;**Quality** | [![Sonar Quality Gate](https://sonarcloud.io/api/project_badges/measure?project=wiremock_WireMock.Net&metric=alert_status)](https://sonarcloud.io/project/issues?id=wiremock_WireMock.Net) [![CodeFactor](https://www.codefactor.io/repository/github/wiremock/wiremock.net/badge)](https://www.codefactor.io/repository/github/wiremock/wiremock.net) |
+| &nbsp;&nbsp;**SonarQube** | [![Sonar Bugs](https://sonarcloud.io/api/project_badges/measure?project=wiremock_WireMock.Net&metric=bugs)](https://sonarcloud.io/project/issues?id=wiremock_WireMock.Net&resolved=false&types=BUG) [![Sonar Code Smells](https://sonarcloud.io/api/project_badges/measure?project=wiremock_WireMock.Net&metric=code_smells)](https://sonarcloud.io/project/issues?id=wiremock_WireMock.Net&resolved=false&types=CODE_SMELL) |
+| &nbsp;&nbsp;**Coverage** | [![Sonar Coverage](https://sonarcloud.io/api/project_badges/measure?project=wiremock_WireMock.Net&metric=coverage)](https://sonarcloud.io/component_measures?id=wiremock_WireMock.Net&metric=coverage) [![codecov](https://codecov.io/gh/wiremock/WireMock.Net/branch/master/graph/badge.svg)](https://codecov.io/gh/wiremock/WireMock.Net)|
 | &nbsp;&nbsp;**TIOBE** | [TIOBE Quality Indicator](https://ticsdemo.tiobe.com/tiobeweb/DEMO/TqiDashboard.html#axes=Project(WireMock.Net),Sub()&metric=tqi)

 ### :package: NuGet packages
@@ -1,3 +1,6 @@
+trigger: none
+pr: none
+
 parameters:
 - name: runWindowsReleaseToMyGet
  displayName: Run Windows Release to MyGet
@@ -45,7 +48,7 @@ jobs:

  # See: https://docs.sonarsource.com/sonarcloud/enriching/test-coverage/dotnet-test-coverage
  - script: |
-      dotnet sonarscanner begin /k:"WireMock-Net_WireMock.Net" /o:"wiremock-net" /d:sonar.branch.name=$(Build.SourceBranchName) /d:sonar.host.url="https://sonarcloud.io" /d:sonar.token="$(SONAR_TOKEN)" /d:sonar.pullrequest.provider=github /d:sonar.cs.vscoveragexml.reportsPaths=**/wiremock-coverage-*.xml /d:sonar.verbose=true
+      dotnet sonarscanner begin /k:"wiremock_WireMock.Net" /o:"wiremock" /d:sonar.branch.name=$(Build.SourceBranchName) /d:sonar.host.url="https://sonarcloud.io" /d:sonar.token="$(SONAR_TOKEN)" /d:sonar.pullrequest.provider=github /d:sonar.cs.vscoveragexml.reportsPaths=**/wiremock-coverage-*.xml /d:sonar.verbose=true
    displayName: 'Begin analysis on SonarCloud'
    condition: and(succeeded(), ne(variables['Build.Reason'], 'PullRequest')) # Do not run for PullRequests

@@ -1,6 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk">

-    <Sdk Name="Aspire.AppHost.Sdk" Version="13.6.4" />
+    <Sdk Name="Aspire.AppHost.Sdk" Version="13.6.5" />

    <PropertyGroup>
        <OutputType>Exe</OutputType>
@@ -19,7 +19,7 @@
    </ItemGroup>

    <ItemGroup>
-        <PackageReference Include="Aspire.Hosting.AppHost" Version="13.6.4" />
+        <PackageReference Include="Aspire.Hosting.AppHost" Version="13.6.5" />
    </ItemGroup>

    <ItemGroup>
@@ -1,6 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk">

-    <Sdk Name="Aspire.AppHost.Sdk" Version="13.6.4" />
+    <Sdk Name="Aspire.AppHost.Sdk" Version="13.6.5" />

    <PropertyGroup>
        <OutputType>Exe</OutputType>
@@ -16,7 +16,7 @@
    </ItemGroup>

    <ItemGroup>
-        <PackageReference Include="Aspire.Hosting.AppHost" Version="13.6.4" />
+        <PackageReference Include="Aspire.Hosting.AppHost" Version="13.6.5" />
    </ItemGroup>

 </Project>
@@ -1,22 +1,24 @@
 <Project Sdk="Microsoft.NET.Sdk">

-  <PropertyGroup>
-    <OutputType>Exe</OutputType>
-    <TargetFramework>net10.0</TargetFramework>
-    <ImplicitUsings>enable</ImplicitUsings>
-    <Nullable>enable</Nullable>
-  </PropertyGroup>
+    <PropertyGroup>
+        <OutputType>Exe</OutputType>
+        <TargetFramework>net10.0</TargetFramework>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <Nullable>enable</Nullable>
+    </PropertyGroup>

-  <!--<ItemGroup>
-    <ProjectReference Include="..\..\src\WireMock.Net\WireMock.Net.csproj" />
-  </ItemGroup>-->
+    <ItemGroup>
+        <PackageReference Update="SonarAnalyzer.CSharp" Version="10.12.0.118525" />
+    </ItemGroup>

-  <ItemGroup>
-    <PackageReference Update="SonarAnalyzer.CSharp" Version="10.12.0.118525" />
-  </ItemGroup>
+    <ItemGroup>
+        <PackageReference Include="WireMock.Net" Version="2.30.0" />
+    </ItemGroup>

-  <ItemGroup>
-    <PackageReference Include="WireMock.Net" Version="2.15.0" />
-  </ItemGroup>
+    <!-- CVE -->
+    <ItemGroup>
+        <PackageReference Include="Microsoft.AspNetCore.Http" Version="2.3.14" />
+        <PackageReference Include="Microsoft.AspNetCore.WebUtilities" Version="2.3.14" />
+    </ItemGroup>

 </Project>
@@ -90,8 +90,11 @@
    <PackageReference Include="Microsoft.AspNetCore.Server.Kestrel.Core">
      <Version>2.3.11</Version>
    </PackageReference>
+    <PackageReference Include="Microsoft.AspNetCore.WebUtilities">
+      <Version>2.3.14</Version>
+    </PackageReference>
    <PackageReference Include="WireMock.Net">
-      <Version>2.12.0</Version>
+      <Version>2.30.0</Version>
    </PackageReference>
  </ItemGroup>
  <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">

    <PropertyGroup>
        <ImplicitUsings>enable</ImplicitUsings>
@@ -46,7 +46,7 @@
    </PropertyGroup>

    <ItemGroup>
-        <PackageReference Include="Aspire.Hosting" Version="13.6.4" />
+        <PackageReference Include="Aspire.Hosting" Version="13.6.5" />
    </ItemGroup>

    <ItemGroup>
@@ -2,6 +2,9 @@

 using System.Security.Cryptography.X509Certificates;
 using WireMock.Owin;
+#if NETSTANDARD2_0
+using Enum = WireMock.Compatiblity.EnumCompat;
+#endif

 namespace WireMock.HttpsCertificate;

@@ -18,32 +21,24 @@ internal static class CertificateLoader
        {
            var thumbprintOrSubjectNameOrHost = options.X509ThumbprintOrSubjectName ?? host;

-            var certStore = new X509Store((StoreName)Enum.Parse(typeof(StoreName), options.X509StoreName!), (StoreLocation)Enum.Parse(typeof(StoreLocation), options.X509StoreLocation!));
-            try
-            {
-                certStore.Open(OpenFlags.ReadOnly);
+            using var certStore = new X509Store(Enum.Parse<StoreName>(options.X509StoreName!), Enum.Parse<StoreLocation>(options.X509StoreLocation!));
+            certStore.Open(OpenFlags.ReadOnly);

-                // Attempt to find by Thumbprint first
-                var matchingCertificates = certStore.Certificates.Find(X509FindType.FindByThumbprint, thumbprintOrSubjectNameOrHost, false);
+            // Attempt to find by Thumbprint first
+            var matchingCertificates = certStore.Certificates.Find(X509FindType.FindByThumbprint, thumbprintOrSubjectNameOrHost, false);
+            if (matchingCertificates.Count == 0)
+            {
+                // Fallback to SubjectName
+                matchingCertificates = certStore.Certificates.Find(X509FindType.FindBySubjectName, thumbprintOrSubjectNameOrHost, false);
                if (matchingCertificates.Count == 0)
                {
-                    // Fallback to SubjectName
-                    matchingCertificates = certStore.Certificates.Find(X509FindType.FindBySubjectName, thumbprintOrSubjectNameOrHost, false);
-                    if (matchingCertificates.Count == 0)
-                    {
-                        // No certificates matched the search criteria.
-                        throw new FileNotFoundException($"No Certificate found with in store '{options.X509StoreName}', location '{options.X509StoreLocation}' for Thumbprint or SubjectName '{thumbprintOrSubjectNameOrHost}'.");
-                    }
+                    // No certificates matched the search criteria.
+                    throw new FileNotFoundException($"No Certificate found with in store '{options.X509StoreName}', location '{options.X509StoreLocation}' for Thumbprint or SubjectName '{thumbprintOrSubjectNameOrHost}'.");
                }
+            }

-                // Use the first matching certificate.
-                return matchingCertificates[0];
-            }
-            finally
-            {
-                certStore.Dispose();
-                certStore.Close();
-            }
+            // Use the first matching certificate.
+            return matchingCertificates[0];
        }

        if (!string.IsNullOrEmpty(options.X509CertificateFilePath))
@@ -55,10 +50,14 @@ internal static class CertificateLoader
                if (!string.IsNullOrEmpty(options.X509CertificatePassword))
                {
                    var certPem = File.ReadAllText(options.X509CertificateFilePath);
-                    var cert = X509Certificate2.CreateFromPem(certPem, options.X509CertificatePassword);
+                    using var cert = X509Certificate2.CreateFromPem(certPem, options.X509CertificatePassword);
                    const string defaultPasswordPem = "WireMock.Net";

+#if NET9_0_OR_GREATER
+                    return X509CertificateLoader.LoadPkcs12(cert.Export(X509ContentType.Pfx, defaultPasswordPem), defaultPasswordPem);
+#else
                    return new X509Certificate2(cert.Export(X509ContentType.Pfx, defaultPasswordPem), defaultPasswordPem);
+#endif
                }
                return X509Certificate2.CreateFromPemFile(options.X509CertificateFilePath);
 #else                
@@ -66,9 +65,29 @@ internal static class CertificateLoader
 #endif
            }

+#if NET9_0_OR_GREATER
+            var data = File.ReadAllBytes(options.X509CertificateFilePath);
+            var contentType = X509Certificate2.GetCertContentType(data);
+            if (contentType == X509ContentType.Pfx)
+            {
+                return X509CertificateLoader.LoadPkcs12(data, string.IsNullOrEmpty(options.X509CertificatePassword) ? null : options.X509CertificatePassword);
+            }
+            if (contentType == X509ContentType.Cert)
+            {
+                return X509CertificateLoader.LoadCertificate(data);
+            }
+
+            // The loader does not support legacy formats such as PKCS#7 and serialized certificates.
+            #pragma warning disable SYSLIB0057
+            return !string.IsNullOrEmpty(options.X509CertificatePassword) ?
+                new X509Certificate2(data, options.X509CertificatePassword) :
+                new X509Certificate2(data);
+            #pragma warning restore SYSLIB0057
+#else
            return !string.IsNullOrEmpty(options.X509CertificatePassword) ?
                new X509Certificate2(options.X509CertificateFilePath, options.X509CertificatePassword) :
                new X509Certificate2(options.X509CertificateFilePath);
+#endif
        }

        if (options.X509Certificate != null)
@@ -89,6 +89,10 @@ wTM1Z+CJZG9xAcf1zAVGl4ggYyYEFGBFyJ8VBwijS2zy1qwN1WYGtcWoAgIH0A==
    public static X509Certificate2 GetX509Certificate2()
    {
        byte[] data = Convert.FromBase64String(Data);
+#if NET9_0_OR_GREATER
+        return X509CertificateLoader.LoadPkcs12(data, null);
+#else
        return new X509Certificate2(data);
+#endif
    }
 }
@@ -0,0 +1,10 @@
+// Copyright © WireMock.Net
+
+#if NETSTANDARD2_0
+namespace WireMock.Compatiblity;
+
+internal static class EnumCompat
+{
+    public static TEnum Parse<TEnum>(string value) where TEnum : struct, Enum =>  (TEnum)Enum.Parse(typeof(TEnum), value);
+}
+#endif
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
    <PropertyGroup>
        <Description>Shared interfaces, models, enumerations and types.</Description>
        <Authors>Stef Heyenrath</Authors>
@@ -25,8 +25,13 @@
        <GeneratePackageOnBuild>true</GeneratePackageOnBuild>
    </PropertyGroup>

+    <!-- CVE -->
+    <ItemGroup>
+        <PackageReference Include="Microsoft.AspNetCore.Http" Version="2.3.14" />
+        <PackageReference Include="Microsoft.AspNetCore.WebUtilities" Version="2.3.14" />
+    </ItemGroup>
+
    <ItemGroup>
-        <PackageReference Include="Microsoft.AspNetCore.Http" Version="2.3.9" />
        <PackageReference Include="Stef.Validation" Version="0.3.0" />
        <PackageReference Include="AnyOf" Version="0.5.0.1" />
        <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="8.0.2" Condition=" '$(TargetFramework)' != 'net10.0' " />
@@ -1,8 +1,6 @@
 // Copyright © WireMock.Net

-using System;
 using System.Diagnostics.CodeAnalysis;
-using System.Linq;
 using System.Reflection;
 using JetBrains.Annotations;
 using Stef.Validation;
@@ -1,6 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk">

-    <Sdk Name="Aspire.AppHost.Sdk" Version="13.6.4" />
+    <Sdk Name="Aspire.AppHost.Sdk" Version="13.6.5" />

    <PropertyGroup>
        <OutputType>Exe</OutputType>
@@ -20,7 +20,7 @@
    </ItemGroup>

    <ItemGroup>
-        <PackageReference Include="Aspire.Hosting.AppHost" Version="13.6.4" />
+        <PackageReference Include="Aspire.Hosting.AppHost" Version="13.6.5" />
    </ItemGroup>

    <ItemGroup>
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">

    <PropertyGroup>
        <TargetFrameworks>net8.0;net10.0</TargetFrameworks>
@@ -14,7 +14,7 @@
    </PropertyGroup>

    <ItemGroup>
-        <PackageReference Include="Aspire.Hosting.Testing" Version="13.6.4" />
+        <PackageReference Include="Aspire.Hosting.Testing" Version="13.6.5" />
        <PackageReference Include="Codecov" Version="1.13.0" />
        <PackageReference Include="coverlet.msbuild" Version="6.0.4">
            <PrivateAssets>all</PrivateAssets>
@@ -39,4 +39,10 @@
        <PackageReference Update="SonarAnalyzer.CSharp" Version="10.11.0.117924" />
    </ItemGroup>

+    <!-- CVE -->
+    <ItemGroup>
+        <PackageReference Include="Microsoft.AspNetCore.Http" Version="2.3.14" />
+        <PackageReference Include="Microsoft.AspNetCore.WebUtilities" Version="2.3.14" />
+    </ItemGroup>
+
 </Project>
@@ -0,0 +1,87 @@
+// Copyright © WireMock.Net
+
+#if NET8_0_OR_GREATER
+using System.Security.Cryptography;
+using System.Security.Cryptography.X509Certificates;
+using WireMock.HttpsCertificate;
+using WireMock.Owin;
+
+namespace WireMock.Net.Tests.HttpsCertificate;
+
+public class CertificateLoaderTests
+{
+    [Theory]
+    [InlineData("pfx", null, true)]
+    [InlineData("pfx", "password", true)]
+    [InlineData("cer", null, false)]
+    [InlineData("cer", "password", false)]
+    [InlineData("pem", null, true)]
+    [InlineData("pem", "private-key", true)]
+    public void LoadCertificate_LoadsSupportedFormats(string format, string? password, bool hasPrivateKey)
+    {
+        using var key = RSA.Create(2048);
+        var request = new CertificateRequest("CN=localhost", key, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
+        using var original = request.CreateSelfSigned(DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(1));
+        var path = Path.Combine(Path.GetTempPath(), $"{Guid.NewGuid()}.{format}");
+
+        try
+        {
+            if (format == "pem")
+            {
+                var pem = original.ExportCertificatePem();
+                File.WriteAllText(path, password == null ? pem + "\n" + key.ExportPkcs8PrivateKeyPem() : pem);
+            }
+            else
+            {
+                var contentType = format == "pfx" ? X509ContentType.Pfx : X509ContentType.Cert;
+                File.WriteAllBytes(path, original.Export(contentType, format == "pfx" ? password : null));
+            }
+
+            var options = new WireMockMiddlewareOptions
+            {
+                X509CertificateFilePath = path,
+                X509CertificatePassword = format == "pem" && password != null ? key.ExportPkcs8PrivateKeyPem() : password
+            };
+            using var loaded = CertificateLoader.LoadCertificate(options, "localhost");
+
+            loaded.Thumbprint.Should().Be(original.Thumbprint);
+            loaded.HasPrivateKey.Should().Be(hasPrivateKey);
+        }
+        finally
+        {
+            File.Delete(path);
+        }
+    }
+
+    [Fact]
+    public void LoadCertificate_InvalidPfxPassword_Throws()
+    {
+        using var key = RSA.Create(2048);
+        var request = new CertificateRequest("CN=localhost", key, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
+        using var original = request.CreateSelfSigned(DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(1));
+        var path = Path.Combine(Path.GetTempPath(), $"{Guid.NewGuid()}.pfx");
+
+        try
+        {
+            File.WriteAllBytes(path, original.Export(X509ContentType.Pfx, "password"));
+            var options = new WireMockMiddlewareOptions { X509CertificateFilePath = path, X509CertificatePassword = "wrong" };
+
+            Action load = () => CertificateLoader.LoadCertificate(options, "localhost");
+            load.Should().Throw<CryptographicException>();
+        }
+        finally
+        {
+            File.Delete(path);
+        }
+    }
+
+    [Fact]
+    public void GetX509Certificate2_LoadsEmbeddedCertificate()
+    {
+        using var certificate = PublicCertificateHelper.GetX509Certificate2();
+
+        certificate.HasPrivateKey.Should().BeTrue();
+        certificate.Thumbprint.Should().NotBeNullOrEmpty();
+    }
+}
+#endif
@@ -16,7 +16,7 @@ public class WebSocketIntegrationTests(ITestOutputHelper output, ITestContextAcc
    private readonly CancellationToken _ct = testContext.Current.CancellationToken;

    [Fact]
-    public async Task WithNoSetupShouldJustWaitForClose_AndCLose_When_ClientCloses()
+    public async Task WithNoSetupShouldJustWaitForClose_AndClose_When_ClientCloses()
    {
        // Arrange
        using var server = WireMockServer.Start(new WireMockServerSettings
@@ -706,12 +706,14 @@ public class WebSocketIntegrationTests(ITestOutputHelper output, ITestContextAcc
    public async Task WithWebSocketProxy_Should_Proxy_Multiple_TextMessages()
    {
        // Arrange - Start target echo server
-        var exampleEchoServer = WireMockServer.Start(new WireMockServerSettings
+        using var exampleEchoServer = WireMockServer.Start(new WireMockServerSettings
        {
            Logger = new TestOutputHelperWireMockLogger(output),
            Urls = ["ws://localhost:0"]
        });

+        await Task.Delay(500, _ct);
+
        exampleEchoServer
            .Given(Request.Create()
                .WithPath("/ws/target")
@@ -724,12 +726,14 @@ public class WebSocketIntegrationTests(ITestOutputHelper output, ITestContextAcc
        await Task.Delay(500, _ct);

        // Arrange - Start proxy server
-        var sut = WireMockServer.Start(new WireMockServerSettings
+        using var sut = WireMockServer.Start(new WireMockServerSettings
        {
            Logger = new TestOutputHelperWireMockLogger(output),
            Urls = ["ws://localhost:0"]
        });

+        await Task.Delay(500, _ct);
+
        sut
            .Given(Request.Create()
                .WithPath("/ws/proxy")
@@ -761,26 +765,20 @@ public class WebSocketIntegrationTests(ITestOutputHelper output, ITestContextAcc
        }

        await client.CloseAsync(WebSocketCloseStatus.NormalClosure, "Test complete", _ct);
-
-        await Task.Delay(250, _ct);
-
-        sut.Stop();
-        sut.Dispose();
-
-        exampleEchoServer.Stop();
-        exampleEchoServer.Dispose();
    }

    [Fact]
    public async Task WithWebSocketProxy_Should_Proxy_Binary_Messages()
    {
        // Arrange - Start target echo server
-        var exampleEchoServer = WireMockServer.Start(new WireMockServerSettings
+        using var exampleEchoServer = WireMockServer.Start(new WireMockServerSettings
        {
            Logger = new TestOutputHelperWireMockLogger(output),
            Urls = ["ws://localhost:0"]
        });

+        await Task.Delay(500, _ct);
+
        exampleEchoServer
            .Given(Request.Create()
                .WithPath("/ws/target")
@@ -793,12 +791,14 @@ public class WebSocketIntegrationTests(ITestOutputHelper output, ITestContextAcc
        await Task.Delay(500, _ct);

        // Arrange - Start proxy server
-        var sut = WireMockServer.Start(new WireMockServerSettings
+        using var sut = WireMockServer.Start(new WireMockServerSettings
        {
            Logger = new TestOutputHelperWireMockLogger(output),
            Urls = ["ws://localhost:0"]
        });

+        await Task.Delay(500, _ct);
+
        sut
            .Given(Request.Create()
                .WithPath("/ws/proxy")
@@ -828,15 +828,9 @@ public class WebSocketIntegrationTests(ITestOutputHelper output, ITestContextAcc
        // Assert
        receivedData.Should().BeEquivalentTo(testData, "binary data should be proxied and echoed back");

+        await Task.Delay(500, _ct);
+
        await client.CloseAsync(WebSocketCloseStatus.NormalClosure, "Test complete", _ct);
-
-        await Task.Delay(250, _ct);
-
-        sut.Stop();
-        sut.Dispose();
-
-        exampleEchoServer.Stop();
-        exampleEchoServer.Dispose();
    }

    [Fact]
@@ -35,8 +35,12 @@ public partial class WireMockServerTests
                    : 403
            }));

+#if NET9_0_OR_GREATER
+        var certificates = X509CertificateLoader.LoadPkcs12CollectionFromFile("client_cert.pfx", "1234", X509KeyStorageFlags.Exportable);
+#else
        var certificates = new X509Certificate2Collection();
        certificates.Import("client_cert.pfx", "1234", X509KeyStorageFlags.Exportable);
+#endif

        var httpMessageHandler = new HttpClientHandler
        {
Author	SHA1	Message	Date
Stef Heyenrath	567f94d70d	2.31.0	2026-11-12 20:58:02 +01:00
Stef HeyenrathandCopilot Autofix powered by AI	22576eb539	Use X509CertificateLoader on .NET 9+ (#1543 ) * Use X509CertificateLoader on .NET 9+ Preserve older-target certificate loading and add tests for supported formats, passwords, and embedded certificates. * ! * Potential fix for pull request finding 'Missed 'using' opportunity' Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com> * enum * namespace WireMock.Compatiblity; --------- Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>	2026-11-12 20:56:01 +01:00
Stef Heyenrath	384c083a78	Upgrade dependencies	2026-11-12 20:03:03 +01:00
dependabot[bot]	920b5b48f2	Bump Microsoft.AspNetCore.WebUtilities from 2.3.0 to 2.3.14 (#1538 ) --- updated-dependencies: - dependency-name: Microsoft.AspNetCore.WebUtilities dependency-version: 2.3.14 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-11-11 08:28:03 +01:00
Stef Heyenrath	b7a02e2971	Bump Aspire from 13.6.4 to 13.6.5	2026-11-11 08:21:10 +01:00
Stef Heyenrath	dbf90c6888	New SonarCloud project (#1534 ) * SonarCloud test * xxx * WebSocketIntegrationTests * move sonar to github * SonarCloud now runs for every Linux workflow event. The begin step supplies pull-request key/branch/base metadata for PRs and branch metadata for pushes; the end step is no longer gated. Workflow YAML parsing and the solution build both pass. * SHA	2026-11-11 07:57:54 +01:00