PEM format cert for TLS

[darwin67]

Feature request type

enhancement

Is your feature request related to a problem? Please describe

The security docs on the website specifies PKCS12 for TLS certificate format.
https://microsoft.github.io/garnet/docs/security

PEM is more widely used in Unix systems including Linux, so it'd be great if that can be supported as well.

Describe the solution you'd like

Be able to use .pem plain text files for TLS certificates.

Describe alternatives you've considered

No response

Additional context

No response

[mgravell]

Assuming you're using standard .NET certificate types, you can probably just lift most of the code (with my full blessing) directly from SE.Redis - see the SetUserPemCertificate method for the client-side part of this. Here's the core part from the SE.Redis code - not much to it:

#if NET5_0_OR_GREATER
        internal static LocalCertificateSelectionCallback CreatePemUserCertificateCallback(string userCertificatePath, string? userKeyPath)
        {
            // PEM handshakes not universally supported and causes a runtime error about ephemeral certificates; to avoid, export as PFX
            using var pem = X509Certificate2.CreateFromPemFile(userCertificatePath, userKeyPath);
#pragma warning disable SYSLIB0057 // Type or member is obsolete
            var pfx = new X509Certificate2(pem.Export(X509ContentType.Pfx));
#pragma warning restore SYSLIB0057 // Type or member is obsolete

            return (sender, targetHost, localCertificates, remoteCertificate, acceptableIssuers) => pfx;
        }
#endif

The tricky bit may be auto-detecting the file format, which I guess you could do using file extension, or by reading the first 10 bytes and checking them for -----BEGIN or ---- BEGIN.

Note that there are X509CertificateLoader.LoadCertificate[FromFile](...) methods, but unlike CreateFromPemFile, these don't seem to allow you to specify a password file/payload, which may make them useless. I assume you'd also want to choose to interpret the password parameter as a path in the case of PEM (although to be fair: the ungainliness of this is part of why I went for completely different methods in SE.Redis).