MSIX Architecture

For deploying applications to the Microsoft Store, the MSIX format is something you need to very familiar with. It is the wildly successful successor to the MSI format.

Start by reading the Overview on Microsoft Learn.  

For additional background you can read the Microsoft guide to packaging and deployment for Windows Applications. The latter will recommend Microsoft Store as the recommended distribution path for most developers.  Other avenues will require additional certificate signing obligations (and concomitant costs).

One of the first concepts the would-be MSIX master must learn is that of package identity. When your app is packaged as MSIX, Windows assigns an identity to it based on manifest information such as name, publisher, version, architecture and resource identifier (you find this in the AppManifest.xml).

One of the merits of MSIX usage is reliable install and uninstall. On the uninstall piece, it guarantees no leftover files or registry entries. On the install piece, it has a reported 99.96% install success rate.

Containerized execution is one of the more interesting aspects of MSIX. Apps run in a lightweight container with virtual file system and registry. An overview is here.

Root Certificates

In cryptography, a root certificate is a public key certificate that identifies a root certificate authority (CA).

Examples of certificate authorities (CAs) include SwissSign.

Root certificates are self-signed and forms the basis of an X.509-based public key infrastructure (PKI). Recall the X.509 is the ITU standard for defining the format of a public key certificate.

Worth reading also is RFC5280 which covers X.509 certificates and CRLs (certificate revocation lists).

Certificate Validation with Certifi in Python

The Python certifi package provides Mozilla's "carefully curated collection" of Root Certificates to validate the trustworthiness of SSL certificates while verifying the identify of TLS hosts. 

It has been extracted from the Requests project.

The PEM Format

PEM (Privacy Enhanced Mail) is a format used for transmitting cryptographic keys, certificates and other data.  

PEM structure consists of a text file in Base64 encoded data format (a binary-to-text encoding consisting of 64 printable characters - the idea is you can push binary data into a communication channel that only supports text). 

Base64 is famous for its use in attachments, since SMTP in its original form was designed to support 7-bit ASCII characters only.

An alternative to PEM in Java contexts is DER (Distinguished Encoding Rules) used for X.509 certificates and private keys.

Busting Certificate Issues in Ubuntu

Suppose you are running a data pipeline on Linux/Ubuntu that consumes data from the web. You get a RuntimeError: "SSL certificate verification failed".  What do you investigate?

Verifying the ca-certificates package and updating /etc/ssl/certs

 sudo apt-get install -y ca-certificates

installs the ca-certificates package (the -y means "say yes to all prompts").

This software processes certificates in PEM format.

With this installed, new certificates can be added to /usr/local/share/ca-certificates.  

The trust store can then be updated with:

sudo update-ca-certificates

You can then check if the certificate has been added.

ls /etc/ssl/certs | grep local-ca

Python Debugging: "SSL Certificate Verification Failed"

Ever seen this:

RuntimeError: Failed to fetch (insert_dataset_of_choice) data: SSL Certificate Verification Failed

This may happen in code that was previoulsy working. It can be caused by outdated or missing CA certificates. 

The Weird World of OCSP Revocation Checks (Certificate Status)

OCSP, or Online Certificate Status Protocol, enables real-time verification (for clients like web browsers) of digital certificate validity (rather than use downloaded lists of revoked certificates, a la CRLs, or certificate revocation lists). 

It reduces overhead in validation (could be useful in real-time use cases e.g. transaction processing).

Statuses can be "good", "revoked" or "unknown".

Certificate Authorities (CAs) are mandated to track certificates they revoke.