[quoted text, click to view]

If you want to prevent the CLR from loading an assembly based on the CA that
issued its authenticode signing certificate, you would need to modify the
CLR's behaviour in a way that is not possible without hacking the CLR.
However, you can certainly add a CA verification to your own code that loads
your plug-in assemblies.

[quoted text, click to view]

The easiest approach would probably involve simply checking the issuing CA
for the assembly signing certificate. For example, if the CA name is enough
for you, something like this should do the trick:

private bool CheckCA(Assembly assembly)
{
bool retVal = false;

Publisher publisher = this.GetPublisher(assembly);
if (publisher != null)
{
retVal = (publisher.Certificate.Issuer == "<your CA>");
}

return retVal;
}

private Publisher GetPublisher(Assembly assembly)
{
IEnumerator evidenceEnumerator = assembly.Evidence.GetEnumerator();
while (evidenceEnumerator.MoveNext())
{
Publisher publisherEvidence = evidenceEnumerator.Current as
Publisher;
if (publisherEvidence != null) return publisherEvidence;
}

return null;
}

In the above approach, you don't need to check if the assembly's
authenticode signature is valid since publisher evidence is not issued by
the CLR for an assembly with an invalid signature.


[quoted text, click to view]

If you don't obfuscate the code that performs the CA verification, it would
be trivial to modify your application to eliminate or modify the
verification. Obfuscation just makes it more difficult to find the code
that performs the verification then figure out exactly what it is doing.