Add support for hot reloading of client certificates (#1783)

* Refactor Unit Tests

* Add new certificate provider interface instead of read only certificates list.

* Update ReleaseNotes.md

* Fix Unit Tests

* Fix build

* unit testing hot swappable certificates (#1787)

* Move test classes to correct namespace

* Apply code style

---------

Co-authored-by: Sean Hanna <hannasm@users.noreply.github.com>

Source/MQTTnet/Client/Options/DefaultMqttCertificatesProvider.cs

@@ -0,0 +1,36 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+using System.Collections.Generic;
+using System.Security.Cryptography.X509Certificates;
+
+namespace MQTTnet.Client
+{
+    public sealed class DefaultMqttCertificatesProvider : IMqttClientCertificatesProvider
+    {
+        readonly X509Certificate2Collection _certificates;
+
+        public DefaultMqttCertificatesProvider(X509Certificate2Collection certificates)
+        {
+            _certificates = certificates;
+        }
+
+        public DefaultMqttCertificatesProvider(IEnumerable<X509Certificate> certificates)
+        {
+            if (certificates != null)
+            {
+                _certificates = new X509Certificate2Collection();
+                foreach (var certificate in certificates)
+                {
+                    _certificates.Add(certificate);
+                }
+            }
+        }
+
+        public X509CertificateCollection GetCertificates()
+        {
+            return _certificates;
+        }
+    }
+}

Source/MQTTnet/Client/Options/IMqttClientCertificatesProvider.cs

@@ -0,0 +1,11 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+namespace MQTTnet.Client
+{
+    public interface IMqttClientCertificatesProvider
+    {
+        System.Security.Cryptography.X509Certificates.X509CertificateCollection GetCertificates();
+    }
+}

Source/MQTTnet/Client/Options/MqttClientOptionsBuilder.cs

@@ -15,10 +15,14 @@ namespace MQTTnet.Client
     public sealed class MqttClientOptionsBuilder
     {
         readonly MqttClientOptions _options = new MqttClientOptions();
-        MqttClientWebSocketProxyOptions _proxyOptions;
+
+        [Obsolete] MqttClientWebSocketProxyOptions _proxyOptions;
 
         MqttClientTcpOptions _tcpOptions;
-        MqttClientOptionsBuilderTlsParameters _tlsParameters;
+        MqttClientTlsOptions _tlsOptions;
+
+        [Obsolete] MqttClientOptionsBuilderTlsParameters _tlsParameters;
+
         MqttClientWebSocketOptions _webSocketOptions;
 
         public MqttClientOptions Build()
@@ -28,11 +32,12 @@ namespace MQTTnet.Client
                 throw new InvalidOperationException("A channel must be set.");
             }
 
+            var tlsOptions = _tlsOptions;
             if (_tlsParameters != null)
             {
                 if (_tlsParameters?.UseTls == true)
                 {
-                    var tlsOptions = new MqttClientTlsOptions
+                    tlsOptions = new MqttClientTlsOptions
                     {
                         UseTls = true,
                         SslProtocol = _tlsParameters.SslProtocol,
@@ -40,28 +45,23 @@ namespace MQTTnet.Client
                         CertificateValidationHandler = _tlsParameters.CertificateValidationHandler,
                         IgnoreCertificateChainErrors = _tlsParameters.IgnoreCertificateChainErrors,
                         IgnoreCertificateRevocationErrors = _tlsParameters.IgnoreCertificateRevocationErrors,
-#if WINDOWS_UWP
-                        Certificates = _tlsParameters.Certificates?.Select(c => c.ToArray()).ToList(),
-#else
-                        Certificates = _tlsParameters.Certificates?.ToList(),
-#endif
-
+                        ClientCertificatesProvider = _tlsParameters.CertificatesProvider,
 #if NETCOREAPP3_1_OR_GREATER
                         ApplicationProtocols = _tlsParameters.ApplicationProtocols,
 #endif
                     };
-
-                    if (_tcpOptions != null)
-                    {
-                        _tcpOptions.TlsOptions = tlsOptions;
-                    }
-                    else if (_webSocketOptions != null)
-                    {
-                        _webSocketOptions.TlsOptions = tlsOptions;
-                    }
                 }
             }
 
+            if (_tcpOptions != null)
+            {
+                _tcpOptions.TlsOptions = tlsOptions;
+            }
+            else if (_webSocketOptions != null)
+            {
+                _webSocketOptions.TlsOptions = tlsOptions;
+            }
+
             if (_proxyOptions != null)
             {
                 if (_webSocketOptions == null)
@@ -78,17 +78,7 @@ namespace MQTTnet.Client
 
             return _options;
         }
-        
-        /// <summary>
-        /// The client will not throw an exception when the MQTT server responses with a non success ACK packet.
-        /// This will become the default behavior in future versions of the library.
-        /// </summary>
-        public MqttClientOptionsBuilder WithoutThrowOnNonSuccessfulConnectResponse()
-        {
-            _options.ThrowOnNonSuccessfulConnectResponse = false;
-            return this;
-        }
-        
+
         public MqttClientOptionsBuilder WithAuthentication(string method, byte[] data)
         {
             _options.AuthenticationMethod = method;
@@ -120,6 +110,7 @@ namespace MQTTnet.Client
             return this;
         }
 
+        [Obsolete("Use WithTcpServer(... configure) or WithWebSocketServer(... configure) instead.")]
         public MqttClientOptionsBuilder WithConnectionUri(Uri uri)
         {
             if (uri == null)
@@ -136,12 +127,16 @@ namespace MQTTnet.Client
                     break;
 
                 case "mqtts":
-                    WithTcpServer(uri.Host, port).WithTls();
+                    WithTcpServer(uri.Host, port)
+                        .WithTlsOptions(
+                            o =>
+                            {
+                            });
                     break;
 
                 case "ws":
                 case "wss":
-                    WithWebSocketServer(uri.ToString());
+                    WithWebSocketServer(o => o.WithUri(uri.ToString()));
                     break;
 
                 default:
@@ -159,6 +154,7 @@ namespace MQTTnet.Client
             return this;
         }
 
+        [Obsolete("Use WithTcpServer(... configure) or WithWebSocketServer(... configure) instead.")]
         public MqttClientOptionsBuilder WithConnectionUri(string uri)
         {
             return WithConnectionUri(new Uri(uri, UriKind.Absolute));
@@ -222,6 +218,16 @@ namespace MQTTnet.Client
             return this;
         }
 
+        /// <summary>
+        ///     The client will not throw an exception when the MQTT server responses with a non success ACK packet.
+        ///     This will become the default behavior in future versions of the library.
+        /// </summary>
+        public MqttClientOptionsBuilder WithoutThrowOnNonSuccessfulConnectResponse()
+        {
+            _options.ThrowOnNonSuccessfulConnectResponse = false;
+            return this;
+        }
+
         public MqttClientOptionsBuilder WithProtocolVersion(MqttProtocolVersion value)
         {
             if (value == MqttProtocolVersion.Unknown)
@@ -233,6 +239,7 @@ namespace MQTTnet.Client
             return this;
         }
 
+        [Obsolete("Use WithWebSocketServer(... configure) instead.")]
         public MqttClientOptionsBuilder WithProxy(
             string address,
             string username = null,
@@ -254,6 +261,7 @@ namespace MQTTnet.Client
             return this;
         }
 
+        [Obsolete("Use WithWebSocketServer(... configure) instead.")]
         public MqttClientOptionsBuilder WithProxy(Action<MqttClientWebSocketProxyOptions> optionsBuilder)
         {
             if (optionsBuilder == null)
@@ -324,17 +332,20 @@ namespace MQTTnet.Client
             return this;
         }
 
+        [Obsolete("Use WithTlsOptions(... configure) instead.")]
         public MqttClientOptionsBuilder WithTls(MqttClientOptionsBuilderTlsParameters parameters)
         {
             _tlsParameters = parameters;
             return this;
         }
 
+        [Obsolete("Use WithTlsOptions(... configure) instead.")]
         public MqttClientOptionsBuilder WithTls()
         {
             return WithTls(new MqttClientOptionsBuilderTlsParameters { UseTls = true });
         }
 
+        [Obsolete("Use WithTlsOptions(... configure) instead.")]
         public MqttClientOptionsBuilder WithTls(Action<MqttClientOptionsBuilderTlsParameters> optionsBuilder)
         {
             if (optionsBuilder == null)
@@ -351,6 +362,26 @@ namespace MQTTnet.Client
             return this;
         }
 
+        public MqttClientOptionsBuilder WithTlsOptions(MqttClientTlsOptions tlsOptions)
+        {
+            _tlsOptions = tlsOptions;
+            return this;
+        }
+
+        public MqttClientOptionsBuilder WithTlsOptions(Action<MqttClientTlsOptionsBuilder> configure)
+        {
+            if (configure == null)
+            {
+                throw new ArgumentNullException(nameof(configure));
+            }
+
+            var builder = new MqttClientTlsOptionsBuilder();
+            configure.Invoke(builder);
+
+            _tlsOptions = builder.Build();
+            return this;
+        }
+
         public MqttClientOptionsBuilder WithTopicAliasMaximum(ushort topicAliasMaximum)
         {
             _options.TopicAliasMaximum = topicAliasMaximum;
@@ -382,6 +413,7 @@ namespace MQTTnet.Client
             return this;
         }
 
+        [Obsolete("Use WithWebSocketServer(... configure) instead.")]
         public MqttClientOptionsBuilder WithWebSocketServer(string uri, MqttClientOptionsBuilderWebSocketParameters parameters = null)
         {
             _webSocketOptions = new MqttClientWebSocketOptions
@@ -394,6 +426,21 @@ namespace MQTTnet.Client
             return this;
         }
 
+        public MqttClientOptionsBuilder WithWebSocketServer(Action<MqttClientWebSocketOptionsBuilder> configure)
+        {
+            if (configure == null)
+            {
+                throw new ArgumentNullException(nameof(configure));
+            }
+
+            var webSocketOptionsBuilder = new MqttClientWebSocketOptionsBuilder();
+            configure.Invoke(webSocketOptionsBuilder);
+
+            _webSocketOptions = webSocketOptionsBuilder.Build();
+            return this;
+        }
+
+        [Obsolete("Use WithWebSocketServer(... configure) instead.")]
         public MqttClientOptionsBuilder WithWebSocketServer(Action<MqttClientWebSocketOptions> optionsBuilder)
         {
             if (optionsBuilder == null)
@@ -425,6 +472,12 @@ namespace MQTTnet.Client
             return this;
         }
 
+        public MqttClientOptionsBuilder WithWillMessageExpiryInterval(uint willMessageExpiryInterval)
+        {
+            _options.WillMessageExpiryInterval = willMessageExpiryInterval;
+            return this;
+        }
+
         public MqttClientOptionsBuilder WithWillPayload(byte[] willPayload)
         {
             _options.WillPayload = willPayload;
@@ -478,12 +531,6 @@ namespace MQTTnet.Client
             return this;
         }
 
-        public MqttClientOptionsBuilder WithWillMessageExpiryInterval(uint willMessageExpiryInterval)
-        {
-            _options.WillMessageExpiryInterval = willMessageExpiryInterval;
-            return this;
-        }
-
         public MqttClientOptionsBuilder WithWillTopic(string willTopic)
         {
             _options.WillTopic = willTopic;

Source/MQTTnet/Client/Options/MqttClientOptionsBuilderTlsParameters.cs

@@ -5,12 +5,14 @@
 using System;
 using System.Collections.Generic;
 using System.Security.Authentication;
-using System.Security.Cryptography.X509Certificates;
 
 namespace MQTTnet.Client
 {
+    [Obsolete("Use methods from MqttClientOptionsBuilder instead.")]
     public sealed class MqttClientOptionsBuilderTlsParameters
     {
+        IEnumerable<System.Security.Cryptography.X509Certificates.X509Certificate> _obsoleteCertificates;
+
         public bool UseTls { get; set; }
 
         public Func<MqttClientCertificateValidationEventArgs, bool> CertificateValidationHandler { get; set; }
@@ -24,7 +26,24 @@ namespace MQTTnet.Client
 #if WINDOWS_UWP
         public IEnumerable<IEnumerable<byte>> Certificates { get; set; }
 #else
-        public IEnumerable<X509Certificate> Certificates { get; set; }
+        [Obsolete("Use CertificatesProvider instead.")]
+        public IEnumerable<System.Security.Cryptography.X509Certificates.X509Certificate> Certificates
+        {
+            get => _obsoleteCertificates;
+            set
+            {
+                _obsoleteCertificates = value;
+
+                if (value == null)
+                {
+                    CertificatesProvider = null;
+                }
+                else
+                {
+                    CertificatesProvider = new DefaultMqttCertificatesProvider(value);
+                }
+            }
+        }
 #endif
 
 #if NETCOREAPP3_1_OR_GREATER
@@ -36,5 +55,7 @@ namespace MQTTnet.Client
         public bool IgnoreCertificateChainErrors { get; set; }
 
         public bool IgnoreCertificateRevocationErrors { get; set; }
+
+        public IMqttClientCertificatesProvider CertificatesProvider { get; set; }
     }
 }

Source/MQTTnet/Client/Options/MqttClientOptionsBuilderWebSocketParameters.cs

@@ -2,11 +2,13 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+using System;
 using System.Collections.Generic;
 using System.Net;
 
 namespace MQTTnet.Client
 {
+    [Obsolete("Use dedicated methods in MqttClientOptionsBuilder.")]
     public class MqttClientOptionsBuilderWebSocketParameters
     {
         public IDictionary<string, string> RequestHeaders { get; set; }

Source/MQTTnet/Client/Options/MqttClientTcpOptionsExtensions.cs

@@ -17,7 +17,7 @@ namespace MQTTnet.Client
                 return options.Port.Value;
             }
 
-            return !options.TlsOptions.UseTls ? 1883 : 8883;
+            return !(options.TlsOptions?.UseTls ?? false) ? 1883 : 8883;
         }
     }
 }

Source/MQTTnet/Client/Options/MqttClientTlsOptions.cs

@@ -24,11 +24,13 @@ namespace MQTTnet.Client
 
         public X509RevocationMode RevocationMode { get; set; } = X509RevocationMode.Online;
 
-#if WINDOWS_UWP
-        public List<byte[]> Certificates { get; set; }
-#else
-        public List<X509Certificate> Certificates { get; set; }
-#endif
+        /// <summary>
+        ///     Gets or sets the provider for certificates.
+        ///     This provider gets called whenever the client wants to connect
+        ///     with the server and requires certificates for authentication.
+        ///     The implementation may return different certificates each time.
+        /// </summary>
+        public IMqttClientCertificatesProvider ClientCertificatesProvider { get; set; }
 
 #if NETCOREAPP3_1_OR_GREATER
         public List<SslApplicationProtocol> ApplicationProtocols { get; set; }

Source/MQTTnet/Client/Options/MqttClientTlsOptionsBuilder.cs

@@ -0,0 +1,136 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+using System;
+using System.Collections.Generic;
+using System.Security.Authentication;
+using System.Security.Cryptography.X509Certificates;
+#if NETCOREAPP3_1_OR_GREATER
+using System.Net.Security;
+#endif
+
+namespace MQTTnet.Client
+{
+    public sealed class MqttClientTlsOptionsBuilder
+    {
+        readonly MqttClientTlsOptions _tlsOptions = new MqttClientTlsOptions
+        {
+            // If someone used this builder the change is very very high that TLS
+            // should be actually used.
+            UseTls = true
+        };
+
+        public MqttClientTlsOptions Build()
+        {
+            return _tlsOptions;
+        }
+
+        public MqttClientTlsOptionsBuilder UseTls(bool useTls = true)
+        {
+            _tlsOptions.UseTls = useTls;
+            return this;
+        }
+
+        public MqttClientTlsOptionsBuilder WithAllowUntrustedCertificates(bool allowUntrustedCertificates = true)
+        {
+            _tlsOptions.AllowUntrustedCertificates = allowUntrustedCertificates;
+            return this;
+        }
+
+        public MqttClientTlsOptionsBuilder WithCertificateValidationHandler(Func<MqttClientCertificateValidationEventArgs, bool> certificateValidationHandler)
+        {
+            if (certificateValidationHandler == null)
+            {
+                throw new ArgumentNullException(nameof(certificateValidationHandler));
+            }
+
+            _tlsOptions.CertificateValidationHandler = certificateValidationHandler;
+            return this;
+        }
+
+        public MqttClientTlsOptionsBuilder WithClientCertificates(IEnumerable<X509Certificate2> certificates)
+        {
+            if (certificates == null)
+            {
+                throw new ArgumentNullException(nameof(certificates));
+            }
+
+            _tlsOptions.ClientCertificatesProvider = new DefaultMqttCertificatesProvider(certificates);
+            return this;
+        }
+
+        public MqttClientTlsOptionsBuilder WithClientCertificates(X509Certificate2Collection certificates)
+        {
+            if (certificates == null)
+            {
+                throw new ArgumentNullException(nameof(certificates));
+            }
+
+            _tlsOptions.ClientCertificatesProvider = new DefaultMqttCertificatesProvider(certificates);
+            return this;
+        }
+
+        public MqttClientTlsOptionsBuilder WithClientCertificatesProvider(IMqttClientCertificatesProvider clientCertificatesProvider)
+        {
+            _tlsOptions.ClientCertificatesProvider = clientCertificatesProvider;
+            return this;
+        }
+
+        public MqttClientTlsOptionsBuilder WithIgnoreCertificateChainErrors(bool ignoreCertificateChainErrors = true)
+        {
+            _tlsOptions.IgnoreCertificateChainErrors = ignoreCertificateChainErrors;
+            return this;
+        }
+
+        public MqttClientTlsOptionsBuilder WithIgnoreCertificateRevocationErrors(bool ignoreCertificateRevocationErrors = true)
+        {
+            _tlsOptions.IgnoreCertificateRevocationErrors = ignoreCertificateRevocationErrors;
+            return this;
+        }
+
+        public MqttClientTlsOptionsBuilder WithRevocationMode(X509RevocationMode revocationMode)
+        {
+            _tlsOptions.RevocationMode = revocationMode;
+            return this;
+        }
+
+        public MqttClientTlsOptionsBuilder WithSslProtocols(SslProtocols sslProtocols)
+        {
+            _tlsOptions.SslProtocol = sslProtocols;
+            return this;
+        }
+
+        public MqttClientTlsOptionsBuilder WithTargetHost(string targetHost)
+        {
+            _tlsOptions.TargetHost = targetHost;
+            return this;
+        }
+
+#if NETCOREAPP3_1_OR_GREATER
+        public MqttClientTlsOptionsBuilder WithAllowRenegotiation(bool allowRenegotiation = true)
+        {
+            _tlsOptions.AllowRenegotiation = allowRenegotiation;
+            return this;
+        }
+
+        public MqttClientTlsOptionsBuilder WithApplicationProtocols(List<SslApplicationProtocol> applicationProtocols)
+        {
+            _tlsOptions.ApplicationProtocols = applicationProtocols;
+            return this;
+        }
+
+        public MqttClientTlsOptionsBuilder WithCipherSuitesPolicy(CipherSuitesPolicy cipherSuitePolicy)
+        {
+            _tlsOptions.CipherSuitesPolicy = cipherSuitePolicy;
+            return this;
+        }
+
+        public MqttClientTlsOptionsBuilder WithCipherSuitesPolicy(EncryptionPolicy encryptionPolicy)
+        {
+            _tlsOptions.EncryptionPolicy = encryptionPolicy;
+            return this;
+        }
+#endif
+    }
+}

Source/MQTTnet/Client/Options/MqttClientWebSocketOptionsBuilder.cs

@@ -0,0 +1,85 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+using System;
+using System.Collections.Generic;
+using System.Net;
+
+namespace MQTTnet.Client
+{
+    public sealed class MqttClientWebSocketOptionsBuilder
+    {
+        readonly MqttClientWebSocketOptions _webSocketOptions = new MqttClientWebSocketOptions();
+
+        public MqttClientWebSocketOptions Build()
+        {
+            return _webSocketOptions;
+        }
+
+        public MqttClientWebSocketOptionsBuilder WithCookieContainer(CookieContainer cookieContainer)
+        {
+            _webSocketOptions.CookieContainer = cookieContainer;
+            return this;
+        }
+
+        public MqttClientWebSocketOptionsBuilder WithCookieContainer(ICredentials credentials)
+        {
+            _webSocketOptions.Credentials = credentials;
+            return this;
+        }
+
+        public MqttClientWebSocketOptionsBuilder WithProxyOptions(MqttClientWebSocketProxyOptions proxyOptions)
+        {
+            _webSocketOptions.ProxyOptions = proxyOptions;
+            return this;
+        }
+
+        public MqttClientWebSocketOptionsBuilder WithProxyOptions(Action<MqttClientWebSocketProxyOptionsBuilder> configure)
+        {
+            if (configure == null)
+            {
+                throw new ArgumentNullException(nameof(configure));
+            }
+
+            var proxyOptionsBuilder = new MqttClientWebSocketProxyOptionsBuilder();
+            configure.Invoke(proxyOptionsBuilder);
+
+            _webSocketOptions.ProxyOptions = proxyOptionsBuilder.Build();
+            return this;
+        }
+
+        public MqttClientWebSocketOptionsBuilder WithRequestHeaders(IDictionary<string, string> requestHeaders)
+        {
+            _webSocketOptions.RequestHeaders = requestHeaders;
+            return this;
+        }
+
+        public MqttClientWebSocketOptionsBuilder WithSubProtocols(ICollection<string> subProtocols)
+        {
+            _webSocketOptions.SubProtocols = subProtocols;
+            return this;
+        }
+
+        public MqttClientWebSocketOptionsBuilder WithUri(string uri)
+        {
+            _webSocketOptions.Uri = uri;
+            return this;
+        }
+
+#if !NETSTANDARD1_3
+        public MqttClientWebSocketOptionsBuilder WithKeepAliveInterval(TimeSpan keepAliveInterval)
+        {
+            _webSocketOptions.KeepAliveInterval = keepAliveInterval;
+            return this;
+        }
+#endif
+#if !WINDOWS_UWP && !NETSTANDARD1_3
+        public MqttClientWebSocketOptionsBuilder WithUseDefaultCredentials(bool useDefaultCredentials = true)
+        {
+            _webSocketOptions.UseDefaultCredentials = useDefaultCredentials;
+            return this;
+        }
+#endif
+    }
+}

Source/MQTTnet/Client/Options/MqttClientWebSocketProxyOptionsBuilder.cs

@@ -0,0 +1,67 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+using System.Collections.Generic;
+using System.Linq;
+
+namespace MQTTnet.Client
+{
+    public sealed class MqttClientWebSocketProxyOptionsBuilder
+    {
+        readonly MqttClientWebSocketProxyOptions _proxyOptions = new MqttClientWebSocketProxyOptions();
+
+        public MqttClientWebSocketProxyOptionsBuilder WithAddress(string address)
+        {
+            _proxyOptions.Address = address;
+            return this;
+        }
+        
+        public MqttClientWebSocketProxyOptionsBuilder WithUsername(string username)
+        {
+            _proxyOptions.Username = username;
+            return this;
+        }
+        
+        public MqttClientWebSocketProxyOptionsBuilder WithPassword(string password)
+        {
+            _proxyOptions.Password = password;
+            return this;
+        }
+        
+        public MqttClientWebSocketProxyOptionsBuilder WithDomain(string domain)
+        {
+            _proxyOptions.Domain = domain;
+            return this;
+        }
+        
+        public MqttClientWebSocketProxyOptionsBuilder WithBypassOnLocal(bool bypassOnLocal = true)
+        {
+            _proxyOptions.BypassOnLocal = bypassOnLocal;
+            return this;
+        }
+        
+        public MqttClientWebSocketProxyOptionsBuilder WithBypassList(string[] bypassList)
+        {
+            _proxyOptions.BypassList = bypassList;
+            return this;
+        }
+        
+        public MqttClientWebSocketProxyOptionsBuilder WithBypassList(IEnumerable<string> bypassList)
+        {
+            _proxyOptions.BypassList = bypassList?.ToArray();
+            return this;
+        }
+        
+        public MqttClientWebSocketProxyOptionsBuilder WithUseDefaultCredentials(bool useDefaultCredentials = true)
+        {
+            _proxyOptions.UseDefaultCredentials = useDefaultCredentials;
+            return this;
+        }
+        
+        public MqttClientWebSocketProxyOptions Build()
+        {
+            return _proxyOptions;
+        }
+    }
+}

Source/MQTTnet/Implementations/MqttTcpChannel.Uwp.cs

@@ -6,8 +6,6 @@
 using System;
 using System.Collections.Generic;
 using System.IO;
-using System.Linq;
-using System.Runtime.InteropServices.WindowsRuntime;
 using System.Security.Authentication;
 using System.Security.Cryptography.X509Certificates;
 using System.Threading;
@@ -18,6 +16,7 @@ using Windows.Security.Cryptography.Certificates;
 using MQTTnet.Channel;
 using MQTTnet.Client;
 using MQTTnet.Server;
+using System.Runtime.InteropServices.WindowsRuntime;
 
 namespace MQTTnet.Implementations
 {
@@ -126,17 +125,19 @@ namespace MQTTnet.Implementations
 
         private static Certificate LoadCertificate(IMqttClientChannelOptions options)
         {
-            if (options.TlsOptions.Certificates == null || !options.TlsOptions.Certificates.Any())
+            var certificates = options.TlsOptions?.ClientCertificatesProvider?.GetCertificates();
+
+            if (certificates == null || certificates.Count == 0)
             {
                 return null;
             }
 
-            if (options.TlsOptions.Certificates.Count > 1)
+            if (certificates.Count > 1)
             {
                 throw new NotSupportedException("Only one client certificate is supported when using 'uap10.0'.");
             }
 
-            return new Certificate(options.TlsOptions.Certificates.First().AsBuffer());
+            return new Certificate(certificates[0].Export(X509ContentType.Cert).AsBuffer());
         }
 
         private IEnumerable<ChainValidationResult> ResolveIgnorableServerCertificateErrors()

Source/MQTTnet/Implementations/MqttTcpChannel.cs

@@ -3,9 +3,6 @@
 // See the LICENSE file in the project root for more information.
 
 #if !WINDOWS_UWP
-using MQTTnet.Channel;
-using MQTTnet.Client;
-using MQTTnet.Exceptions;
 using System;
 using System.IO;
 using System.Net.Security;
@@ -14,6 +11,9 @@ using System.Runtime.ExceptionServices;
 using System.Security.Cryptography.X509Certificates;
 using System.Threading;
 using System.Threading.Tasks;
+using MQTTnet.Channel;
+using MQTTnet.Client;
+using MQTTnet.Exceptions;
 using MQTTnet.Internal;
 
 namespace MQTTnet.Implementations
@@ -73,7 +73,7 @@ namespace MQTTnet.Implementations
                 {
                     socket.Bind(_tcpOptions.LocalEndpoint);
                 }
-                
+
                 socket.ReceiveBufferSize = _tcpOptions.BufferSize;
                 socket.SendBufferSize = _tcpOptions.BufferSize;
                 socket.SendTimeout = (int)_clientOptions.Timeout.TotalMilliseconds;
@@ -105,7 +105,7 @@ namespace MQTTnet.Implementations
                     {
                         targetHost = _tcpOptions.Server;
                     }
-                    
+
                     var sslStream = new SslStream(networkStream, false, InternalUserCertificateValidationCallback);
                     try
                     {
@@ -298,18 +298,7 @@ namespace MQTTnet.Implementations
 
         X509CertificateCollection LoadCertificates()
         {
-            if (_tcpOptions.TlsOptions.Certificates == null)
-            {
-                return null;
-            }
-
-            var certificates = new X509CertificateCollection();
-            foreach (var certificate in _tcpOptions.TlsOptions.Certificates)
-            {
-                certificates.Add(certificate);
-            }
-
-            return certificates;
+            return _tcpOptions.TlsOptions.ClientCertificatesProvider?.GetCertificates();
         }
     }
 }

Source/MQTTnet/Implementations/MqttWebSocketChannel.cs

@@ -206,16 +206,12 @@ namespace MQTTnet.Implementations
                 clientWebSocket.Options.Cookies = _options.CookieContainer;
             }
 
-            if (_options.TlsOptions?.UseTls == true && _options.TlsOptions?.Certificates != null)
+            if (_options.TlsOptions?.UseTls == true)
             {
-                clientWebSocket.Options.ClientCertificates = new X509CertificateCollection();
-                foreach (var certificate in _options.TlsOptions.Certificates)
+                var certificates = _options.TlsOptions?.ClientCertificatesProvider?.GetCertificates();
+                if (certificates?.Count > 0)
                 {
-#if WINDOWS_UWP
-                    clientWebSocket.Options.ClientCertificates.Add(new X509Certificate(certificate));
-#else
-                    clientWebSocket.Options.ClientCertificates.Add(certificate);
-#endif
+                    clientWebSocket.Options.ClientCertificates = certificates;
                 }
             }