SSL w/client certificates

[Chris Grimes]

Despite finding samples of doing this in newsgroups, I can not post a
certificate to an SSL web site using System.Net.HttpWebRequest. I have a
file containing a DER export of a certificate that I add to my
request.Certificates collection. Strangely, the code below works ONLY if I
leave the certificate in my personal store; if I remove it or put it in the
computer store, the code no longer works.

The code also fails if I comment out hr.ClientCertificates.Add (... ) or use
the other static method to create a cert from a file. The current code
below causes a 403 denied from the server.

I can't rely on a personal certificate store since the application I'm
ultimately intending to modify runs in a service.

Thanks,
Chris

////////////////////////////////

class MyForm {
///......
private void linkLabel1_LinkClicked(object sender,
System.Windows.Forms.LinkLabelLinkClickedEventArgs e)
{
try
{
WebRequest req = WebRequest.Create(this.textBox1.Text);
HttpWebRequest hr = (HttpWebRequest)req;
hr.KeepAlive = false;
string strFile = this.textBox2.Text.Trim();
hr.ClientCertificates.Add(
X509Certificate.CreateFromCertFile(strFile) );
ServicePointManager.CertificatePolicy = new CertPol();
HttpWebResponse res = (HttpWebResponse)req.GetResponse();
int nCode = (int)res.StatusCode;
StreamReader tr = new StreamReader( res.GetResponseStream() );
textBox3.Text = tr.ReadToEnd();
}
catch(Exception exc)
{
textBox3.Text = exc + "";
}
}
}
public enum CertificateProblem : uint
{
CertEXPIRED = 0x800B0101,
CertVALIDITYPERIODNESTING = 0x800B0102,
CertROLE = 0x800B0103,
CertPATHLENCONST = 0x800B0104,
CertCRITICAL = 0x800B0105,
CertPURPOSE = 0x800B0106,
CertISSUERCHAINING = 0x800B0107,
CertMALFORMED = 0x800B0108,
CertUNTRUSTEDROOT = 0x800B0109,
CertCHAINING = 0x800B010A,
CertREVOKED = 0x800B010C,
CertUNTRUSTEDTESTROOT = 0x800B010D,
CertREVOCATION_FAILURE = 0x800B010E,
CertCN_NO_MATCH = 0x800B010F,
CertWRONG_USAGE = 0x800B0110,
CertUNTRUSTEDCA = 0x800B0112
}

class CertPol : ICertificatePolicy
{
public bool CheckValidationResult(ServicePoint srvPoint, X509Certificate
certificate, WebRequest request, int certificateProblem)
{
System.Diagnostics.Trace.WriteLine( "Problem: " +
(CertificateProblem)(uint)certificateProblem );
return true;
}
}

 

[Rob Teixeira [MVP]]

I'm only guessing off the top of my head here, but I believe it's probably
because your account can only access the private key that relates to that
certificate from your personal store. One account can't access private keys
from stores belonging to other accounts. SSL won't work without access to
the private key.

-Rob Teixeira [MVP]