CODEWITHSUNDEEP
c#authenticationdotnet-httpclientmutual-authentication
Justin Self
Justin Self

Reputation: 6265

HttpClient isn't using Client Certificate for Mutual TLS Auth

Question

Why will my HttpClient instance not use my provided client certificate for mutual auth?

Background

I'm using HttpClient to do mutual TLS. As the client, I'm adding a client certificate to a WebRequestHandler and then using that handler in the new HttpClient.

The certificate is not installed on my machine. I've successfully loaded it into the handler and can see it when debugging (the password is correct, too).

I'm testing against a couple of different test domains

Both testing apps are showing no cert is being sent.

Code

    var clientCert = new X509Certificate2("badssl.pem", "badssl.com");

    var webHandler = new WebRequestHandler();
    webHandler.ClientCertificates.Add(clientCert);
    var httpClient = new HttpClient(webHandler);

    var result = await (await httpClient.GetAsync(uri)).Content.ReadAsStringAsync();

Upvotes: 5

Views: 5335

Answers (1)

Adam Larsen
Adam Larsen

Reputation: 1121

The X509Certificate2 class doesn't look to be reading in the private key from the PEM cert.

    var clientCert = new X509Certificate2("badssl.com-client.pem", "badssl.com");
    if(!clientCert.HasPrivateKey)
        throw new ApplicationException("Cert doesn't contain private key");

Does throwing an error.

In the case of badssl.com, they do have a PKCS #12 cert available (aka PFX). I was able to get your code to work with that cert.

Upvotes: 3

Related Questions