3

I'm new to cryptography and I'm a bit stuck:

I'm trying to connect (from my development environment) to a web service using HTTPS. The web service requires a client certificate - which I think I've installed correctly.

They have supplied me with a .PFX file. In Windows 7, I double clicked the file to install it into my Current User - Personal certificate store.

I then exported a X509 Base-64 encoded .cer file from the certificate entry in the store. It didn't have a private key associate with it.

Then, in my app, I'm attempting to connect to the service like this:

var certificate = X509Certificate.CreateFromCertFile("xyz.cer"));
var serviceUrl = "https://xyz";
var request = (HttpWebRequest) WebRequest.Create(serviceUrl);
request.ClientCertificates.Add(certificate);
request.Method = WebRequestMethods.Http.Post;
request.ContentType = "application/x-www-form-urlencoded";

I get a 502 Connection failed when I connect.

Is there anything you can see wrong with this method? Our production environment seems to work with a similar configuration, but it's running Windows Server 2003.

Thanks!

wows
  • 10,687
  • 7
  • 27
  • 27

2 Answers2

4

The underlying problem is that you are only giving your program access to the certificate. To perform authentication, it needs access to the private key too.

A correctly instantiated X509Certificate2 can carry the private key, and should be passed to ClientCertificates.Add() method. I believe the Import() method can accept a .pfx file as input; the exported .cer file lacks the private key and isn't useful for client authentication.

erickson
  • 265,237
  • 58
  • 395
  • 493
  • So the web service will require that I send a private key to authenticate? – wows May 24 '10 at 23:52
  • 2
    The private key isn't actually sent to the server; it is used to digitally sign some data, proving to the server that the client holds the private key without actually disclosing it. – erickson May 24 '10 at 23:57
0

Take a look at this and verify that your error is due to a certificate - is the server sending back more details on the problem? Error 502 (Bad Gateway) when sending a request with HttpWebRequest over SSL

Community
  • 1
  • 1
Ed Power
  • 8,310
  • 3
  • 36
  • 42
  • I basically get a "System.IO.IOException : Received an unexpected EOF or 0 bytes from the transport stream." I take this to mean the connection was just closed by the host - not even giving me a response :( – wows May 25 '10 at 01:34
  • This guy had a similar issue but it was a security protocol issue: http://stackoverflow.com/questions/853896/implement-a-c-client-that-uses-webservices-over-ssl – Ed Power May 25 '10 at 16:10