Asp Mvc prompt client certificate with private key

Question

I want to create a web application, where the server creates a pdf document, and then the user signs it with some personal digital certificate, (eID, Id card, nif, etc.)

Problem is, when I try it localy (Debug) it works, because I have the certificate installed in the local machine, but when I publish, the private key of the certificate is not in the certificate, and so, I can not sign the pdf.

public ActionResult Index()
{
    HttpClientCertificate cert = Request.ClientCertificate;
    X509Certificate2 x509cert2 = new X509Certificate2(cert.Certificate);
}

In Debug, so, in local machine x509cert2.PrivateKey is not null, but if I publish, x509cert2.PrivateKey is null, so, when I try:

        byte[] contentPdfUnsigned = System.IO.File.ReadAllBytes(path + name + ".pdf");
        ContentInfo objContent = new ContentInfo(contentPdfUnsigned);
        SignedCms objSignedData = new SignedCms(objContent);
        CmsSigner objSigner = new CmsSigner(x509cert2);
        objSignedData.ComputeSignature(objSigner, false);
        byte[] bytSigned = objSignedData.Encode();

In the line "objSignedData.ComputeSignature(objSigner, false);" throws a exception:

System.Security.Cryptography.CryptographicException: Key does not exist.

Is there some method to make the user to pass me the private key?

When executed localy x509cert2.PrivateKey.ToXMLString(true);

prompts this message:

in english:

Is there a way to prompt this message (or another) to allow the user to pass the private key?

score 2 · Accepted Answer · edited May 23 '17 at 10:28

2

In most cases there's no way the user can or should pass you the private key - this is both technically impossible and would break the idea of the private key (passing it to you makes its privacy void). You need to either create a client-side module to do actual signing, or use some pre-created module. In this answer I describe the solution that we offer, and you can create your own client-side module as well.

edited May 23 '17 at 10:28

Community

1
1

answered May 17 '16 at 17:30

Eugene Mayevski 'Callback

45,135
8
71
121

Thanks, It's not the solution that i wanted, but it's the solution I deserve. I don't want to use applets because browsers won't support it in the future, I will try to find diferent solutions. – Albert Cortada May 18 '16 at 08:47
1

@AlbertCortada there are no other solutions available at the moment , and there will unlikely be any, as WebCrypto standard developers don't seem to understand the need for unification of access to cryptographic keys, stored on the client system. If applets are not supported in the particular desktop browser, you can run a Java applet via Java Web Start, and this will work if the user has Java installed. With mobile apps the situation is much worse. – Eugene Mayevski 'Callback May 18 '16 at 20:10

Asp Mvc prompt client certificate with private key

1 Answers1