1

I am using EPP (Extensible Provisioning Protocol) to perform domain registration operations.

Everything works fine but when I use a certificate, the login request fails.

Let us say I have certificate in C:\Folder\epp.crt and using the following code:

var tcpTransport = new TcpTransport(url, port, new X509Certificate("C:\Folder\epp.crt"), true);
var service = new Service(tcpTransport);
service.Connect();

This code executes just fine and service is connected. That means connection to URL is established using certificate. Now, I try to login with:

service.Execute(logingCmd);

But this gives me "Server requires Client certificate validation, no client certificate provided".

Why? Should there be any flag for certificate in login command?

Patrick Mevzek
  • 10,995
  • 16
  • 38
  • 54
A.Ghaffar
  • 83
  • 2
  • 13

1 Answers1

2

Per RFC5734, EPP uses TLS, not TCP. This RFC also mandates use of client certificates.

Your question lacks details about the content of epp.crt (where is the associated key?) or the language you use. The TLS negotiation, including validation of client certificate happens before the EPP login, but the exact moment may be hidden by the library you use to connect.

So to answer your "Should there be any flag for certificate in Login Command?", no there should not as the certificate handling is part of the transport setup, not the EPP commands. Your problem is probably more around your use of TcpTransport.

You can use a network sniffer to see exactly what happens. Registries are probably not offering TLS1.3 for now so you should still be able to see the TLS exchanges, including your client providing a certificate.

Also the registry you connect to should be able to help you.

Patrick Mevzek
  • 10,995
  • 16
  • 38
  • 54
  • The problem was with where with the associated key. Certificate was not associated with any private key. Issue resolved by regenerating certificate with private key. – A.Ghaffar Jul 15 '19 at 07:24
  • "Certificate was not associated with any private key. " Technically that is not really possible. A certificate is basically a public key with some metadata and a signature over it. The public and private parts of a key are computing at the same time in one spot because they are mathematically related. Said otherwise: you have to have a private key if you have a certificate, otherwise none would have been generated. But of course you can also just loose the private key after the fact and then the loose certificate is useless. – Patrick Mevzek Mar 05 '20 at 17:53