8

I have a C# console app that consumes a web service that is outside of my network. I am told that the web services uses self-signed certificate for SSL. I am not familiar with the certificate and I am wondering what I need to do in .net/windows server environment.

Thanks.

tony
  • 1,309
  • 3
  • 10
  • 12

2 Answers2

4

Self signed certificates will not be viewed by your application as valid by default because there is not a trusted third party validating the certificate. Typically you'll see self signed certificates on test servers, and you can find more info on self signed versus signed certificates here.

If you are having trouble calling the web services then you'll need to either install the certificate on the machine that your application is running on, or create a custom validator that you can use to tell your application to accept the self signed certificate. From .NET 2.0 onward, custom SSL validation is done by specifying a custom method on the ServicePointManager.ServerCertificateValidationCallback property.

An example of using the ServerCertificateValidationCallback property can be found here: http://weblogs.asp.net/smehaffie/archive/2009/09/10/calling-web-services-that-use-self-signed-certificates.aspx

rsbarro
  • 27,021
  • 9
  • 71
  • 75
  • 2
    Gah, you beat me to it. No use answering now :) This sums up adding the `ServerCertificateValidationCallback` nicely: http://stackoverflow.com/questions/2675133/c-ignore-certificate-errors/2675183#2675183 – arcain Apr 25 '11 at 15:56
  • 1
    The ServerCertificateValidationCallback is also the way to go if your vendor's SSL cert has a common name that doesn't match the websites DNS name (e.g., SSL cert say "QA TEST" and DNS name of site is "service.provider.com"). – arcain Apr 25 '11 at 15:58
3

That's a large question especially regarding X.509 security. Usually with self-signed certificate, you have to import the initial CA used to sign this certificate (usually the self-signed CA used by the application) into your keyring (to be sure that you are connecting to the right server). It's usually required because your client application will check at the connection if the certificate is signed by a known and trusted CA or matching an existing certificate in your keyring.

In C#, you can check the System.Net.Security namespace and especially the SSlStream class for more details.

If you need to import certificate in your keyring, you can use various interfaces to access the keyring from the GUI, using the command line "Certutil.exe" or via the various APIs.

Alexandre Dulaunoy
  • 130
  • 3