5

Background: I have a web app that is accessed via Chrome on a Windows 10 machine.

I also have a native Win10 application installed on the device. The web app sends data to the Win10 application via a local web service running on the machine in IISExpress.

To allow for HTTPS communication on port 44300, I've created a self-signed certificate via PowerShell: New-SelfSignedCertificate -DnsName "localhost" -CertStoreLocation "cert:\LocalMachine\My" -NotAfter (Get-Date).AddMonths(60)

And then imported it to 'Local Computer\Trusted Root Certificates\Certificates'

From within the web app I send a command to the win10 app that looks something like this: https://localhost:44300/CMTService.svc/JumpToAssignment?Param=Key=418584577

The win10 app is polling for these requests and picks up the message.

Issue: Different versions of Chrome behave differently with the acceptance of the self-signed certificate. For instance versions 62, 64 and 75 all accept the certificate and allow for communication with the web service. But other versions of Chrome like 76 and 78 block communication. The Security tab in the Chrome DevTools shows https://localhost:44300 as "Unknown / cancelled" and my requests fail with ERR_SSL_CLIENT_AUTH_CERT_NEEDED. Whereas in working versions of Chrome my URL shows under "Secure origins". The only thing that I change is the Chrome version to get these different results.

I've tried enabling the Chrome setting to allow for invalid certs for localhost (chrome://flags/#allow-insecure-localhost). This temporarily works, but then after closing and reopening chrome, my requests start failing again with the same error code.

If I take one of my failing URLs and paste it into a new Chrome tab, suddenly communication with my native app in my web app resumes as normal. But it only works for that session - when I close and reopen Chrome my communication is broken again.

Question: How do I allow for communication between my Chrome v78 web app and my local native app?

Petr Srníček
  • 2,296
  • 10
  • 22
evres
  • 51
  • 3
  • 1
    I believe you have to allow the request to localhost over HTTPS. To do so, use this link: "chrome://flags/#allow-insecure-localhost" – Varun Jain Dec 16 '19 at 08:27
  • If this serves your query then do tell me and I'll put this as an answer so you can accept it as the answer. – Varun Jain Dec 16 '19 at 08:28
  • Thanks Varun, but as mentioned in the post, enabling this setting only temporarily works. After relaunching chrome, communication is blocked once again. – evres Dec 17 '19 at 17:44

3 Answers3

1

ERR_SSL_CLIENT_AUTH_CERT_NEEDED means the server is asking the browser for a certificate for client authentication.

You've described how you setup server authentication, but not described how you setup client authentication.

Likely you have enabled certificates for client authentication, but have not configured the web app to send the correct client certificate or have not configured the native app to accept the correct client certificate. That's a very open ended topic to be prescriptive without knowing more about your development efforts, but you can confirm if client authentication is enabled by inspecting a packet capture. One description of the handshake is here : https://blogs.technet.microsoft.com/nettracer/2013/12/30/how-it-works-on-the-wire-iis-http-client-certificate-authentication/.

Doug
  • 484
  • 2
  • 8
0

Is the web app only communicating with the one win10 machine? Have you installed the self-signed cert directly to the machine? I would try installing it directly to the machine and see if the later instances of chrome allow communication.

Jeff Gray
  • 1
  • 1
  • https://stackoverflow.com/a/15076602/12545785 In the past, I've had to use a remedy similar to this. I believe you stated that you've already tried something similar, but I thought I would share in case anyone else is looking at this in the future. – Jeff Gray Dec 16 '19 at 13:27
  • Thanks Jeff. Yes, the web app communicates with just the local win10 machine. The self-signed cert is installed on the machine. I've tried checking all the 'certificate purposes' checkboxes for my cert as your link describes. But still communication with iis is spotty in chrome v78, 79. – evres Dec 17 '19 at 17:47
0

Just an update: I implemented a javascript workaround to get around my communication issues. When first loading the web app, I simply send my first communication to IIS (destined for Win10 native app) in a separate chrome browser tab. For whatever reason this allows for successful acceptance of the certificate and kick starts the communication with IIS. This is my code to send the command in a new tab and then close it:

    var inst = window.open(launchWinAppURL);
    if (inst != null) {
        window.setTimeout(function() {
            inst.close();
        }, 1000);
    }

This is not the most elegant solution, but it seems to work on all chrome versions, so i'm satisfied.

evres
  • 51
  • 3