Client Cert Doesn’t work after Deployment

[Ty]

One of our Asp.Net web applications utilizes a 3rd party webservice that
requires a client cert as part of the security model. The application code
runs fine, authenticates the message, and returns the expected results in the
development environment.

I have installed the CA & Client Certs into:
Certificates (Local Computer)/Trusted Root Certification
Authorities/Certificates/CA.CER

In Dev when I manually open the secure webservice URL in IE6 I am prompted
to select the client cert I want to use to access this resource. I select the
client cert (the only one listed) and click “ok†and the destination page
opens.

In Dev When I run my client application the transaction completes
successfully, so I know that the cert is working properly.

However, after I deployed to my staging server, all of the messages to the
3rd party webservice fail with an http 403.7 error.

I can access the webservice in IE6 by manual selecting the client cert, but
when I run the application it fails with HTTP 403.7.

I have looked at the IIS6 configuration on both servers and they match. I
have uninstalled all the certs on both the Dev & Staging servers and started
from scratch with the same results. When I step thru the code while debugging
I can see that the Client Cert is getting attached.

My Question is: Does anyone have any tips on resolving and or debugging this
issue?

 

[Peter Jakab]

Hi Ty,

if your web application ran in an application pool with Network Service
identity, you should grant access to the certificate to it with
winhttpcertcfg tool as mentioned in

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/SecNetHT13.asp

Peter

 

[Peter Jakab]

I dont know how you are calling the web service from code, but if you use
httpwebrequest, you should add the certificate to it like this:

....
string url =https://server.x.com:7002/xxx.apmx;

HttpWebRequest req;

HttpWebResponse res;

// Create request object that connects to NetSuite

req = (HttpWebRequest) WebRequest.Create( url );

req.Method = "POST";

....

....



// The path to the certificate.



string certFilePath = "C:\\cleientcert.cer";

// Load the certificate into an X509Certificate object.

X509Certificate x509Cert = X509Certificate.CreateFromCertFile(
@certFilePath );

// Add certificate to request

req.ClientCertificates.Add( x509Cert );

res = (HttpWebResponse) req.GetResponse();