Search code examples
sslssl-certificateclient-certificatesmutual-authentication

Sending an HTTP request with client certificates in Chrome

I have an API on Azure that is protected with mutual authentication. The server certificate is internally handled by Azure:

Server Certificate

I've created a self signed certificate and added it to my local computer's list of Trusted Root Certification Authorities as well as my Personal certificates:

Client Certificate

When attempting to hit the API through Chrome (specifically the Chrome App Postman), I'm getting a 403 indicating my request didn't have a certificate associated with it.

  1. Do I have a misunderstanding of how this should work?
  2. It's possible I've created the client certificate incorrectly. Everything I read online point to using OpenSSL to create these, however I had some issues getting it to run on a Windows machine and went through a variety of other tools: MakeCert, PowerShell's New-SelfSignedCertificate, and Self-Signed Certificate Generator. All seem to create certificates, but I have no real way of knowing if I created them correctly.
  3. If the certificate was created correctly, how do I get Chrome to submit the certificate with the request? Shouldn't it just automatically pick up the cert when I add it to the store?
Solution

  • Turns out I had to go to the root url of the site in chrome (i.e. https://my_app_name.azurewebsites.net) and chrome would display a pop up allowing me to choose the certificate to use with the request.