Search code examples
c#httpwebrequestdotnet-httpclientmutual-authentication

How to do mutual tls authentication in C#

I have my desktop application. I would like to send post request to server URL using mutual authentication in C#. I have written following code:

System::Net::ServicePointManager::SecurityProtocol = SecurityProtocolType::Tls12;
WebRequestHandler ^ clientHandler = gcnew WebRequestHandler();
X509Certificates::X509Certificate2^ modCert = gcnew X509Certificates::X509Certificate2("Dev.pfx", "test");
clientHandler->ClientCertificates->Add(cerInter);
clientHandler->AuthenticationLevel = System::Net::Security::AuthenticationLevel::MutualAuthRequested;
clientHandler->ClientCertificateOptions = ClientCertificateOption::Manual;
httpClient = gcnew HttpClient(clientHandler);
HttpContent ^ httpContent = gcnew ByteArrayContent(state->postBody);
httpContent->Headers->ContentType = gcnew MediaTypeHeaderValue("application/octet-stream");
resultTask = httpClient->PostAsync(state->httpRequest, httpContent);

Now post request is throwing exception that it is connection is forcefully closed by remote host. I have used wireshark and it shows that client certificate in client response is of zero length. Even if I don't add any certificate in WebRequestHandler, I get the same response. Can someone please help me to solve this issue or guide me for possible solutions.

Screenshot for wireshark

EDIT

Hi All, I have found the issue. I have to set client certificate in local store.

X509Certificates::X509Store store(X509Certificates::StoreName::Root, X509Certificates::StoreLocation::LocalMachine);
store.Ostore. Openrtificates::OpenFlags::ReadWrite);
store. Add(cerInter);

However, I am facing the issue that if I don't run my application as administrator, then it throws access right exception.

If I use StoreLocation::CurrentUser, it pop up message for approval.

Can someone please suggests, how can I Use it with StoreLocation::CurrentUser without prompting the message?

Besides it, I will really appreciate if someone can suggests, if this is the right approach?

Solution

  • By Windows' design, you cannot add certificates to the per-user store without a prompt. You can add certificates to the Local Machine store, but only when running with Administrative rights.

    You should only need to add the certificate to the user's store once (e.g. during first run or setup).