Make HTTPS call through HttpClient with client certificate that does not have access to private key

Question

Is it possible to send client certificate without (access to) private key in HTTPs request (e.g. by using HttpClient)?

The target API can be reached and client certificate is available with the following implementation of the HTTPS request that uses client certificate with private key.

var handler = new HttpClientHandler();
handler.ClientCertificates.Add(new X509Certificate2(@"clientcertificate.pfx", "password"));
var client = new HttpClient(handler);
var httpRequestMessage = new HttpRequestMessage(HttpMethod.Get, "https://url");
var result = await client.SendAsync(httpRequestMessage);

Client certificate is read as var clientCertificate = await Request.HttpContext.Connection.GetClientCertificateAsync(); on the target API side.

However, when certificate without (access to) private key is used during the HTTPS request, the target API does not get client certificate (it is null in the Request.HttpContext.Connection.ClientCertificate property).

handler.ClientCertificates.Add(new X509Certificate2(@"clientcertificate.crt"));

Answer 1

Is it possible to send client certificate without (access to) private key in HTTPs request (e.g. by using HttpClient)?

You can send it as content, sure; but you cannot use it as a client certificate without the private key. It would be like logging in to a system by just asserting a username.

The technical reason is that whenever certificates are sent in TLS there's also a required signature that has to be sent to prove that the private key is held by the sender. If the signature doesn't validate, then the recipient terminates the session.