Search code examples
c#.netsslsspi

How to specify accepted certificates for Client Authentication in .NET SslStream

I am attempting to use the .Net System.Security.SslStream class to process the server side of a SSL/TLS stream with client authentication.

To perform the handshake, I am using this code:

SslStream sslStream = new SslStream(innerStream, false, RemoteCertificateValidation, LocalCertificateSelectionCallback);
sslStream.AuthenticateAsServer(serverCertificate, true, SslProtocols.Default, false);

Unfortunately, this results in the SslStream transmitting a CertificateRequest containing the subjectnames of all certificates in my CryptoAPI Trusted Root Store.

I would like to be able to override this. It is not an option for me to require the user to install or remove certificates from the Trusted Root Store.

It looks like the SslStream uses SSPI/SecureChannel underneath, so if anyone knows how to do the equivalent with that API, that would be helpful, too.

Any ideas?

Solution

  • It does not look like this is currently possible using the .NET libraries.

    I solved it by using the Mono class library implementation of System.Security.SslStream, which gives better access to overriding the servers behavior during the handshake.