Skip to main content
AI Assist is now on Stack Overflow. Start a chat to get instant answers from across the network. Sign up to save and share your chats.

Return to Answer

deleted 213 characters in body
Source Link
Fabian
Fabian
  • 2.1k
  • 15
  • 13

Looking at the source code I also think there must be some issue with the problem hereprivate key.

What it is doing is actually to check if the way you generated your certificate. I see the IssueTo and IssueBy that is the same namepassed is of type X509Certificate2 and that you have no certification chainif it has the private key. So I suppose you generated one certificate and then put

If it doesn't find the sameprivate key it tries to find the certificate intoin the personalCurrentUser store and intothen in the root authorityLocalMachine store.

When If it finds the certificate chain is not trusted Request.ClientCertificate won't be populated. I think this could also happenit checks if therethe private key is no certification chain at allpresent.

Maybe you should try to create a(see real self signed certificate by creating one root certificatesource code from class SecureChannnel, method EnsurePrivateKey)

So depending on which file you put in the root store and then use it to sign your client certificateimported (.cer - without private key or .pfx - with private key) and puton which store it inmight not find the personal storeright one and Request.

For a short version:ClientCertificate won't be populated.

This wayYou can activate Network Tracing to create the two certificates seemtry to work (copied from this page)debug this. It will give you output like this:

makecert.exe -r -n "CN=My Personal CA" -pe -sv MyPersonalCA.pvk -a sha1 -len 2048 -b 01/21/2015 -e 05/21/2016 -cy authority MyPersonalCA.cer makecert.exe -iv MyPersonalCA.pvk -ic MyPersonalCA.cer -n "CN=John Doe" -pe -sv JohnDoe.pvk -a sha1 -len 2048 -b 01/21/2015 -e 05/21/2016 -sky exchange JohnDoe.cer -eku 1.3.6.1.5.5.7.3.2 pvk2pfx.exe -pvk JohnDoe.pvk -spc JohnDoe.cer -pfx JohnDoe.pfx -po THE_PASSWORD_USED
  • Trying to find a matching certificate in the certificate store
  • Cannot find the certificate in either the LocalMachine store or the CurrentUser store.

I think the problem here is the way you generated your certificate. I see the IssueTo and IssueBy is the same name and that you have no certification chain. So I suppose you generated one certificate and then put the same certificate into the personal store and into the root authority store.

When the certificate chain is not trusted Request.ClientCertificate won't be populated. I think this could also happen if there is no certification chain at all.

Maybe you should try to create a real self signed certificate by creating one root certificate you put in the root store and then use it to sign your client certificate and put it in the personal store.

For a short version:

This way to create the two certificates seem to work (copied from this page)

makecert.exe -r -n "CN=My Personal CA" -pe -sv MyPersonalCA.pvk -a sha1 -len 2048 -b 01/21/2015 -e 05/21/2016 -cy authority MyPersonalCA.cer makecert.exe -iv MyPersonalCA.pvk -ic MyPersonalCA.cer -n "CN=John Doe" -pe -sv JohnDoe.pvk -a sha1 -len 2048 -b 01/21/2015 -e 05/21/2016 -sky exchange JohnDoe.cer -eku 1.3.6.1.5.5.7.3.2 pvk2pfx.exe -pvk JohnDoe.pvk -spc JohnDoe.cer -pfx JohnDoe.pfx -po THE_PASSWORD_USED

Looking at the source code I also think there must be some issue with the private key.

What it is doing is actually to check if the certificate that is passed is of type X509Certificate2 and if it has the private key.

If it doesn't find the private key it tries to find the certificate in the CurrentUser store and then in the LocalMachine store. If it finds the certificate it checks if the private key is present.

(see source code from class SecureChannnel, method EnsurePrivateKey)

So depending on which file you imported (.cer - without private key or .pfx - with private key) and on which store it might not find the right one and Request.ClientCertificate won't be populated.

You can activate Network Tracing to try to debug this. It will give you output like this:

  • Trying to find a matching certificate in the certificate store
  • Cannot find the certificate in either the LocalMachine store or the CurrentUser store.
added 25 characters in body
Source Link
Fabian
Fabian
  • 2.1k
  • 15
  • 13

I think the problem here is the way you generated your certificate. I see the IssueTo and IssueBy is the same name and that you have no certification chain. So I suppose you generated one certificate and then put the same certificate into the personal store and into the root authority store.

When the certificate chain is not trusted Request.ClientCertificate won't be populated. I think this could also happen if there is no certification chain at all.

Maybe you should try to create a real self signed certificate by creating one root certificate you put in the root store and then use it to sign your client certificate and put it in the personal store.

For a short version this way:

This way to create the two certificates seem to work: (copied from this page)

makecert.exe -r -n "CN=My Personal CA" -pe -sv MyPersonalCA.pvk -a sha1 -len 2048 -b 01/21/20102015 -e 0105/21/2016 -cy authority MyPersonalCA.cer makecert.exe -iv MyPersonalCA.pvk -ic MyPersonalCA.cer -n "CN=John Doe" -pe -sv JohnDoe.pvk -a sha1 -len 2048 -b 01/21/20102015 -e 0105/21/2016 -sky exchange JohnDoe.cer -eku 1.3.6.1.5.5.7.3.2 pvk2pfx.exe -pvk JohnDoe.pvk -spc JohnDoe.cer -pfx JohnDoe.pfx -po THE_PASSWORD_USED

I think the problem here is the way you generated your certificate. I see the IssueTo and IssueBy is the same name and that you have no certification chain. So I suppose you generated one certificate and then put the same certificate into the personal store and into the root authority store.

When the certificate chain is not trusted Request.ClientCertificate won't be populated. I think this could also happen if there is no certification chain at all.

Maybe you should try to create a real self signed certificate by creating one root certificate you put in the root store and then use it to sign your client certificate and put it in the personal store.

For a short version this way to create the two certificates seem to work:

makecert.exe -r -n "CN=My Personal CA" -pe -sv MyPersonalCA.pvk -a sha1 -len 2048 -b 01/21/2010 -e 01/21/2016 -cy authority MyPersonalCA.cer makecert.exe -iv MyPersonalCA.pvk -ic MyPersonalCA.cer -n "CN=John Doe" -pe -sv JohnDoe.pvk -a sha1 -len 2048 -b 01/21/2010 -e 01/21/2016 -sky exchange JohnDoe.cer -eku 1.3.6.1.5.5.7.3.2 pvk2pfx.exe -pvk JohnDoe.pvk -spc JohnDoe.cer -pfx JohnDoe.pfx -po THE_PASSWORD_USED

I think the problem here is the way you generated your certificate. I see the IssueTo and IssueBy is the same name and that you have no certification chain. So I suppose you generated one certificate and then put the same certificate into the personal store and into the root authority store.

When the certificate chain is not trusted Request.ClientCertificate won't be populated. I think this could also happen if there is no certification chain at all.

Maybe you should try to create a real self signed certificate by creating one root certificate you put in the root store and then use it to sign your client certificate and put it in the personal store.

For a short version:

This way to create the two certificates seem to work (copied from this page)

makecert.exe -r -n "CN=My Personal CA" -pe -sv MyPersonalCA.pvk -a sha1 -len 2048 -b 01/21/2015 -e 05/21/2016 -cy authority MyPersonalCA.cer makecert.exe -iv MyPersonalCA.pvk -ic MyPersonalCA.cer -n "CN=John Doe" -pe -sv JohnDoe.pvk -a sha1 -len 2048 -b 01/21/2015 -e 05/21/2016 -sky exchange JohnDoe.cer -eku 1.3.6.1.5.5.7.3.2 pvk2pfx.exe -pvk JohnDoe.pvk -spc JohnDoe.cer -pfx JohnDoe.pfx -po THE_PASSWORD_USED
Source Link
Fabian
Fabian
  • 2.1k
  • 15
  • 13

I think the problem here is the way you generated your certificate. I see the IssueTo and IssueBy is the same name and that you have no certification chain. So I suppose you generated one certificate and then put the same certificate into the personal store and into the root authority store.

When the certificate chain is not trusted Request.ClientCertificate won't be populated. I think this could also happen if there is no certification chain at all.

Maybe you should try to create a real self signed certificate by creating one root certificate you put in the root store and then use it to sign your client certificate and put it in the personal store.

For a short version this way to create the two certificates seem to work:

makecert.exe -r -n "CN=My Personal CA" -pe -sv MyPersonalCA.pvk -a sha1 -len 2048 -b 01/21/2010 -e 01/21/2016 -cy authority MyPersonalCA.cer makecert.exe -iv MyPersonalCA.pvk -ic MyPersonalCA.cer -n "CN=John Doe" -pe -sv JohnDoe.pvk -a sha1 -len 2048 -b 01/21/2010 -e 01/21/2016 -sky exchange JohnDoe.cer -eku 1.3.6.1.5.5.7.3.2 pvk2pfx.exe -pvk JohnDoe.pvk -spc JohnDoe.cer -pfx JohnDoe.pfx -po THE_PASSWORD_USED