I am trying to open my homepage with HTTPS in my test server. Is there a way i can create Self signed certifcates and see if https works. some links or any ideas with how to do Its an ASP.Net project and IIS V6.0
View 3 RepliesI would like to do login to the website using certificates.
I want to have a secure login.
How to create certificates for login?
How certification process?
I've noticed that it is possible SQL Server 2005/2008 to authenticate replication accounts using certificates. Is it possible to authenticate .NET SqlConnection in the same manor?
Ideally, I'd like to do away with password authentication completely and have the aspnet user connect using a certificate stored against its account.
Is it possible to read the certificate(s) in a clients browser through code? The situation I have is, someone is going to access my website with a certificate installed. In that certificate, there will be specific information related to my application. I will be pulling that specific peice of info out, and then doing what I need to with it.
I can already read certificates from my local machine (using the X509Certificate2 class), and using string manipulation, traverse out the information needed. The only part I can't do, is pull certificates from the browser.
I have tried using the '.IsPresent' function on an HttpClientCertificate object, but that always returns false (even though I have four certificates installed on my machine).
I am trying to decrypt using an X509 certificate private key. I am using the following function:
[Code]....
Is anyone using digital certificates in project ?I have created a digital certificate using Microsoft certificate services.I have installed this certificate on my website.When I access website over https I get digital certificate error in browser.Most common cause for this error is incorrect date/time settings on client machine. This is not the issue in my case.
View 1 RepliesI am fairly new to web development and have never used Digital Certificates before. I assume using a digital certificate on a silverlight web page is the same as using one on any other web page, but i thought i should check. There are a few example of digitally signing the .xap file on the internet, would it then be a case of simply buying the certificate (from verisign or somewhere similar) and distributing it to customers?
View 1 RepliesI need it for the test purposes.. (don't want to see „The remote certificate is invalid..." Exception.. )
View 3 RepliesI am not sure whether I posted the question at the right place, But I don know how to start approaching the problem ,
I need to open a .cer cirtificate from the server side. The .cer cirtificate will be stored in the client browser.
I tried locally putting the cirtificate in my hard drive and I could open it and get the info I want using
X509Certificate2 certificate = new X509Certificate2("C:\OCX\abc.cer");
But what will I do when I need it to open it from client browser?
There is an existing classic ASP application that uses CAPICOM to encrypt a file's content using a certificate. A new file is created with the encrypted content and put on a location from where another 3rd party web application picks up the file (with encrypted content). They use the certificate to decrypt the encrypted data .
I am re-writing this piece of the software in ASP.Net and have read a bit about the encryption algos in .Net. But I am unable to come to a solution I am aiming for.
My questions:
a.) CAPICOM and .Net encryption? Any resource that has some sort of method mapping between the two?
b.) How to encrypt the content of a file using a certificate's private key? The reason I'm looking for this is this statement
The Sign method creates a digital signature on the content to be signed. A digital signature consists of a hash of the content to be signed that is encrypted by using the private key of the signer.
Source: [URL] ....
Background: From a desktop application, users will navigate to an SSL-encrypted web portal where they will have to enter a username / password if it's their first time logging in. I want to be able to securely persist their user session. I was thinking of using encrypted cookies, storing their username and a unique session token / key, but was wondering what benefits client certificates offered in terms of security.
The way I see understand it currently:
Encrypted cookies:
Saved on the user's machine just like any other cookie Since the entire site is SSL, the contents of the cookie cnnot be tampered withEasily implementableWhen a user logs in again, invalidate the token / key and issue a new one
Problems:
Anyone attempting to access the web portal on the computer with a saved session will be able to, but this is a problem with any persisted session, right?
How do I know that computer A is computer A and not just computer B that copied computer A's cookie?
Client Certificates:
A pain in the ass to install Will uniquely identify that person's computer (or can it be restricted to the user account) to the web portal If the client certificate is stolen, then the account is compromised
Question: For persisting user sessions with the utmost security, would encrypted cookies be sufficient or would I need to install client certificates? How do they differ?
I was wondering if it is possible to call a webservice or send a SOAP request using a provided certificate to encrypt my password (my identity) and use another to encrypt/sign a timestamp, service header, & soap body? Does anyone have any material or sample code where I can test encryption and security too? It doesn't have to be my own certificates, I just want to see it work and then I can possibly tailor it to my needs. After the SOAP request, there will be a provided response which I assume I will have to decrypt.
I found this thread, but it doesn't seem to use signatures or an SSL connection. Does VS 2010 have some extra features to help out on this? I believe the SOAP should look like this.
<soap:Envelope>
<soap:Header>
<svchdr:ServiceHeader>
<svchdr:StaticRegion>...</svchdr:StaticRegion>
<svchdr:DynamicRegion>...</svchdr:DynamicRegion>
</svchdr:ServiceHeader>
<wsse:Security>
(Signature Info)
</wsse:Security>
<soap:Body>
...
</soap:Body>
</soap:Envelope>
I write a ocx file and package into cab file.I execute some commands as below:
cabarc -s 6144 N my.cab ./MyActiveX.ocx
makecert -sv mytest.pvk -ss testCertStore mytest.cercert2spc mytest.cer mytest.spc
pvk2pfx -pvk mytest.pvk -pi "mypassword" -spc mytest.spc -pfx mytest.pfx -f
signtool sign /n "myactivex" /du http://localhost /f mytest.pfx /p "mypassword" -t http://timestamp.verisign.com/scripts/timstamp.dll my.cab
The error message appears as below when I use signtool:
SignTool Error: No certificates were found that met all the given criteria.
Number of errors: 1
I am using a Self signed certificate for HTTPS. I have it ready. what should be changed in IIS and also what should be changed in the code for https to come into affect. I need https for some pages(not all).
View 2 RepliesI have a internal site used by employees of my company that uses ASP.Net 3.5, Ajax and the Ajax Control Toolkit and is secured using https and requires a client certificate to gain access to the site. We are getting the following error when updating drop down lists on the very first page of an application wizard we have built. The page uses an UpdatePanel with PartialPagePostbacks enabled.
Sys.WebForms.PageRequestManagerServerErrorException:
An unknown error occurred while processing the request on the server. The status code returned from the server was: 413
ScriptResource.axd Line: 5
Code: 0 Char: 62099.
I have increased the maxRequestLength value to 8192Kb (which is way overkill), the readAheadBuffer to 4096Kb, set all the timeouts I can find, and this problem keeps showing up for my users. I can reproduce the error if I let the initial page site idle for 2-3 minutes before doing the partial page postback to move to the next segment. I have been chasing this now for a couple of weeks, and keep coming back to the same sites with the same answers.
This is in VS 2005. And IIS is 6.0. I am trying to use Self signed certificate for HTTPS. In the code i am redirecting from http to https for few pages. It is nt working fine. and in the IIS manager, for each page that i want HTTPs, i have changed its setting by checking "Require Secure Channel(SSL)" and "Require 128 bit encryption".
public void setSecureProtocol()
{
string redirectUrl = null;
bool bSecure = true;
bool SecureConnection = true;
if (bSecure && SecureConnection)
redirectUrl = Request.Url.ToString().Replace("http:", "https:");
else
if (!bSecure && SecureConnection)
redirectUrl = Request.Url.ToString().Replace("https:", "http:");
if (redirectUrl != null)
Response.Redirect(redirectUrl);
}
Pages throw me an error like this The page must be viewed over a secure channel The page you are trying to access is secured with Secure Sockets
Layer (SSL).
Please try the following:
* Type https:// at the beginning of the address you are attempting to reach and press ENTER.
HTTP Error 403.4 - Forbidden: SSL is required to view this resource. Internet Information Services (IIS)Internet Information Services (IIS) When i try to put https in the start of the URl, it wont call. I have no idea whats wrong in here. Here, Its not redirecting from http to https. For the pages that i am not redirecting in the code behind, and changing in the IIS, i can see the HTTPS when i check the two checkboxes. Internet Information Services (IIS)
I have created a self signed certificate for IIS6 for my app. App works fine when I access it from the web server. But when I access the app from client machine it gives an error "The connection has timed out" on IE, and on Firefox it does not load the page.
View 4 RepliesI want to use UrlReferrer after the user has signed-in.
Can UrlReferrer also refer to a webpage outside of the web project? .. this is not what I want...
Using the form view control, when I click on the edit button to modify a record. the form is in update mode. When I clcik the update button any modified data is posted, but, for some reason the name in one filed named, user_update_name, does not. The name in the field will not change unless the field was empty. For example, if test1 was the last user to modify the record and the user_update_name field was empty, the field was now say Test1. If Test2 modified the same record, Test1 name will still display in the field. The command that fires when the update button is clicked.
Imports System.Data
Imports System.Data.Common
Imports System.Configuration
Imports System.Collections
Imports System.Web
Imports System.Web.Security
Imports System.Web.UI
Imports System.Web.UI.WebControls
Imports System.Web.UI.WebControls.WebParts
Imports System.Web.UI.HtmlControls
Imports System.Data.SqlClient
Imports Microsoft.VisualBasic
Protected
Sub FormView1_ItemUpdating(ByVal sender
As System.Object,
ByVal e
As System.Web.UI.WebControls.FormViewUpdateEventArgs)
Handles FormView1.ItemUpdating
frmPartsDS.UpdateParameters("user_update_name").DefaultValue = User.Identity.Name
End
Sub
How to send a digitally signed through C# code.i apply the no of ways but still not able to perform.
View 6 RepliesI am using the aspnet membership features and check to make sure the user is logged in before display the page:
Protected
Sub Page_Load(ByVal sender
As
Object,
ByVal e
As System.EventArgs)
Handles
Me
.Load
'Check for UserName
If Context.User.Identity.Name
Is
Nothing
Or IsDBNull(Context.User.Identity.Name)
Or Context.User.Identity.Name =
String.Empty
Then
Response.Redirect(
"~/Login.aspx"
)
End
If
Session(
"UserName"
) = Context.User.Identity.Name
UserName.Text = Session(
"UserName"
)
UserIDValue.Text = Membership.GetUser().ProviderUserKey.ToString()
End
Sub
Everything was working fine when I had two separate applications (two web.config files) using the same data base and the same "applicationName" in the web.config files...............
In the control Chart, I add few points, selected from the database:
var Diagram_1 = Razrez_D1.Series ["D1"];
sqlDA.SelectCommand.CommandType = CommandType.StoredProcedure;
sqlDA.SelectCommand.CommandText = "Razrez_D1";
sqlDA.SelectCommand.Parameters ["@ date1"]. Value = Session ["date1"]. ToString ();
sqlDA.SelectCommand.Parameters ["@ date2"]. Value = Session ["date2"]. ToString ();
sqlDA.Fill (dataSet1, "Razrez_D1");
sqlDA.SelectCommand.CommandType = CommandType.Text;
for (int i = 0; i <dataSet1.Razrez_D1.Rows.Count; i + +)
(
string name_s = dataSet1.Razrez_D1 [i]. Name.ToString ();
name_s = name_s.Substring (name_s.IndexOf ('№')). Trim ();
Diagram_1.Points.AddXY (name_s, dataSet1.Razrez_D1 [i]. Count);
Diagram_1.Points [i]. BorderColor = System.Drawing.Color.Black;;
Diagram_1.Points [i]. BorderWidth = 1;
if (Convert.ToInt32 (dataSet1.Razrez_D1 [i]. count)> 5)
(
Diagram_1.Points [i]. Color = System.Drawing.Color.Red;
)
else if (Convert.ToInt32 (dataSet1.Razrez_D1 [i]. count)> = 4 & & Convert.ToInt32
(dataSet1.Razrez_D1 [i]. count) <= 5)
(
Diagram_1.Points [i]. Color = System.Drawing.Color.Yellow;
)
else if (Convert.ToInt32 (dataSet1.Razrez_D1 [i]. count) <4)
(
Diagram_1.Points [i]. Color = System.Drawing.Color.Green;
)
)
The problem is that the points on the X axis are signed that way: first is not signed, second is signed, third is not signed etc How can I sigh all points?
I developped a light WinForm Control that run like an ActiveX in a Web Page. No problem yet.However, when i want to access System.IO I got a Security Exception. It seems that I have to sign my assembly, so that's what I did. When my assembly is signed, my Web Browser can't show the Winform. I set IE to download any ActiveX in the Security tab ... Nothing happens. Uncheck "Sign Assembly" ... works fine ...
View 2 RepliesI created a self-signed certificate for testing in IIS7 (win 7 64 bit environment ). I attached the cert to the bindings, etc and everything was fine. But when I crank up the site I get the generic error: There is a problem with this website's security certificate. Continue to this website (not recommended). What should I be looking at to fix this
View 5 RepliesI'd like to add a typical 'Signed in as' bar, cf this site.Since it's 'common', first thought is: master page.However any controls designed on a master page are only rendered 'in' the final page...... so you need the 'this' (Page reference) to access the control... so you can't write code 'on' a master page, whose 'this' is not a Page.HttpContext has Session, Request, etc - all useful but none with a 'Page' reference that I've noticedUpdatePanel looks neat, but I'd prefer a non-Ajax solution to learn the 'basic' way before perhaps later making it 'smarter' with Ajax.Question therefore is: how to write a script that is site-wide, for a master page, that references controls on the (rendered) master page, with or without a 'Page' reference.
View 1 Replies