C# - Sending Client Certificate Though HttpWebRequest, Intermittenly Working?
Oct 7, 2010
I have created a web application that calls a web service that requires a Client Certificate for authentication. Here is a snippet of how I am building the request:
// Grab Certificate
X509Certificate2 cert2 = new X509Certificate2(AppDomain.CurrentDomain.BaseDirectory + GiftCardConfig.A2A_CertificateLocation, GiftCardConfig.A2A_CertificatePassword, X509KeyStorageFlags.MachineKeySet);[code]....
This all works, but only intermittenly. About every 24 hours the Server hosting the web service returns a 403:Forbidden error. The only way to fix it is to do a iisreset of the server running the web application. We are completely stumped about this issue and would like to know if this issue has something to do with the web application or the configuration of the server it is being hosted on.
View 1 Replies
Similar Messages:
Nov 30, 2012
Let's assume our users in their office using Internet explorer to sign some Web Pages using their client certificate imported into the Internet explorer browser (let s assume no other browser is used)
what is a good approach/architecture for validating the client certificate (Internet Explorer), how to send that certificate or the signed form to the server and how do we verify the signature
Should we use smart client approach integrated to the web application or some silverlight or so or is web form/web pages enough to implement this security requirement ?
View 1 Replies
Feb 12, 2010
I am running the code below to authorize payments but I wanted to know how secure is it to submit sensitive data like that, do I have to worry about any issues going on or no?
[Code]....
View 3 Replies
Sep 16, 2010
When i'm sending an HttpWebrequest, I've this response:
"Go away, Robots are not supposed to visit this page"
What can I do for avoid this?
View 1 Replies
Aug 31, 2010
Im trying to send some xml inside a soap request to a webservice using the HttpWebRequest class. I know this isnt the best way, but my hands are tied by company policy so i have to do it this way. My webmethod has an input parameter "SourceXML" so my soap request has this node
<SourceXML></SourceXML>
I need to insert the xml in this node but whenver I insert it and try to send it to my web method I get an error "400 bad request"
Is this even possible ? I need to insert the xml as a string literal and read it in the web method
[Code]....
[Code]....
View 2 Replies
Dec 6, 2010
Using a Windows application I am sending a web request to a web page and getting the response back using the following code
HttpWebRequest oRequest1 = (HttpWebRequest)WebRequest.Create(url);
oRequest1.ContentType = "text/xml";
using (Stream stream = oRequest1.GetRequestStream())
{
stream.Write(fileBytes1, 0, fileBytes2.Length); //fileBytes1 - contains the data of first request
}
HttpWebResponse Response1 = (HttpWebResponse)oRequest1.GetResponse();
->The above code works fine
But I need to enhance the code to accomodate following additional scenario
->Send another request to the same web app and
->get the response back
The first request sent contains the credentials to access the web application the second request sent doesn't have credentials, it must use the credentials of first request. I am using the same (following) code for the second request too. I get an error saying that it's looking for credentials
HttpWebRequest oRequest2 = (HttpWebRequest)WebRequest.Create(url);
oRequest2.ContentType = "text/xml";
using (Stream stream = oRequest2.GetRequestStream())
{
stream.Write(fileBytes2, 0, fileBytes2.Length);
}
HttpWebResponse Response2 = (HttpWebResponse)oRequest2.GetResponse();
So how do I accomplish this? Should I be sending the second request using same session or same connection?
View 2 Replies
Jun 24, 2010
There is something I don't understand, When I don't put certificate at all, the SSL connection is established successfully, I wonder how the server decrypt the message without client certificate.What is client side certificate is for
View 4 Replies
Nov 26, 2010
I developing web application to sign, verify , encrypt, decrypt data at client side with client certificate.
It's happening in server side but how can I implement it client side.
View 1 Replies
Jun 25, 2010
I have hosted a secure WCF service on cloud with a certificate created by makecert.
Now I want to restrict the access to the service by allowing only those clients who have the certificate generated by me.
What is the best approach to implement this
* Shall I go with the changes in the configuration file
* Or Shall I write the code to validate this in the service
* Is there any other alternative?
View 1 Replies
Feb 22, 2010
I want to make a registration page for clients, that would only contain a button register and unregister. When the user would click on any of these 2 button he would should be prompted to select a client certificate from his computer. I would also like to extract the email address from the selected certificate.
Is there any way of declaratively configuring IIS 7 to require a client certificate for just 1 .aspx page on the website. I could then extract the certificate from Request.ClientCertificate, right?
View 1 Replies
Aug 16, 2010
I have a WCF service which accepts X.509 certificate signed incoming messages. As per my understanding the client will send the message with signature encrypted using his private key and web services will decrypt the signature with client's public key. This ensures that the sender of the message is holder of the private key and that he is certified by the server trusted CA as "He is what he claims to be".
It's being a highly secure application I need to give access to only certain clients regardless of whether they are trusted or not. (This is to take care of good turned bad scenario :-)) How do I achieve this? Is there any way to get the client information as subject name etc from his certificate in C# code? Is there any example of this usage?
View 2 Replies
May 24, 2010
I'm new to cryptography and I'm a bit stuck:
I'm trying to connect (from my development environment) to a web service using HTTPS. The web service requires a client certificate - which I think I've installed correctly.
They have supplied me with a .PFX file. In Windows 7, I double clicked the file to install it into my Current User - Personal certificate store.
I then exported a X509 Base-64 encoded .cer file from the certificate entry in the store. It didn't have a private key associate with it.
Then, in my app, I'm attempting to connect to the service like this:
var certificate = X509Certificate.CreateFromCertFile("xyz.cer"));
var serviceUrl = "https://xyz";
var request = (HttpWebRequest) WebRequest.Create(serviceUrl);
request.ClientCertificates.Add(certificate);
request.Method = WebRequestMethods.Http.Post;
request.ContentType = "application/x-www-form-urlencoded";
I get a 502 Connection failed when I connect.
Is there anything you can see wrong with this method? Our production environment seems to work with a similar configuration, but it's running Windows Server 2003.
View 2 Replies
Sep 9, 2010
I dont have a lot of background with SSL and X509 configuration and support with my Asp.Net application, so I was wondering if someone can explain or point me in the right direction to MSDN or any other article or posting explaining if it's possible to do what I am looking to support in my environment.
I have IIS 6.0 with SSL (Verisign cert) as well as "Require client certificates" working against a local installation of Microsoft Certificate Services, https://<domain>/certsrv, where users can request and install client certs (both xp clients for basic
mode, and Vista/7 for advance mode).
Here's what I am up against:
I have a segment of users coming from a virtualized server environment where this environment does not store personal settings for more than 48 hours. It's not an internet cafe, but rather an actual business where their IT staff uses server images to reimage each virtual server in the farm every 48hrs. Thus losing all users data in the "Current Users" Certificate Stores.
The IT staff give users a network folder share to store any personal items (docs, spreadsheets, links, etc.). The servers consist of Windows Server 2003, and will be migrating to Windows Server 2008 in the next 6-9 months.
These users have rights in Internet Explorer to navigate to my certsrv site and use activex to to request and install certificates then clode and reopen the broser to navigate and render the asp.net app.
Problem:
It's a pain to ask the users to request and have issued a client certificate every 48 hours.
The IT staff of this company has asked if I can create some sort of certificate that they can load in the "local computer" certificate store, NOT the "Current User" store, that will be made part of their base image for all their servers, and that this certificate is then used to properly authenticate all users on these servers to my IIS with "require client certificates" selected.
Question:
Is this possible, and if so what can I do on my side to create the proper certificate to give to the IT staff at this business to put into their servers "local computer" certificate store? I assume either under the Personal->Certificates store, or under the "Trusted Root Certification Authorities"->Certificates store. Thus allowing any user of these servers in their thin client virtual environment to open I.E., navigate to my site and select a certificate from the "Choose a digital certificate" popup that allows them to render my Asp.Net application, or avoids this popup altogether.
If this is the wrong forum to post in, please advise and I will move. Probably due to vernacular on my part, I have been unable to find any resources on here, MSDN or Bing to help me solve this problem.
View 1 Replies
Jul 26, 2010
I need to send a X.509 client certificate to a web service in byte array (not attached to request). Besides the certificate, the caller will also send data and signed data. From the web service I can verify if the signature is ok but I don't know what is required to verify that the certificate is ok. I have the client certificate issuer CA trusted in Server (where the web service runs).
More specifically, how can I verify if a X.509 certificate itself is valid? I need to do it in web service not from IIS.
View 4 Replies
Mar 1, 2010
I would like to identify users that connect on a intranet web server (IIS) with client certificates.
I've set up a CA server on a Windows 2003 server pc. On my development pc, i've a windows xp with a web server (IIS) running.From my web server, i generated a certificate request (i specified the netbios name of my web server because this setup is for an intranet), i used that request to generate a web server certificate and i installed it on my IIS to allow SSL connection. . Now, i can connect with https to my web server from an internet explorer. I configured the web server to 'require client certificates'.
I would like to authenticate the users with a client certificate installed on each users pc. My CA server allows users to request a client certificate (domain user) from the CA server just by typing the url of the CA server and click 'User Certificate', 'submit' and then 'Install this certificate'.
In order to test my setup, i opened a Internet Explorer from a pc which resides in the domain and i requested and installed the user certificate. Then i connected to my web server and i get a window with the title "Choose a digital certificate". This window is always empty and never proposes the client certificate i previously installed on the user pc.
I've no idea of what i missed during my setup. I'm still wondering how the browser knows how to select which certificate must be displayed according to the url typed in the address bar.
View 6 Replies
Oct 15, 2010
I'm trying to receive a Client Certificate in a Web Service and having some problems.
Client
[Code]....
The certificate seems to be correclty loading and added to the client.
The client connects to the server with HTTPS.
Server:
[Code]....
cert.IsPresent is false and all certificate fields are empty.
IIS is configured to Accept Client Certificates.
Reproduced in two environments:
- Windows 7 x64, IIS 7, VS 2008, .NET 3.5
- XP x86, IIS 5, VS 2008, .NET 3.5
Always in the Web Service the Client Certificate is not proesent. I haven't been able to find any other configuration I should do.
View 1 Replies
Jan 13, 2010
We have a large extranet asp.net application that users forms authentication. In addition, for SCCM purposes, each computer in the company has a client certificate installed.
Now the question has been raised:
Is it possible for us to test for the presence of this certificate from our asp.net code behinds?
We don't want to switch our security to require client certificates to access the site, there are just parts of some pages that we'd rather not display if the person viewing the site is not using a company issued machine.
View 2 Replies
Feb 12, 2011
I want to implement client certificate in IIS 7.5 in windows 7. As per my knowladge I need to setup server certificate first for IIS. But I could not figure out how to do that.
View 2 Replies
Mar 21, 2011
I'm running into an issue which has me going in circles with the references I've been able to find online. I have an application which is using client certificate authentication (with a removable token). It works well as long as a user doesn't leave their computer. If the token is pulled and any timer events fire on the page causing a postback the application loses its authentication and ends up at an error page.
I've seen some sites which use a mix of (presumably) forms authentication and windows authentication so that the network authentication only has to happen one time and then a token is built which the session relies on for future requests. I had hoped to use something similar to this so that when a new user enters the application they are redirected to a secure page which will request the client certificate (same principal as windows authentication) and then create the token before sending the user back to
their requested page. So far no luck with this.
If I try to setup a subfolder in my website with a different authenication scheme from the root ("windows" vs "forms") I'm given an error in Visual Studio about requiring a separate application in IIS for this to be valid. Working in a development environment this is not practical. Every other technique I've run across which tries to force one page (or folder) to use a windows credential is leaving me with an empty identity object.
Has anyone come up with a way of using a mix of authentication methods to reach the goal I have and still work inside of Visual Studio for development activities?
View 1 Replies
Aug 30, 2010
I have created a web service that authenticates with username and password, works fine.
Basically this one, http://msdn.microsoft.com/en-us/library/ff649647.aspx
Now I also want to connect to this web service using client certificates, works fine
http://msdn.microsoft.com/en-us/library/cc948997.aspx
But I would like to when authenticated via client certificates, connect that certificate to a user in the membership database. So that I can use Roles.IsUserInRole(...) and such.
I thought that, well if I implement a Custom certificate Validator http://msdn.microsoft.com/en-us/library/ms733806.aspx then I could check for example subject and map that against a created username in the membership database.
But in the class X509CertificateValidator public override void Validate(X509Certificate2 certificate) I don't have the same ability as when the user is authenticated
like
void OnAuthenticateRequest(object source, EventArgs eventArgs)
HttpApplication app = (HttpApplication)source;
Basically how can I do this
app.Context.User = new
GenericPrincipal(new
GenericIdentity(username,
"Membership Provider"),roles);
within
public override
void Validate(X509Certificate2 certificate)
and if that is not possible, can this be solved differently? Bottom line, how do I connect a client certificate to a user account in the membership database. Is there a MSDN article on how to do this?
View 1 Replies
Jun 24, 2010
I am trying to authenticate the users on a web application through their Active Directory credentials. What should I use? Client Certificate Mapping? or Forms? I am currently using a Form Authentication, but it is not working. It keep telling me my credentials are not correct. Should I switch over to something more recent? Client Certificate Mapping is installed, I just don't know how to set it up. Isn't there something about purchasing a certificate for the website? Is there anything else I can use that is secure and uses Active Directory credentials?
View 10 Replies
Oct 26, 2010
I've been pulling my hair out about this for ages. I have a WebService which sends a zip file to the browser. This works; when I test the WebService and 'invoke' the method through it directly, the zip file is downloaded to the browser correctly.
The problem arises when I use jQuery to send an AJAX request to the WebService - the zip file is downloaded to the response, but it stays in the response and doesn't download as a file.
Here is my code:
[Code]....
Now this works since the file downloads when I use the 'invoke' function when navigating directly to the service.
Here is my jQuery AJAX request...
[Code]....
I added the code in 'beforeSend' so that the request states explicitly what type of response the browser should expect.
I've been using Firebug to monitor the request/response headers and can't see anything wrong with them (except when I look at the content of the response, it's full of binary data AND its the same size as the file I'm sending.
I just attempted to upload screen-dumps of the request/response headers and the content of the reponse but I don't have enough reputation points to do this yet :-(
The Response is the same size of the Zip file so I'm assuming its being sent back to the browser, but the browser doesn't know what to do with it.
Tested in IE, FF & Chrome and the results are consistent.
View 2 Replies
Feb 21, 2011
I'm transforming lotus note application to ASP.NET.In lotus note, we can pass the application(data) from staff to his/her manager for approval.The staff can also check status of his/her data whether the manager is opening it, approved it or not.This process can be done in real time. I mean on the staff screen he/she will see status is changing from data sent --> manager is opening --> manager accepted or manager rejected it.In the same time, if other staffs try to track this application(data) they will see the same screen with the first staff.ow, in asp.net, i'm thinking of sending data from staff to manager directly. I don't want manager's web browser need to do polling for every xx millisecond. I'm not quite too sure it can be done or not in asp.net because i'm not the WEB guy.After doing a research for a while, i found that comet may help me on that but it seems pretty hard. And I don't know it is suitable for my problem or not or someone may guide me a better idea on this.
View 1 Replies
Jul 20, 2010
I have a page (generic handler) on which I want to return the status code 500 to the client to indicate that something is wrong. I do it like this:
Response.StatusCode = 500;
Response.StatusDescription = "Internal Server Error";
And at the same time I render a friendly message telling the user that something went wrong. But instead of seing my message, I get the default IIS message saying something like this:
Server Error
500 - Internal server error.
There is a problem with the resource you are looking for, and it cannot be displayed.
And if I go in to IIS and remove the error page for 500, I get this message:
The page cannot be displayed because an internal server error has occurred.
It works as intended in IIS6, but not in IIS7. What should I do to get it working in IIS7?
View 1 Replies
Mar 11, 2011
I'm converting a bunch of FOXPRO / FOXWEB apps to ASP.NET.
The underlying DB is still foxpro (for the moment).
I am passing a table to some VB.NET code that I want to have converted to a CSV file and sent back to the client for download. And it works! Sort of ... It works sometimes, but at other times, instead of asking me if I want to download the CSV file, it just spews the file to the browser window.
On the asp side, I am passing the response object, the table and the csv file name.
[Code]....
View 3 Replies
