Validate the Client certificate in web api

Question

0.00/5 (No votes)

See more:

Hi,
I need to implement the message signing certificate security in my web api. Request will be coming from external application where they will be sending the certificate details uisng X509Certificate2 in httprequest. Now how can i read the certificate which has come in request and validate against the certificate which i have in my server.

OR is my understanding about message signing certificate security is worng. Please reply as soon as possible

Posted 22-Dec-15 2:46am

Mithun P

Add a Solution

Comments

Nathan Minier 22-Dec-15 10:45am

Have a look at:
https://msdn.microsoft.com/en-us/library/system.security.cryptography.x509certificates.x509certificate2.verify(v=vs.110).aspx

There's a link to drill down if you need to in the Remarks section.

Edit: The cert will only be compared to your server's cert store if your server is the CA.

Mithun P 23-Dec-15 0:54am

Hi i have problem to validate the cert when i get request. i am not able get the cert details from request

Nathan Minier 23-Dec-15 7:28am

Have you tried recovering it from Request.ClientCertificate.Certificate ?

Edit: As a correction to my previous comment, if you have a .cer (public key) file on hand you can use it for validation, if you are not able to extract the certificate from the request.

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)