ASPX webform app + obtain client x509 certificate and send it to 3rd party

Question

0.00/5 (No votes)

See more:

Dear all, good afternoon.

Here's a new question. We are being asked to have our Web app (ASPX webforms) obtain a client's X509 certificate, to later present it to another site in order to query o consume a web service.

The site is already SSL enabled and requesting client's certificates. I understand we somehow would have to retrieve such certificates in code and the attach it to the web service request.

Is it possible to do it? can anybody point at relevant documentation?

Thank you very much.

What I have tried:

So far, online search, but since I am really sure what to look for, I am absolutely lost.

Posted 18-May-17 9:04am

alexvw

Updated 18-May-17 15:31pm

Add a Solution

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Dave Kreskowiak · Accepted Answer · 2017-05-18T09:18:00

Solution 1

As far as I know, there is no way your client-side code can get at the certificates installed, let alone export them without the users interaction (consent) and sending them to a 3rd party site.

Posted 18-May-17 9:18am

Dave Kreskowiak

Comments

alexvw 18-May-17 21:27pm

Hi Dave, thanks for your input.

Here's a quick and small update; I was told about an hour ago that we just need to read the client's certificate to obtain two values (CN and another one) to use them as credentials to consume a third party's web service. Does that make sense?

I thought we could somehow read client's certificate(s), and ask (the client) which one to use for such purpose. How that does sound?

Dave Kreskowiak 18-May-17 22:46pm

Code running in the browser is forbidden from seeing anything on the client machine, including certificates. It doesn't matter what little piece you're looking for.

alexvw 19-May-17 9:02am

Short after I read your first message, I came to think that. If we could just do it, then it would not be secure after all.

Now I know I must look for a different way. Is it possible for a SSL enabled site to request client certificates (the formal way = through browser) for certain page along the way rather that from the start?