Today, I tried to implement SSL-based transport security for the webservices calls between our smart client running on NT4 and the server. Additionally, the client was supposed to include a user certificate in each call.
For the server configuration, IIS help provided a pretty good step-by-step tutorial which made it really easy.
The client certificate can be included with the following code (from MSDN):
// Load the client certificate from a file.X509Certificate x509 = X509Certificate.CreateFromCertFile(@"c:\user.cer");// Add the client certificate to the ClientCertificates property of the proxy class.bank.ClientCertificates.Add(x509);
A blog post by Jan Tielens described the steps necessary to change the client code so that it accepts the servers SSL certificate.
Finally, I wanted to take the client certificate from Windows Certificate store instead of the file system and noticed that currently (.NET FX 1.1) there is no managed implementation for this scenario. A webpage by Michael Gallant explained two possibilities for that: one using the unmanaged CAPICOM dll and the second by P/Invoking the CryptoAPI. I decided for the second due to lower deployment hassle and it worked without problems.
To enumerate all certificates in the stores you can use the function CertEnumCertificatesInStore.
Disclaimer The opinions expressed herein are my own personal opinions and do not represent my employer's view in anyway.
© Copyright 2012, Denis Bauer
