Re: X.509 Certificate based authentication

I had some familiarity with public-private keys at a theoretical level
and in the context of SSH and PGP prior to this project, but I had
never used them with ASP.NET. I think this problem would have been
easier to figure out if the .NET documentation was better. In
particular this document could have more detail.

ms-help://MS.VSCC.v80/MS.MSDN.v80/MS.NETDEVFX.v20.en/cpref10/html/
P_System_Net_HttpWebRequest_ClientCertificates.htm

All it really says is:

HttpWebRequest.ClientCertificates Property

Gets or sets the collection of security certificates that are
associated with this request.

It does not say that the certificate is used to sign the request.
This implies to me that it simply passes the certificate verbatim in
the request (as a header or something). As far as I understand,
simply passing the certificate over the wire verbatim is not a valid
way of authentication. Additionally, the book "Building Secure
Microsoft ASP.NET Applications" from Microsoft Press did not clarify
the question.

After 4 days of googling on this topic and talking to various people
at my company, I have come to the realization that this stuff is not
widely understood. This is disconserting, because I think a security
system needs to be understood by its owners, because otherwise how can
they verify that it is indeed secure?


.

Relevant Pages

  • Re: Computer and User Certificates Issues
    ... Enrollment of User Certificates using the custom v2 User Certificate Template ... I can NOT request the custom v2 Computer Cert nor the included v1 no ... Concerning permissions, these are the exact permissions I am using now: ...
    (microsoft.public.security)
  • Re: Cannot request computer certificate.
    ... request a computer certificate for about 9 months. ... and verify that you can get a computer/server certificate from it. ... List of NetBt transports currently bound to the Redir ... DNS Host Name: srvr3.domain.com ...
    (microsoft.public.windows.server.security)
  • RE: SIMple SSL question ??
    ... OK - i would also delete a cert request file lying around. ... But a certificate is a pub key + extra info. ... That said - if someone compromises the server he will also find a way to retrieve the private key. ... traffic between the initial web server and the client. ...
    (microsoft.public.dotnet.security)
  • Re: how can we restrict what certificate WSE will use?
    ... the valid x509 certificate which is used to identify him'. ... X509SecurityTokenManager to verify the request is from a trusted client. ... the problem is that he can not passed the authentication (suppose we ... > decrypte and signature validation process. ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: Web Certificate Enrollment security problem
    ... Enrollment works only with the NetBIOS Name and not with the FQDN. ... Svyatoslav Pidgorny, MS MVP - Security, MCSE ... access auditing and logging "issue and manage certificate requests" on ... Have seen that there is a component "Certsrv Request" when launching ...
    (microsoft.public.security)