4

In MVC application I need to verify that the client certificate was signed/issued by a specific CA.

I know how to get Request.ClientCertificate and X509Certificate2 from that, but I can't figure out how to check the issuer.
Request.ClientCertificate.Issuer gives the subject of Issuer, but I don't think that is secure enough.

I would prefer to be able to check issuer thumbprint, so how do I retrieve it from client certificate?

1 Answer 1

3
// get the X509 from HTTP client certificate
var x509 = new X509Certificate2(this.Request.ClientCertificate.Certificate);

// create the certificate chain by using the machine store
var chain = new X509Chain(true);
chain.ChainPolicy.RevocationMode = X509RevocationMode.Offline;
chain.Build(x509);

// at this point chain.ChainElements[0] will contain the original
// certificate, the higher indexes are the issuers.
// note that if the certificate is self-signed, there will be just one entry.
var issuer = chain.ChainElements[1].Certificate.Thumbprint;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.