1

I have an Web Forms site that will be calling my IIS hosted Web API service. Both the site and the Web API are hosted on the same physical machine. We also have a x509 certificate on this same machine.

I would like the Web API to use this certificate to authenticate requests. So that it will only accept requests from clients that "use" this certificate.

When I say "use" I was thinking to do either:

  1. to use Request.ClientCertificates.Add(myCert); and then in the API - retrieve the certificate from the request and validate it.

2.Or if this is too fiddly to set up (see question below) - to simply sign or encrypt a token (a single word) in a request header. And then verify or decrypt the token in the API service.

My question is - for option 1.

I am unclear about client certs. When I am developing the client and the service, do I need to set up SSL, load the certificate into IIS and debug in IIS to test/debug this? Or can I test the end to end call just using WebDev?

The reason I ask this - when I tried to do a very simple example in WebDev, I added the certificate to the collection client side, and yet the certificate was not present in the request when the Web API received the request.

Thanks alot.

3
  • 2
    You might want to check out @pmhsfelix's security chapter in our Web API book ofps.oreilly.com/titles/9781449337711/ch_security.html If it is missing the content you are looking for, add a comment and let us know. Jan 2, 2013 at 15:57
  • 1
    Have you seen this question social.msdn.microsoft.com/Forums/pl-PL/vsdebug/thread/… ? It looks like you need to set it up in IIS and then attach the debugger to the process (If I have interpreted your question correctly)
    – Mark Jones
    Jan 2, 2013 at 16:50
  • @DarrelMiller Thanks this article looks perfect! However, when I go to set up the Https binding in IIS7 and try to use the server certificate "www.example.net" (which is stored in my Personal store) I get the following: "One or more intermediate certificates in the certificate chain are missing. To resolve this issue make sure all of the intermediate certificates are installed." I think I have followed the article correctly. In Trusted Root Certification Authorities store I have "Demo Certification Authority" cer, In Personal store - Alice, Bob, www.example.net What am I missing? thanks.
    – jonho
    Jan 2, 2013 at 17:42

1 Answer 1

1

I am unclear about client certs. When I am developing the client and the service, do I need to set up SSL, load the certificate into IIS and debug in IIS to test/debug this? Or can I test the end to end call just using WebDev?

In order to use client certificates you must be connecting over SSL (mutual authentication). So, it would mean setting up the web server with a server certificate and then generating a client certificate to be attached to the client request.

IIS and IIS express both support SSL, but the Visual Studio development web server does not.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.