3

I am attempting to use the .Net System.Security.SslStream class to process the server side of a SSL/TLS stream with client authentication.

To perform the handshake, I am using this code:

SslStream sslStream = new SslStream(innerStream, false, RemoteCertificateValidation, LocalCertificateSelectionCallback);
sslStream.AuthenticateAsServer(serverCertificate, true, SslProtocols.Default, false);

Unfortunately, this results in the SslStream transmitting a CertificateRequest containing the subjectnames of all certificates in my CryptoAPI Trusted Root Store.

I would like to be able to override this. It is not an option for me to require the user to install or remove certificates from the Trusted Root Store.

It looks like the SslStream uses SSPI/SecureChannel underneath, so if anyone knows how to do the equivalent with that API, that would be helpful, too.

Any ideas?

3 Answers 3

3

It does not look like this is currently possible using the .NET libraries.

I solved it by using the Mono class library implementation of System.Security.SslStream, which gives better access to overriding the servers behavior during the handshake.

2
  • Do you have any more info on how to actually use the Mono implementation from an otherwise regular-framework app?
    – Miral
    Jan 7, 2020 at 5:01
  • @Miral This was a long time ago, but taking a quick look at the Mono libraries, I think I would take a dependency on Mono.Net.Security and use the MonoTlsStream. The setting to override is MonoTlsSettings.ClientCertificateIssuers. Jan 7, 2020 at 7:56
2

What the certificate validation is doing is validating all certificates in the chain. In order to truely do that it just contact the root store of each of those cerficates.

If that's not something you want to happen you can deploy your own root store locally.

0
1

It is not the validation part I want to change. The problem is in the initial handshake, the server transmits the message informing the client that client authentication is required (that is the CertificateRequest message). As part of this message, the server sends the names of CAs that it will accept as issuers of the client certificate. It is that list which per default contains all the Trusted Roots in the store.

But if is possible to override the certificate root store for a single application, that would probably fix the problem. Is that what you mean? And if so, how do I do that?

2
  • Rasmus, I am trying to solve the same problem. Did you find any particular solution?
    – cdpnet
    Jun 17, 2013 at 5:58
  • @cdpnet, I solved it by using the Mono implementation of SslStream. Jun 17, 2013 at 6:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.