4

In MVC application I need to verify that the client certificate was signed/issued by a specific CA.

I know how to get Request.ClientCertificate and X509Certificate2 from that, but I can't figure out how to check the issuer.
Request.ClientCertificate.Issuer gives the subject of Issuer, but I don't think that is secure enough.

I would prefer to be able to check issuer thumbprint, so how do I retrieve it from client certificate?

Jérémie Bertrand
  • 3,025
  • 3
  • 44
  • 53
Jabolcna Pita
  • 73
  • 1
  • 4

1 Answers1

3
// get the X509 from HTTP client certificate
var x509 = new X509Certificate2(this.Request.ClientCertificate.Certificate);

// create the certificate chain by using the machine store
var chain = new X509Chain(true);
chain.ChainPolicy.RevocationMode = X509RevocationMode.Offline;
chain.Build(x509);

// at this point chain.ChainElements[0] will contain the original
// certificate, the higher indexes are the issuers.
// note that if the certificate is self-signed, there will be just one entry.
var issuer = chain.ChainElements[1].Certificate.Thumbprint;
Knaģis
  • 20,827
  • 7
  • 66
  • 80