4

I've written a small console application to make a HTTP call to a server using a client certificate. The code I've written reads the .cer file from the specificed location to make the request:

  X509Certificate Cert = X509Certificate.CreateFromCertFile("JohnDoe.cer");            
  HttpWebRequest Request = (HttpWebRequest)
  WebRequest.Create("https://10.135.12.166:4434");
  Request.ClientCertificates.Add(Cert);
  Request.UserAgent = "Client Cert Sample";
  Request.Method = "GET";
  HttpWebResponse Response = (HttpWebResponse) Request.GetResponse();

However, this code doesn't work unless you have the certificate installed in the personal folder of the current user inside the certificate manager. More specifically, it only works when I have the .pfx certificate installed, not the .cer

As per my understanding, the client cert is only used for authentication and not encryption, right? So,

  1. Why do we need a certificate to be installed? Why can't my program just pick the .cer file up from the location and send it with the request? And,

  2. Again, more specifically, why do we need the .pfx certificate installed? Why doesn't .cer do the job?

GrowinMan
  • 4,891
  • 12
  • 41
  • 58

1 Answers1

1

The .cer file contains the certificate. The certificate contains the public key. Identification with certificates involves a cryptographic operation to show, that you are in the possession of the secret private key matching the public key in the (public) certificate. This private key is contained in the .pfx file.

Steffen Ullrich
  • 114,247
  • 10
  • 131
  • 172
  • "involves a cryptographic operation to show" any chance you could elaborate a little on that? I was of the opinion that identification involves matching the .cer that the server obtains with one of the .cer's that it has with it. – GrowinMan Aug 12 '14 at 16:44
  • The secret private key is used to create a digital signature over data of the SSL handshake, which can then verified by the server using the public key contained in the certificate. See also http://security.stackexchange.com/questions/24577/client-certificate-in-ssl-handshake-insecure – Steffen Ullrich Aug 12 '14 at 18:33