How to config certificate with httpClientFactory

Question

I am using httpClientFactory to request a Wechat Pay API, but the Wechat Pay API needs a certificate. How can I configure httpClientFactory to use the certificate?

Answer 1

First, you need register you HttpClient:

services.AddHttpClient("signed")
        .ConfigurePrimaryMessageHandler(() =>
        {
            var handler = new HttpClientHandler();
            var certificate = new X509Certificate2(filename: "foo.pfx", password: "123");

            handler.ClientCertificateOptions = ClientCertificateOption.Manual;
            handler.ClientCertificates.Add(certificate);
        });

In the example the file foo.pfx contains a certificate with the password 123. signed is the name of HttpClient.

Second, you'll call IHttpClientFactory.CreateClient to create the HttpClient instance.

public class PayClient
{
    private readonly IHttpClientFactory _httpClientFactory;

    public PayClient(IHttpClientFactory httpClientFactory)
    {
        _httpClientFactory = httpClientFactory;
    }

    public async Task SomePayMethodAsync()
    {
        using (httpClient = _httpClientFactory.CreateClient("signed"))
        {
            // use httpClient
        }
    }
}

You need use same name signed as the parameter of CreateClient.

LATER UPDATE

If you write SAAS with many certificates you may create and configure an HttpClient manually every time you need it. It's the simplest way.

public class PayClient
{
    private readonly ICurrentUserProvider _currentUserProvider;

    public PayClient(ICurrentUserProvider _currentUserProvider)
    {
        _currentUserProvider = currentUserProvider;
    }

    private HttpClient CreateHttpClient()
    {
        var currentUser = _currentUserProvider.CurrentUser;
        var filename = currentUser.CertificateFilename;
        var password = currentUser.CertificatePassword;
        var handler = new HttpClientHandler();
        var certificate = new X509Certificate2(filename, password);

        handler.ClientCertificateOptions = ClientCertificateOptions.Manual;
        handler.ClientCertificates.Add(certificat);

        return new HttpClient(handler);
    }

    public async Task SomePayMethodAsync()
    {
        using (httpClient = CreateHttpClient())
        {
            // use httpClient
        }
    }
}

Answer 2

If you look at the Default factory returned in DI, it inherits from two interfaces, and when injecting you chose to only use one:

internal class DefaultHttpClientFactory : IHttpClientFactory, IHttpMessageHandlerFactory

Knowing this you can take a sneaky workaround:

_handlerFactory = _clientFactory as IHttpMessageHandlerFactory;

Now if you look at the handler factory, it has a method CreateHandler with the same string argument as the CreateClient method. Actually if you look at the implementation of CreateClient, you can see it uses this method which then caches the handler.

So forget about Startup: Cast your client factory to handler factory, create a handler for your specific user, verify all properties on the handler (like is the certificate there or do you need to add it since it's a new instance) and then call CreateClient as usual.

Edit: In startup you may still need to add ConfigurePrimaryHttpMessageHandler to actually create a HttpClientHandler, so you may have to make a consession of only registering one named HttpClient and just swapping the certificate. It still gives you the advantages of having the factory though.

Edit 2: know that the handler is wrapped a bunch of times in decorators, so you need to dig deep. The trick I use is:

var handler = _handlerFactory.CreateHandler("customer");
while (handler as DelegatingHandler != null)
{
   handler = (handler as DelegatingHandler).InnerHandler;
}
var clientHandler = handler as HttpClientHandler;

Answer 3

https://learn.microsoft.com/en-us/aspnet/core/fundamentals/http-requests?view=aspnetcore-3.1

services.AddHttpClient("configured-disable-automatic-cookies")
    .ConfigurePrimaryHttpMessageHandler(() =>
    {
        return new SocketsHttpHandler()
        {
            UseCookies = false,
        };
    });