Using System.Net.WebClient with HTTPS certificate

Question

In my C# Windows client, I have a POST submission to "the mothership". I want the data in the submits to be secured, of course, so I paid for HostGator to issue me an SSL certificate.

I saved off the .CER file, and I'm constructing the request as such:

//wrapper for WebClient object to use certificate file
class SecureWebClient : WebClient
{
    protected override WebRequest GetWebRequest(Uri address)
    {
        HttpWebRequest request = (HttpWebRequest)base.GetWebRequest(address);
        string certPath = @"e:\mycertificate.cer";
        X509Certificate myCert = X509Certificate.CreateFromCertFile(certPath);
        request.ClientCertificates.Add(myCert);
        return request;
    }
}

//request
private static SecureWebClient client = new SecureWebClient();
private static NameValueCollection = new NameValueCollection();
nvc.Add(POST_ACTION, ACTION_CODE_LOGIN);
nvc.Add(POST_EMAIL, email);
nvc.Add(POST_PASSWORD, password);

sResponse = System.Text.Encoding.ASCII.GetString(client.UploadValues(BASE_URL + ACTION_PAGE, nvc));

Its throwing a System.Net.WebException:

The underlying connection was closed: An unexpected error occurred on a send.

The InnerException is a System.IO.IOException:

The handshake failed due to an unexpected packet format.

Any insight on what I am doing wrong?

Answer 1

Client certificates will work only if the private key is available. This is not generally the case when using .cer files since the X.509 certificate does not include the private key.

The only safe way to ensure the private key is available is to load the certificate from a PKCS#12 file where both the certificate(s) and the private key are available (i.e. both were exported into the .pfx file).

Notes:

• I said generally because Windows/CryptoAPI sometimes does some magic (when used with X509Certificate) and automatically associate a certificate with a private key from the certificate.key stores.

• I said safe because that will work on Mono too, not just MS .NET.

Answer 2

Sounds like you are doing it backwards. You should have the SLL Certificate installed on the web host/server. Then you create a web request to web server and requires the HTTPS protocol.