Using two client certificates for a SSL Webservice

[b.fokke]

I'd like to connect to a webservice using TLS/SSL. I have two separate
client certificates:
1. A certificate for digital verification
2. A certificate for encryption.

When I use the first one (i.e. add it to the ClientCertificates
collection of the web request), I can establish a connection but I get
a WebException: "Underlying connection closed: Could not establish
trust relationship". When I use the second one I can't even establish a
connection.

When I add both certificates to the ClientCertificates collection, it
seems only the first one I added is used and from what I found, I'd
think the certificate is used to set up the connection. So how do I
specify to use an alternate certificate for encryption?

You'd think that .NET should be able to find it out automatically by
looking at the certificate usage flags but it doesn't.

Any help would be greatly appreciated!

[Pablo Cibraro [MVP]]

Hi,

This article may help you to solve the problem, it mainly discusses
different approaches to secure a web service using X509 certificates.

http://msdn.microsoft.com/library/de...tpsecurity.asp

Regards,
Pablo Cibraro.
<b.*****@gmail.comwrote in message
news:11**********************@14g2000cws.googlegro ups.com...

I'd like to connect to a webservice using TLS/SSL. I have two separate
client certificates:
1. A certificate for digital verification
2. A certificate for encryption.

When I use the first one (i.e. add it to the ClientCertificates
collection of the web request), I can establish a connection but I get
a WebException: "Underlying connection closed: Could not establish
trust relationship". When I use the second one I can't even establish a
connection.

When I add both certificates to the ClientCertificates collection, it
seems only the first one I added is used and from what I found, I'd
think the certificate is used to set up the connection. So how do I
specify to use an alternate certificate for encryption?

You'd think that .NET should be able to find it out automatically by
looking at the certificate usage flags but it doesn't.

Any help would be greatly appreciated!

[b.fokke]

Hello Pablo,

The article describes how to secure a webservice. However, the
webservice is already working. The problem I have is that I need two
separate certificates for SSL: One for authentication and one for
encryption. Although I can supply more than one certificate using the
ClientCertificates.Add() method, it seems that only the first one is
used.

Cheers,
Bram

Hi,

This article may help you to solve the problem, it mainly discusses
different approaches to secure a web service using X509 certificates.

http://msdn.microsoft.com/library/de...tpsecurity.asp

Regards,
Pablo Cibraro.
<b.*****@gmail.comwrote in message
news:11**********************@14g2000cws.googlegro ups.com...

I'd like to connect to a webservice using TLS/SSL. I have two separate
client certificates:
1. A certificate for digital verification
2. A certificate for encryption.

When I use the first one (i.e. add it to the ClientCertificates
collection of the web request), I can establish a connection but I get
a WebException: "Underlying connection closed: Could not establish
trust relationship". When I use the second one I can't even establish a
connection.

When I add both certificates to the ClientCertificates collection, it
seems only the first one I added is used and from what I found, I'd
think the certificate is used to set up the connection. So how do I
specify to use an alternate certificate for encryption?

You'd think that .NET should be able to find it out automatically by
looking at the certificate usage flags but it doesn't.

Any help would be greatly appreciated!