|
| 1 | + |
| 2 | +Setting up mTLS with a client certificate is a bit more involved than just using a server certificate. In this lab, we'll create a client certificate and use it to authenticate the client to the server, and vice versa. |
| 3 | + |
| 4 | +## 1. Create a pfx file |
| 5 | + |
| 6 | +Go back to the CA you created earlier. Generate another certificate: |
| 7 | + |
| 8 | +```powershell |
| 9 | +step certificate create api1.localhost app.crt app.key ` |
| 10 | + --profile leaf --not-after=48h ` |
| 11 | + --ca ./certs/intermediate_ca.crt ` |
| 12 | + --ca-key ./secrets/intermediate_ca_key |
| 13 | +``` |
| 14 | + |
| 15 | +```powershell |
| 16 | +step certificate p12 app.pfx api1.crt app.key ` |
| 17 | + --ca ~/.step/certs/intermediate_ca.crt ` |
| 18 | + --ca ~/.step/certs/root_ca.crt |
| 19 | +``` |
| 20 | + |
| 21 | +### 2. Create a client application |
| 22 | + |
| 23 | +Create a new dotnet console application: |
| 24 | +``` |
| 25 | +dotnet new console --name client |
| 26 | +``` |
| 27 | + |
| 28 | +We'll use user secrets to store the password for the certificate. |
| 29 | + |
| 30 | +Change into the folder where the server project is: `cd server` |
| 31 | + |
| 32 | +First, initialize user secrets for the project: |
| 33 | +```powershell |
| 34 | +dotnet user-secrets init |
| 35 | +``` |
| 36 | +Then store the password for the certificate: |
| 37 | +```powershell |
| 38 | +dotnet user-secrets set Certificates:Password TopSecret |
| 39 | +``` |
| 40 | +Make sure you replace `TopSecret` with the password for your .pfx file. |
| 41 | + |
| 42 | +### 3. Load the certificate |
| 43 | + |
| 44 | +This is a simple console application so we need to setup the configuration to get the password from user secrets. |
| 45 | + |
| 46 | +Add the following packages to the project: |
| 47 | +``` |
| 48 | +Microsoft.Extensions.Configuration |
| 49 | +Microsoft.Extensions.Configuration.Binder |
| 50 | +Microsoft.Extensions.Configuration.EnvironmentVariables |
| 51 | +Microsoft.Extensions.Configuration.Json |
| 52 | +Microsoft.Extensions.Configuration.UserSecrets |
| 53 | +``` |
| 54 | + |
| 55 | +Then add the following code to the `Program.cs` file: |
| 56 | + |
| 57 | +```csharp |
| 58 | +using System.Net.Security; |
| 59 | +using System.Security.Cryptography.X509Certificates; |
| 60 | +using Microsoft.Extensions.Configuration; |
| 61 | + |
| 62 | +var configuration = new ConfigurationBuilder() |
| 63 | + .SetBasePath(Directory.GetCurrentDirectory()) |
| 64 | + .AddJsonFile("appsettings.json", optional: true, reloadOnChange: true) |
| 65 | + .AddEnvironmentVariables() |
| 66 | + .AddUserSecrets<Program>() |
| 67 | + .Build(); |
| 68 | + |
| 69 | +// configure the client to use the certificate in ../api2.pfx |
| 70 | +var certificateCollection = X509CertificateLoader.LoadPkcs12CollectionFromFile("path_to/app.pfx", |
| 71 | + configuration.GetValue<string>("Certificates:Password") ?? throw new InvalidOperationException("Setting Certificates:Password not found in configuration")); |
| 72 | +``` |
| 73 | + |
| 74 | +👉️ Make sure you update the path to the certificate |
| 75 | + |
| 76 | +Now let's call the server. |
| 77 | + |
| 78 | +```csharp |
| 79 | +// Create an HTTP client with the certificate |
| 80 | +var client = new HttpClient(new HttpClientHandler |
| 81 | +{ |
| 82 | + ClientCertificateOptions = ClientCertificateOption.Manual, |
| 83 | + ClientCertificates = { clientCertificate }, |
| 84 | +}) |
| 85 | +{ |
| 86 | + BaseAddress = new Uri("https://api1.localhost:7033") |
| 87 | +}; |
| 88 | + |
| 89 | +// Call the server |
| 90 | +var forecast= await client.GetAsync("/weatherforecast"); |
| 91 | + |
| 92 | +var content = await forecast.Content.ReadAsStringAsync(); |
| 93 | + |
| 94 | +// Print the result |
| 95 | +Console.WriteLine(content); |
| 96 | +``` |
| 97 | + |
| 98 | +Now, run the client application and see if you get a response from the server. |
| 99 | + |
| 100 | +🔍️ This fails. The server accepted the client certificate, but the client is not accepting the server certificate. Why is that? |
| 101 | + |
| 102 | +## 4. Accept the server certificate |
| 103 | + |
| 104 | +To accept the server certificate, we could install the root certificate in the trusted root store. However, that is not a workable solution in a production environment where certificates may be rotated frequently. |
| 105 | +Instead, we can use a custom certificate validation callback to accept the server certificate. |
| 106 | + |
| 107 | +Add the following code to the `Program.cs` file to get the root and intermediate certificates: |
| 108 | + |
| 109 | +```csharp |
| 110 | +var intermediateCaCertificate = certificateCollection.FirstOrDefault(c => c.Subject.Contains("Intermediate")) |
| 111 | + ?? throw new InvalidOperationException("Intermediate cert not found"); |
| 112 | +var rootCaCertificate = certificateCollection.FirstOrDefault(c => c.Subject.Contains("Root")) |
| 113 | + ?? throw new InvalidOperationException("Root cert not found"); |
| 114 | +``` |
| 115 | + |
| 116 | +Then add a `ServerCertificateCustomValidationCallback` to the `HttpClientHandler` to accept the server certificate: |
| 117 | + |
| 118 | +```csharp |
| 119 | + ServerCertificateCustomValidationCallback = (message, cert, chain, errors) => |
| 120 | + { |
| 121 | + if (errors == SslPolicyErrors.None) |
| 122 | + { |
| 123 | + // Basic validation passed, the server used a valid, trusted certificate |
| 124 | + return true; |
| 125 | + }; |
| 126 | + |
| 127 | + bool validateLocalChain = (errors == SslPolicyErrors.RemoteCertificateChainErrors |
| 128 | + && chain!.ChainStatus.Length == 1 |
| 129 | + && chain.ChainStatus[0].Status == X509ChainStatusFlags.PartialChain); |
| 130 | + |
| 131 | + if (!validateLocalChain) |
| 132 | + { |
| 133 | + return false; |
| 134 | + } |
| 135 | + |
| 136 | + var customChain = new X509Chain(); |
| 137 | + // Can't do a revocation check, our CA is not online |
| 138 | + customChain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck; |
| 139 | + // Our CA is not in the trusted root store |
| 140 | + customChain.ChainPolicy.VerificationFlags = X509VerificationFlags.AllowUnknownCertificateAuthority; |
| 141 | + |
| 142 | + // Add the intermediate and root CA to the chain policy |
| 143 | + customChain.ChainPolicy.ExtraStore.Add(intermediateCaCertificate); |
| 144 | + customChain.ChainPolicy.ExtraStore.Add(rootCaCertificate); |
| 145 | + |
| 146 | + // Validate the server certificate |
| 147 | + bool isValid = customChain.Build(cert!); |
| 148 | + |
| 149 | + return isValid; |
| 150 | + } |
| 151 | +``` |
| 152 | + |
| 153 | +🔍️ Take a moment to understand what this code does. |
0 commit comments