Adding a Client Certificate to .NET Core HttpClient for Two-Way SSL Authentication

Introduction:

.NET Core and building APIs that utilize payment APIs, I came across a scenario where I needed to add a client certificate to the request for two-way SSL authentication. I discovered that Http Client Handler doesn’t provide a straightforward option for adding client certificates in .NET Core. In this blog post, I will share the solution I found to achieve this using Http Client in .NET Core.

Understanding Two-Way SSL Authentication

Before diving into the implementation details, let’s quickly go over what two-way SSL authentication entails. Two-way SSL, also known as mutual authentication, involves both the server and the client presenting their certificates to each other for verification. This ensures a secure and authenticated connection between the two parties.

Creating the Client Certificate

To proceed, we need to create a client certificate that will be used for authentication. This certificate will be included in the HTTP request sent from our .NET Core application. Follow these steps to generate the client certificate:

1. Generate a certificate signing request (CSR) using a tool like OpenSSL.
2. Submit the CSR to a certificate authority (CA) and obtain a client certificate.
3. Export the client certificate as a .pfx file, including the private key.

Configuring HTTP Client for Client Certificate Authentication

Now that we have the client certificate, we can configure HTTP Client to use it for two-way SSL authentication. Here’s how you can achieve this in .NET Core:

1. Import the necessary namespaces:

code


using System.Net.Http;
using System.Security.Authentication;
using System.Security.Cryptography.X509Certificates;

2. Create an instance of HttpClientHandler and set the required options:

code



var handler = new HttpClientHandler();
handler.ClientCertificateOptions = ClientCertificateOption.Manual;
handler.SslProtocols = SslProtocols.Tls12;
handler.ClientCertificates.Add(new X509Certificate2("path/to/clientCertificate.pfx", "certificatePassword"));

Note: Replace “path/to/clientCertificate.pfx” with the actual path to your client certificate file, and “certificatePassword” with the password for the certificate.

3. Create an instance of HttpClient with the configured handler:

csharpCopy code
var client = new HttpClient(handler);

Section 4: Making Requests with HttpClient With HttpClient configured to use the client certificate, you can now make requests to the server. Here’s an example of sending a GET request:

code








var response = await client.GetAsync("https://api.example.com");
if (response.IsSuccessStatusCode)
{
    // Handle the successful response
}
else
{
    // Handle the error response
}

Conclusion

Explored how to add a client certificate to .NET Core Http Client for two-way SSL authentication. By following the steps outlined, you can securely authenticate your .NET Core application with servers that require client certificates. Remember to generate a client certificate, configure Http Client Handler, and make requests using HttpClient.

I hope this guide helps you overcome the challenges of adding client certificates in .NET Core Http Client. If you have any questions or face any issues, feel free to leave a comment below.