0

I want to use mTLS, so for testing I created simple API. I wanted to check if I will receive the public key of the certificate after the client sends the certificate to me (the server) as I want to use this public key in future encryption. So I created client certificate with OpenSSL and sent it to my API. I got it in JSON format:

{
    "Archived": false,
    "Extensions": [],
    "FriendlyName": "",
    "HasPrivateKey": false,
    "PrivateKey": null,
    "IssuerName": {
        "Name": "E=undefined@undefined.com, CN=ca.localhost, OU=Undefined, O=Undefined, L=Undefined, S=Undefined, C=PL",
        "Oid": {
            "Value": null,
            "FriendlyName": null
        },
        "RawData": "MIGcMQswCQYDVQQGEwJQTDESMBAGA1UECAwJVW5kZWZpbmVkMRIwEAYDVQQHDAlVbmRlZmluZWQxEjAQBgNVBAoMCVVuZGVmaW5lZDESMBAGA1UECwwJVW5kZWZpbmVkMRUwEwYDVQQDDAxjYS5sb2NhbGhvc3QxJjAkBgkqhkiG9w0BCQEWF3VuZGVmaW5lZEB1bmRlZmluZWQuY29t"
    },
    "NotAfter": "2049-12-05T08:46:19+01:00",
    "NotBefore": "2022-07-21T09:46:19+02:00",
    "PublicKey": {
        "EncodedKeyValue": {
            "Oid": {
                "Value": "1.2.840.113549.1.1.1",
                "FriendlyName": "RSA"
            },
            "RawData": "MIICCgKCAgEAtkknr1VNp6vEg0YxDauqCl7r/swaiowelXuL7XRjo4vCqKipHHerwOXU1ZKABI1BYLBa2E1Hw4eO0ESiZ4zaC8/5mtHcd/KYAc8oHaqK0nBsWKGD2qZTz/ufuB0/z+/5Grb1IfqXmBikxiAXNaIQ6HsyJHvSjO5FZFOARotZ1fUNM4ZcO8vSRCgNOY0vxFp/JskkM5U7bgKDrzHz05RWzHoFNu85a6MShGSw+jSVkEQr4R9n1qpJFMV7p40As+VOulj3vnaKDBU7Wx8RRlMucitzAAw5KhZezUmOSCnb0+8Upg7a6wSyoi7xgagSlp/8HjrkvQxhehMgJX0zHlXULM8xPY5+qEymT38661+zQH+0QTxylMMddg606c3rofW28NnQB5h6iG/YzLbQ9hM4OQZybu1cYWNXXwfMfQPWuEU8dvKtCEcvCWiV0cZY7Hx5jY9oozAUJCUPMYvWbwe4xA/pnguAfCbalYxF0pddTHJ1TI4Wmr4tdKomJoYmvtZmWrwJpbqVCICZrXG0xnOe4IlYxniwnAj462FLPxP9NADFUmTdZU5j3rDSBv+BxVIjOb568V5fgBqnumYGfEk98NMOtN9z+uX/fQRqJ1rJ9Es9Y4i7wIpM3dqKptsuFnulnPNDM6j3vrljqMN3s51463VoXwxP66NpXdtfepZqnAMCAwEAAQ=="
        },
        "EncodedParameters": {
            "Oid": {
                "Value": "1.2.840.113549.1.1.1",
                "FriendlyName": "RSA"
            },
            "RawData": "BQA="
        },
        "Key": {
            "Key": {
                "Algorithm": {
                    "Algorithm": "RSA"
                },
                "AlgorithmGroup": {
                    "AlgorithmGroup": "RSA"
                },
                "ExportPolicy": 0,
                "Handle": {
                    "IsInvalid": false,
                    "IsClosed": false
                },
                "IsEphemeral": true,
                "IsMachineKey": false,
                "KeyName": null,
                "KeySize": 4096,
                "KeyUsage": 16777215,
                "ParentWindowHandle": {
                    "value": 0
                },
                "Provider": {
                    "Provider": "Microsoft Software Key Storage Provider"
                },
                "ProviderHandle": {
                    "IsInvalid": false,
                    "IsClosed": false
                },
                "UIPolicy": {
                    "ProtectionLevel": 0,
                    "FriendlyName": null,
                    "Description": null,
                    "UseContext": null,
                    "CreationTitle": null
                },
                "UniqueName": null
            },
            "LegalKeySizes": [
                {
                    "MinSize": 512,
                    "MaxSize": 16384,
                    "SkipSize": 64
                }
            ],
            "KeyExchangeAlgorithm": "RSA",
            "SignatureAlgorithm": "RSA",
            "KeySize": 4096
        },
        "Oid": {
            "Value": "1.2.840.113549.1.1.1",
            "FriendlyName": "RSA"
        }
    },
    "RawData": "MIIEzDCCA7QCFCni83hMyu9WPRErXN/6cbdhc56ZMA0GCSqGSIb3DQEBCwUAMIGcMQswCQYDVQQGEwJQTDESMBAGA1UECAwJVW5kZWZpbmVkMRIwEAYDVQQHDAlVbmRlZmluZWQxEjAQBgNVBAoMCVVuZGVmaW5lZDESMBAGA1UECwwJVW5kZWZpbmVkMRUwEwYDVQQDDAxjYS5sb2NhbGhvc3QxJjAkBgkqhkiG9w0BCQEWF3VuZGVmaW5lZEB1bmRlZmluZWQuY29tMB4XDTIyMDcyMTA3NDYxOVoXDTQ5MTIwNTA3NDYxOVowgacxCzAJBgNVBAYTAlBMMRIwEAYDVQQIDAlVbmRlZmluZWQxEjAQBgNVBAcMCVVuZGVmaW5lZDESMBAGA1UECgwJVW5kZWZpbmVkMRIwEAYDVQQLDAlVbmRlZmluZWQxGTAXBgNVBAMMEGNsaWVudC5sb2NhbGhvc3QxLTArBgkqhkiG9w0BCQEWHmNsaWVudC51bmRlZmluZWRAdW5kZWZpbmVkLmNvbTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALZJJ69VTaerxINGMQ2rqgpe6/7MGoqMHpV7i+10Y6OLwqioqRx3q8Dl1NWSgASNQWCwWthNR8OHjtBEomeM2gvP+ZrR3HfymAHPKB2qitJwbFihg9qmU8/7n7gdP8/v+Rq29SH6l5gYpMYgFzWiEOh7MiR70ozuRWRTgEaLWdX1DTOGXDvL0kQoDTmNL8RafybJJDOVO24Cg68x89OUVsx6BTbvOWujEoRksPo0lZBEK+EfZ9aqSRTFe6eNALPlTrpY9752igwVO1sfEUZTLnIrcwAMOSoWXs1Jjkgp29PvFKYO2usEsqIu8YGoEpaf/B465L0MYXoTICV9Mx5V1CzPMT2OfqhMpk9/Outfs0B/tEE8cpTDHXYOtOnN66H1tvDZ0AeYeohv2My20PYTODkGcm7tXGFjV18HzH0D1rhFPHbyrQhHLwloldHGWOx8eY2PaKMwFCQlDzGL1m8HuMQP6Z4LgHwm2pWMRdKXXUxydUyOFpq+LXSqJiaGJr7WZlq8CaW6lQiAma1xtMZznuCJWMZ4sJwI+OthSz8T/TQAxVJk3WVOY96w0gb/gcVSIzm+evFeX4Aap7pmBnxJPfDTDrTfc/rl/30EaidayfRLPWOIu8CKTN3aiqbbLhZ7pZzzQzOo9765Y6jDd7OdeOt1aF8MT+ujaV3bX3qWapwDAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAFIfdo9tRyPTVpNpJJdgtwmZWRgC04vJh3/UYUzgPHN5GhDI6gb7foIDc70n7wThuVM0vmNKAeMmoC9/Z6qKFyXaOPDWKKle/LL9IwgJtIhQ8P3pd2xdebsdxKzeeYb87G6zLaVcuICpuH8LijXuYB4h9Vl1xDVFRyxp1aE0KSfvrhbsYQfUaVZWR8r2J8OBRIOBaPVa5iDW8TU7F5CN6YEXzAys7kqrOdeQ2nUrbIr8MJTIvz5KsTN8XzzziDj8labgzXSkyr+NeqtWU8MSFXiidHMuUaSn8ensKm3Q9O4IXVpYEnboxbfpcuK4hVrZqVb9xfxEGPg5CIXu4a8Zlps=",
    "SerialNumber": "29E2F3784CCAEF563D112B5CDFFA71B761739E99",
    "SignatureAlgorithm": {
        "Value": "1.2.840.113549.1.1.11",
        "FriendlyName": "sha256RSA"
    },
    "SubjectName": {
        "Name": "E=client.undefined@undefined.com, CN=client.localhost, OU=Undefined, O=Undefined, L=Undefined, S=Undefined, C=PL",
        "Oid": {
            "Value": null,
            "FriendlyName": null
        },
        "RawData": "MIGnMQswCQYDVQQGEwJQTDESMBAGA1UECAwJVW5kZWZpbmVkMRIwEAYDVQQHDAlVbmRlZmluZWQxEjAQBgNVBAoMCVVuZGVmaW5lZDESMBAGA1UECwwJVW5kZWZpbmVkMRkwFwYDVQQDDBBjbGllbnQubG9jYWxob3N0MS0wKwYJKoZIhvcNAQkBFh5jbGllbnQudW5kZWZpbmVkQHVuZGVmaW5lZC5jb20="
    },
    "Thumbprint": "9508CCC6D5ABE0E0C2DBD21BA8EEE69D39A5D398",
    "Version": 1,
    "Handle": {
        "value": 1829014818928
    },
    "Issuer": "E=undefined@undefined.com, CN=ca.localhost, OU=Undefined, O=Undefined, L=Undefined, S=Undefined, C=PL",
    "Subject": "E=client.undefined@undefined.com, CN=client.localhost, OU=Undefined, O=Undefined, L=Undefined, S=Undefined, C=PL"
}

I wonder if "RawData" in "PublicKey" is the public key of this certificate. If not, is it included somewhere in that response? Also, is it a good idea to assign certificates to my clients via a thumbprint? Does refreshing the certificate also mean changing the thumbprint?

3
  • 1
    "I created simple API ... I wonder if "RawData" in "PublicKey" is the public key of this certificate. If not, is it included somewhere in that response?" - since you created the API, so you should be able to tell what the API returns. It is unknown for us to know what exactly your API does. Jul 21 at 10:49
  • 2
    There are two questions here: where is the public key from the certificate, and how do certificate thumbprints work. The second is a valid question though almost certainly one asked and answered on this site already (definitely answered elsewhere). The first isn't even a security question - just a programming one! - and belongs on StackOverflow if anywhere (did you try reading the docs for the API you used to parse the certificate?)
    – CBHacking
    Jul 21 at 10:56
  • Sorry, I rushed this question and at the same time did not check the documentation of the method that gets the certificate from the request. So the short answer: in this case, "RawData" in "PublicKey" is the public key (HttpContext.Connection.GetClientCertificateAsync() method in ASP NET Core) and the answer to the fingerprint question is here: stackoverflow.com/questions/38119765/…
    – Szyszka947
    Jul 21 at 12:00

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.