How to diagnose No Certificate alert

Question

I have written an application (in C#) to communicate with one of our customers via a web service. Our customer requires us to use bi-directional SSL. The customer has sent us their certificate (in the form of a .p7b file). The client certificate was provided to me in the form of a .cer file.

I've installed the certificates and in the program I use the HttpWebRequest class and add the client certificate to the ClientCertificates collection.

When I run the program I get an exception:

System.Net.WebException: The request was aborted: Could not create SSL/TLS secure channel.

I have used WireShark to try to diagnose the error and I see this (IP Addresses redacted):

1615    12.259771000    CLIENT_IP   SERVER_IP   SSLv3   112 Client Hello
1629    12.429299000    SERVER_IP   CLIENT_IP   SSLv3   1488    Server Hello, Certificate, Certificate Request, Server Hello Done
1630    12.445672000    CLIENT_IP   SERVER_IP   SSLv3   397 Alert (Level: Warning, Description: No Certificate), Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message
1645    12.666191000    SERVER_IP   CLIENT_IP   SSLv3   61  Alert (Level: Fatal, Description: Handshake Failure)

It seems the server has sent their certificate, but for some reason, my app is not sending one back, so it sends the No Certificate alert. However, in my code, it seems to find the certificate and it is added to the ClientCertificate collection of the HttpWebRequest class. Since I fairly new to SSL, I am not sure where the problem lies? It could be a programming mistake, but using some test certficates seemed to work. Does the alert indicate that there is a problem with the client certificate? Some posts that I have read seem to indicate that although the private key is not sent to the server, it is still needed on the client side. But after loading the certificate (using the .Net X509Certificate2 class), I notice that the PrivateKey property is null. Could this be the source of the problem? The .cer file was provided to me by someone else in the company.

Any assistance or suggestions would be helpful. I have refrained from posting code as I'm not sure it's welcome here, but I can post some if need be.

Answer 1

Well no, that won't work for you. The point of a client cert isn't really the cert part, but the private key tied to the client cert. If you don't have the private key you can't do anything useful. What would happen is that the request you send is encrypted with the servers public key and decrypted with their private key. Conversely, any response the server sends is encrypted with your public key (the cert). To decrypt the response you need a private key.

What you need from the other people is the PFX file. In actual fact, you should generate the keys locally, and send THEM the client cert. Just the cert though, not the private key.