1. X.509 Certificate Management in.NET

2. A public key certificate (certs) is digitally signed document that is commonly used for authentication and secure exchange of information on open networks. A certificate securely binds a public key to the entity that holds the corresponding private key. Certificates are digitally signed by the issuing certification authority (CA). They create a trust relationship between two unknown entities. What is X.509 Certificate?

3. Formats for X.509 Certificate Note: The most widely accepted format for certificates is defined by the ITU-T X.509 version 3 international standards. The certificates are encoded using OSI ASN.1 DER. FormatExtension DER Encoded Binary X.509cer Base64 Encoded X.509cer PKCS#7 / Cryptographic Message Syntax Standard p7b PKCS#12 / Personal Information Exchange pfx

4. Primary Fields in X.509 certificate FieldMeaning VersionWhich version of X.509 Serial numberThis number plus the CA’s name uniquely identifies the certificate Signature algorithmThe algorithm used to sign certificate IssuerX.500 name of CA Validity PeriodThe starting and ending period Subject nameThe entity whose key being certified Public KeyThe subject’s pubic key and ID of algorithm using it

5. .NET Certificate Management Tools ApplicationUsage MakecertGenerate a X.509 certificate CertmgrAssembles certificates into CTL (certificate trust list) and can also be used for revoking lists (CRLs) ChktrustVerifies the validity of a file signed with an X.509 certificate Cert2spcCreates a Software Publisher's Certificate (SPC) from one or more X.509 certificates pvk2pfxConvert the certificate.cer and.pvk to.pfx WseCertificate2X.509 Certificate tool to displays details about X.509 certificates.

6. Using X.509 Certificates in.NET application 1.Create and manage X.509 Certificate 2.Sign a SOAP Message Using an X.509 Certificate 3.Verify Digital Signatures of SOAP Messages Signed by an X.509 Certificate

7. STEP I Create and manage X.509 Certificate

8. Obtain X.509 Certificate  Purchase a certificate from a certificate authority, such as VeriSign, Inc  Set up our own certificate service and have a certificate authority sign the certificates  Set up our own certificate service and do not have the certificates signed Note: Whichever approach we take, the recipient of the SOAP request containing the X.509 certificate must trust the X.509 certificate.

9. Creating and configuring X.509 Certificate  Create certificate using makecert.exe cmd>makecert -n "CN=TempCA" -r -sv TempCA.pvk TempCA.cer  Import the created certificate using MMC in to the certificate store Import the certificate TempCA.cer using MMC in to "Trusted Root Certificate Authorities" folder  Export the created certificate to outside world by creating and distributing pfx file using pvk2pfx tool cmd>pvk2pfx -pvk TempCA.pvk -spc TempCA.cer  Define access permission for X.509 certificate cmd>winhttpcertcfg -g -c LOCAL_MACHINE\MY -s TempCA -a ASPNET

10. Make certificates accessible to application  Specify the certificate store that application uses to obtain X.509 certificates  Specify the account under which application is running read access to the file containing the private key associated with the X.509 certificate.

11. Default accessibility for certificates X.509 certificate usePrivate key Digitally signing an outbound SOAPYes Verifying the signature of an inbound SOAPNo Encrypting an outbound SOAP messageNo Decrypting an inbound SOAP messageYes X.509 certificate useClient ApplicationWeb service (.ASMX) Signing or encrypting an outgoing SOAP message. Local Computer's Personal Store Verifying the signature of an incoming SOAP message SOAP message Decrypting an inbound SOAP message Local Computer's Personal Store Default Locations of certificate store: Usage of private key:

12. STEP II Sign a SOAP Message Using an X.509 Certificate

13. Config file settings for using X.509 certificates <policies …

14. Config file settings for using X.509 certificates continued… <wsp:Policy wsu:Id="policy-c0a22319-6b89-49ff-9b82-bdbac5f04618" xmlns:wsp="http://schemas.xmlsoap.org/ws/2002/12/policy" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/03/addressing" > http://schemas.xmlsoap.org/ws/2003/12/kerberos/Kerberosv5ST COHOWINERY host/computer1@cohowinery.com wsp:Body() wsp:Header(wsa:To) wsp:Header(wsa:Action) wsp:Header(wsa:MessageID) wsp:Header(wsa:From)

15. Retrieve certificate from store public X509SecurityToken GetSecurityToken() { X509SecurityToken securityToken = null; X509CertificateStore store = X509CertificateStore.CurrentUserStore( X509CertificateStore.MyStore); bool open = store.OpenRead(); try { byte[] certHash = {0x98, 0xec, 0x08, 0x4b, 0xa5, 0x7a, 0x6c, 0x2f, 0x39, 0x26, 0xb3, 0x0a, 0x58, 0xbf, 0x65, 0x25, 0x61, 0xc5, 0x64, 0x59}; X509CertificateCollection certs = store.FindCertificateByHash(certHash); Microsoft.Web.Services2.Security.X509.X509Certificate cert = ((Microsoft.Web.Services2.Security.X509.X509Certificate) certs[0]); if (cert == null) … else if (!cert.SupportsDigitalSignature || (cert.Key == null)) … else { securityToken = new X509SecurityToken(cert); } finally { if (store != null) store.Close(); } return securityToken; }

16. Code for signing SOAP messages  Call GetSecurityToken() to retrieve certificate X509SecurityToken signatureToken = GetSecurityToken();  Get the SoapContext method for the SOAP request made to the Web service. Service1 svc = new Service1(); SoapContext requestContext = svc.RequestSoapContext;  Add the client's X.509 certificate to the SOAP header. requestContext.Security.Tokens.Add(signatureToken);  Create a new instance of the MessageSignature class by using the X.509 certificate just added to the SOAP header. MessageSignature sig = new MessageSignature(signatureToken);  Add the digital signature to the SOAP header. RequestContext.Security.Elements.Add(sig);  Specify the TTL for the SOAP message requestContext.Security.Timestamp.TtlInSeconds = 60;  Call the Web service. svc.sayHello();

17. STEP III Verify Digital Signatures of SOAP Messages Signed by an X.509 Certificate

18. Configure application to validate digital signatures for incoming SOAP messages <add type="Microsoft.Web.Services2.WebServicesExtension, Microsoft.Web.Services2,Version=2.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" priority="1" group="0"/> Export and Import the CA certificate chain Add a reference to the Microsoft.Web.Services2 assembly When the SOAP message recipient is a Web service client, this configuration entry is not required. Else configure web.config as below:

19. Code to verify if SOAP Body is signed public string CheckSOAPBody() { SoapContext requestContext = RequestSoapContext.Current; // Verify that a SOAP request was received. if (requestContext == null) { throw new ApplicationException("Either a non-SOAP " + "request was received or WSE is not properly " + "installed for the Web application hosting the " + "Web service."); } // Check if the Soap Message is Signed. if (!IsMessageSigned(requestContext)) { throw new ApplicationException("The request is not signed."); } return "sucess"; }

20. Code to verify digital signature of SOAP request private bool IsMessageSigned(SoapContext context) { foreach (ISecurityElement element in context.Security.Elements) { if (element is MessageSignature) { // The given context contains a Signature element. MessageSignature sig = element as MessageSignature; if ((sig.SignatureOptions & SignatureOptions.IncludeSoapBody) != 0) { // The SOAP Body is signed. return true; } return false; }

21. References http://msdn.microsoft.com/en- us/library/system.security.cryptography.x509certificates.x509certificate(VS.71).aspx http://msdn.microsoft.com/en-us/library/ms820022.aspx http://www.kerrywong.com/2006/12/01/using-x509-certificate-with-web-service-in- aspnet/ http://support.microsoft.com/kb/315588 http://msdn.microsoft.com/en-us/library/ms819944.aspx http://www.csharphelp.com/archives/archive189.html http://www.codeproject.com/KB/cpp/X509Certificate.aspx http://www.codeproject.com/KB/WCF/Senthil.aspx

22. Thank You