Mutual authentication (WCF client connecting to SOAP service) fails with one client cert but works with another (but both trusted on server side)

Laurence

12/26/22, 7:31 PM

Setup: a .NET (4.6) client application connects to a remote SOAP service over HTTPS. The remote service can be configured to require a a client certificate or not.

What I am looking as an answer is any possible explanation of why scenario #2 fails ... the following 3 scenarios were all tested using exactly the same code base, only changing the certificates involved and whether or not a client certificate was required by the service.

Scenario #1 - no client certificate required

client connects OK

Scenario #2 - client certificate required, certificate A used

certificate A is installed in Windows on client side (local computer store)
certificate is valid, 2048 bits, non-wildcard, used successfully for server authentication in another unrelated service, issued by GoDaddy Secure Certificate Authority - G2
certificate is shared with the remote party who seem to know what they are doing
when client attempts request, handshake fails. On the client side the .NET exception is "The request was aborted: Could not create SSL/TLS secure channel.". On the server side the error is "client failed to present a certificate".

Scenario #3 - client certificate required, certificate B used

everything is exactly the same as #2 except a different client certificate is used (B)
certificate is valid, 2048 bits, wildcard, used successfully for server authentication in another unrelated service, issued by GeoTrust RSA CA 2018
client connects OK

What we can see from logs is that in both scenario #2 and #3, the client and server negotiate to use TLS 1.2.

After running the above multiple times, checking everything, my only conclusion is that certificate A is somehow not compatible with the setup - either the .NET client decides not to present it, or the service cannot accept it. But what could possibly be different/missing?

133

0 + 7

wcf

ssl-certificate

Laurence

12/27/22, 7:05 AM

Right, but what would make a certificate incompatible or unrecognized, when the same certificate works successfully for server authentication in another unrelated service?

Laurence

12/31/22, 8:14 AM

I guess #1 and #2 could apply here - I'll check. The cert has not expired, so not #3. As per the post, the error occurs during the handshake between the WCF client and the SOAP service, so there are no web pages involved here.

Steeeve

12/31/22, 4:51 PM

Just a guess: have you checked that the client's user account has read access to the private key of certificate A?

Laurence

12/31/22, 5:09 PM

Thanks @Steeeve but the read permissions on cert A and B private keys are identical, and they are in the same Windows store folder.

Greg Askew

1/4/23, 9:46 PM

A packet capture on the client can confirm if a certificate is presented. Also enabled and check the Windows CAPI event log.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Mutual authentication (WCF client connecting to SOAP service) fails with one client cert but works with another (but both trusted on server side)

TH: การรับรองความถูกต้องร่วมกัน (ไคลเอนต์ WCF ที่เชื่อมต่อกับบริการ SOAP) ล้มเหลวด้วยใบรับรองไคลเอนต์หนึ่ง แต่ใช้งานได้กับอีกอันหนึ่ง (แต่ทั้งสองเชื่อถือได้ในฝั่งเซิร์ฟเวอร์)

RO: Autentificarea reciprocă (clientul WCF care se conectează la serviciul SOAP) eșuează cu un certificat de client, dar funcționează cu altul (dar ambele sunt de încredere pe partea serverului)

RU: Взаимная проверка подлинности (клиент WCF, подключающийся к службе SOAP) не работает с одним сертификатом клиента, но работает с другим (но оба доверены на стороне сервера)

VI: Xác thực lẫn nhau (ứng dụng khách WCF kết nối với dịch vụ SOAP) không thành công với một chứng chỉ ứng dụng khách nhưng hoạt động với chứng chỉ khác (nhưng cả hai đều đáng tin cậy ở phía máy chủ)

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.