为什么在使用仅公开公钥的证书时TLS握手失败？

Question

TLS Handshake fails when using a certificate that exposes only public key but it works when use another certificate that exposes private key. when we use certificate that exposes only public key, it gives "400 Bad Request No required SSL certificate was sent"

One key difference here is that with 2nd certificate that exposes private, we give permission to Network Service, but as 1st certificate is not exposing private key we're not able to give permission to Network Service. Both of these certificates are properly installed in the store.

Following is sample code:

public string TestCall() { 
    try { 
        string url = "Some URL"; 
        string apiKey = "Key Information"; 
        string secret = "Key Secret"; 
        string payload = "Timestamp";

        HttpWebRequest request = (HttpWebRequest)WebRequest.Create(url);
        request.Method = "POST";
        request.ContentType = "application/json";
        request.SendChunked = false;
        request.AllowAutoRedirect = true;
        request.Date = DateTime.UtcNow;

        var keyStore = new X509Store(StoreName.TrustedPeople, StoreLocation.LocalMachine);
        keyStore.Open(OpenFlags.ReadOnly);

        X509Certificate clientCertificate = keyStore.Certificates.Find(X509FindType.FindByThumbprint, ConfigurationManager.AppSettings["ThumbPrint"], true)[0];
        request.ClientCertificates.Add(clientCertificate);

        var authProvider = new HmacAuthProvider();
        var headers = authProvider.GenerateAuthHeaders(apiKey, secret, payload, url);
        foreach (var header in headers)
        {
            request.Headers.Add(header.Key, header.Value);
        }

        var response = (HttpWebResponse)request.GetResponse();
        var responseString = new StreamReader(response.GetResponseStream()).ReadToEnd();
        return responseString;
    }
    catch (Exception ex)
    {
        return ex.Message + " " + ex.StackTrace.ToString();
    }
}

Any idea what is missing here that certificate without private key is not reaching to the sever.

Answer 1

Certificate-based authentication requires the possession of private key for a corresponding certificate. You cannot use only public certificate (without having a private key) for client authentication, you need the private key because it is used to sign TLS handshake data.