Certificate Authentication and Message Security without private key in the certificate

Question

I have a problem with the certificates in WCF (client).

I have received three certificates:

• SSL certificate of the remote server
• client certificate (for the user authentication)
• root certificate

Note: no certificate has a private key

---

In WCF there is the possibility to use the certificate authentication. Here is my sample:

var sslBinding = new BasicHttpBinding(BasicHttpSecurityMode.TransportWithMessageCredential);
sslBinding.Security.Message.ClientCredentialType = BasicHttpMessageCredentialType.Certificate;
sslBinding.MessageEncoding = WSMessageEncoding.Mtom;

var certificate= new X509Certificate2(_certificatesFullPath, _certificatePassword, X509KeyStorageFlags.MachineKeySet);
var userCertificate = new X509Certificate2(_userCertificate, "", X509KeyStorageFlags.MachineKeySet);

var identity = new X509CertificateEndpointIdentity(userCertificate);
var endPoint = new EndpointAddress(new Uri(_endPointURI), identity);

using (Test.SdIRiceviNotificaClient client = new Test.SdIRiceviNotificaClient( sslBinding, endPoint))
{
        client.ClientCredentials.ClientCertificate.Certificate = certificate;


        client.Open();

        var result = await client.NotificaEsitoAsync(new Test.NotificaEsitoRequest(idSdI.ToString(), fileName, XmlUtils.GetXmlBytes(new NotificaEsitoCommittente())));

        client.Close();
}

My problem is now that I receive this exception:

The private key is not present in the X.509 certificate.

I know that no certificate has a private key and I can not ask for other certificates.

---

The only info that I have: all certificates should be used in a p12 container.
I have just the problem to create a p12 file (without a private key => ok there is the possibility with the "-nokeys" argument).

I have done this:

openssl x509 -in CAEntratetest.cer -outform PEM -out CAEntratetest.pem
openssl x509 -in SDI-xxxxxxxxxxx.cer -inform DER -out SDI-xxxxxxxxxxx.pem -outform PEM
openssl x509 -in testservizi.fatturapa.it.cer -inform DER -out testservizi.fatturapa.it.pem -outform PEM

cat CAEntratetest.pem SDI-xxxxxxxxxxx.pem testservizi.fatturapa.it.pem > sum.pem

To create a p12 file I need a private key:

openssl pkcs12 -export -in sum.pem -inkey private.key -out output.p12

If I create a new key => it doesn't work (no certificate matches private key)

Is it possible to use certificates without a private key?

Answer 1

No, you cannot use a certificate for authentication without the private key.

The security of an X.509 based authentication mechanism relies on public-key cryptography, where both public and private keys are generated. Only the private part should remain secret.

What you have is the public key. Signing something with your private key is what proves you 'own' the public key, and how you are authenticated.

Also note: you cannot simply generate a new private key for a public key. The keys are a pair.