Client Certificates in Dotnet Core on Ubuntu

Question

all - I've written a dotnet core API set that functions perfectly on windows. On Ubuntu 14.04, everything works except for one SOAP request to a vendor that uses a client certificate for authentication.

The request always times out. A Netstat trace shows that only 1 byte of data was sent to the remote service on 443. No communication happens for 100 seconds and then the app throws a timeout exception.

I've tried using openssl to export PEM and CRT files and referenced those in addition to the way the code is configured now (pfx w/ password). I've also loaded the certificate portions of the PFX into ca-certs.

Here's the code:

        var binding = new BasicHttpBinding();
        binding.Security.Mode = BasicHttpSecurityMode.Transport;
        binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.Certificate;

        var baseAddress = new Uri(mySettings.ClientUrl);
        factory = new ChannelFactory<SingleSignOnSoap>(binding, new EndpointAddress(baseAddress));
        if (RuntimeEnvironment.OperatingSystemPlatform == Platform.Windows)
        {
            //windows file location
            factory.Credentials.ClientCertificate.Certificate = new X509Certificate2(mySettings.PrivateKeyWindowsPath, mySettings.PfxPass);
        }
        else
        {
            //linux file location
            factory.Credentials.ClientCertificate.Certificate = new X509Certificate2(mySettings.ClientPrivateKeyUnixPath, mySettings.PfxPass);

        }

        serviceProxy = factory.CreateChannel();
        RequestTicketRequest request = new RequestTicketRequest();
        RequestTicketRequestBody requestBody = new RequestTicketRequestBody(xmlRequest);
        request.Body = requestBody;

        RequestTicketResponse response = serviceProxy.RequestTicket(request);

        return response.Body.RequestTicketResult;

I didn't include it in the code, but the url does use https:// — mwdavisii
– mwdavisii, Commented Jul 11, 2016 at 15:45

mwdavisii · Accepted Answer · 2016-07-13 19:47:15Z

1

Wireshark and Tshark show the authentication is actually working ok. The timeout is happening because the ServiceFactory is waiting to receive the response, but the network has sent a connection reset flag ([RST, ACK]) to the remote server. I've been able to reproduce on multiple linux distros so I'm adding an issue to the dotnet core WCF team's queue on github.

answered Jul 13, 2016 at 19:47

mwdavisii

418 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Client Certificates in Dotnet Core on Ubuntu

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related