Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
HomeAnnouncementsFree MagazinesWhite PapersSubmit Content
Discussion GroupsASP.NETWindows FormsLanguages.NET FrameworkVisual Studio.NET
Articles.NET FrameworkASP.NETToolsWindows Forms
.NET DirectoryOpen Source ProjectsUser GroupsWeb Resources
Related Topics
Visual Basic 6SQL ServerMS AccessOther DB ProductsMS Server ProductsMore Topics ...

.NET Forum / ASP.NET / Security / July 2004

Tip: Looking for answers? Try searching our database.

Problem using HttpWebRequest/HttpWebResponse with HTTPS

Thread view: 
Enable EMail Alerts  Start New Thread
Thread rating: 
Tony A - 29 Mar 2004 07:42 GMT
I'm having a wierd problem using HttpWebRequest/HttpWebResponse when
posting to a third party server via https to process credit card
transactions.  The WebException (SecureChannelFailure) I am getting
occurs during the call to GetResponse()  (see code below) and returns
the message 'The underlying connection was closed: Could not establish
secure channel for SSL/TLS'.  I've seen this error in many other posts
but my situation seems a little different.  Basically, the FIRST time
an end user submits a transaction on our website, the below code gets
executed and when the exception is thrown an error is displayed to the
end user.  If the user hits their back button and then 'submits' again
-- it works fine -- and, will now ALWAYS work fine from that end
user's computer.  This is wierd to me because when the https request
is made from our server to the third party server the actual end
user's environment (machine, browser, etc...) should be out of the
picture (i.e. - not have an affect on the https request/response being
made between the servers) -- right?  But apparently it does, because
it only fails the first time a user tries to submit, after that it
works fine all the time.  Any help on this would be GREATLY
appreciated!!!  Here is my code:

REQUEST/RESPONSE CODE:
    ServicePointManager.CertificatePolicy = new
AcceptAllCertificatePolicy();

    httpRequest = (HttpWebRequest) WebRequest.Create("https://........");
    httpRequest.Method = "POST";
    string sPostData = "some data I setup for the post"
    byte [] postBuffer = System.Text.Encoding.ASCII.GetBytes(sPostData);
    httpRequest.ContentLength = postBuffer.Length;
    httpRequest.ContentType = "application/x-www-form-urlencoded";
    httpRequest.Timeout = 100000; // wait 100 seconds for a response
    httpRequest.AllowAutoRedirect = true;
    Stream requestStream = httpRequest.GetRequestStream();
    requestStream.Write(postBuffer ,0,postBuffer.Length);
    requestStream.Close();

    httpResponse = (HttpWebResponse) httpRequest.GetResponse();
    stream = httpResponse.GetResponseStream();
    streamReader = new StreamReader(stream,System.Text.Encoding.ASCII);
    sResultLine = streamReader.ReadLine();
    while (sResultLine != null)
    {
        // read all lines
    }

    streamReader.Close();
    httpResponse.Close();

REQUEST/RESPONSE CODE:
    public class AcceptAllCertificatePolicy : ICertificatePolicy
    {
        public bool CheckValidationResult(ServicePoint srvPoint,  
            System.Security.Cryptography.X509Certificates.X509Certificate
certificate,
            WebRequest request,
            int certificateProblem)
        {

            // Just accept.
            return true;
        }
    }
DotNetJunkies User - 10 Jun 2004 12:09 GMT
Did you ever solve this problem?
If so, please can you let me know how as I am trying to do something similar.

richard.beacroft@warnerbros.com

Regards,
Rik

---
DotNetJunkies User - 02 Jul 2004 15:30 GMT
check out http://normanheadlam.blogspot.com/

---
DotNetJunkies User - 23 Jul 2004 16:33 GMT
You must add the https cert from the given url to the request. At first store the cert on disk (e.g. via IE).
Then:

oCert = X509Certificate.CreateFromCertFile("AT3.cer");
m_oRequest.ClientCertificates.Add(oCert);

I hope it helps

---

Free Magazines

Get these publications absolutely FREE for up to 12 months. There are no hidden fees and no obligation. Simply choose a title, complete the application form and submit it. Read more ...

Oracle MagazineNetwork ComputingComputer WorldBio-IT WorldeWeekInformation WeekInfosecurity
 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2008 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.