Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
HomeAnnouncementsFree MagazinesWhite PapersSubmit Content
Discussion GroupsASP.NETWindows FormsLanguages.NET FrameworkVisual Studio.NET
Articles.NET FrameworkASP.NETToolsWindows Forms
.NET DirectoryOpen Source ProjectsUser GroupsWeb Resources
Related Topics
Visual Basic 6SQL ServerMS AccessOther DB ProductsMS Server ProductsMore Topics ...

.NET Forum / .NET Framework / .NET SDK / April 2004

Tip: Looking for answers? Try searching our database.

HttpWebRequest Client Certificates - Suppressing User Prompts

Thread view: 
Enable EMail Alerts  Start New Thread
Thread rating: 
pete reay - 01 Apr 2004 13:01 GMT
H

I'm using HttpWebRequest to connect to a secure site which requests a client certificate. When this happens, a dialog box pops up titled "signing data with your private exchange key" asking the user to confirm that the application should be allowed to use the private key

However, the application makes many connections and I would like to suppress this dialog. I understand that the underlying CryptoAPI call concerned is CryptAcquireContext() which needs to be passed the CRYPT_SILENT flag.

This returns a handle to the CSP, called HCRYPTPROV. Even if the silent flag can't be passed, if I could preserve this HCRYPTPROV between calls, at least the dialog would only be displayed once

Does anyone have any idea how to make the .NET Framework do either of these things? Any suggestions or comments would be much appreciated - I have been looking for a solution to this for ages..

Cheer

Pete
Feroze [MSFT] - 05 Apr 2004 03:56 GMT
I think you are getting this error because you have a client certificate
that is protected by a password. In this case, the OS is asking for
confirmation from you before it uses it. This is by design.

you need to remove the password protection from the client cert.

feroze.

Signature

Remove "user" from the email address to reply to the author.

This posting is provided "AS IS" with no warranties, and confers no rights

Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

> Hi
>
> I'm using HttpWebRequest to connect to a secure site which requests a client certificate. When this happens, a dialog box pops up titled "signing
data with your private exchange key" asking the user to confirm that the
application should be allowed to use the private key.

> However, the application makes many connections and I would like to suppress this dialog. I understand that the underlying CryptoAPI call
concerned is CryptAcquireContext() which needs to be passed the CRYPT_SILENT
flag.

> This returns a handle to the CSP, called HCRYPTPROV. Even if the silent flag can't be passed, if I could preserve this HCRYPTPROV between calls, at
least the dialog would only be displayed once.

> Does anyone have any idea how to make the .NET Framework do either of these things? Any suggestions or comments would be much appreciated - I have
been looking for a solution to this for ages...

> Cheers
>
> Pete
pete reay - 05 Apr 2004 12:16 GMT
Thanks for the advice there

Now the question which follows: How do I do this

I presume it must be done programmatically, as there are no options on the standard UI forms. I think what I want to do is: export the certificate's private key and then import it back without the USER_PROTECTED option (correct me if I'm wrong)

I have got as far as getting the CERT_CONTEXT and CERT_INFO structures of the certificate in question, but can't figure out where to go from here - how do I get the private key? (Or should I be doing something different)

Any advice would be much appreciated - as you can probably tell I'm no expert on the CryptoAPI

Cheer

Pet
   
    ----- Feroze [MSFT] wrote: ----
   
    I think you are getting this error because you have a client certificat
    that is protected by a password. In this case, the OS is asking fo
    confirmation from you before it uses it. This is by design
   
    you need to remove the password protection from the client cert
   
    feroze
   
    --
    Remove "user" from the email address to reply to the author
   
    This posting is provided "AS IS" with no warranties, and confers no right
   
    Use of included script samples are subject to the terms specified a
    http://www.microsoft.com/info/cpyright.ht
   
   
   
   
    "pete reay" <anonymous@discussions.microsoft.com> wrote in messag
    news:D36DB044-B4FF-4A8A-BF65-BDAD9A8A68C2@microsoft.com..
    > H
    >> I'm using HttpWebRequest to connect to a secure site which requests
    client certificate. When this happens, a dialog box pops up titled "signin
    data with your private exchange key" asking the user to confirm that th
    application should be allowed to use the private key
    >> However, the application makes many connections and I would like t
    suppress this dialog. I understand that the underlying CryptoAPI cal
    concerned is CryptAcquireContext() which needs to be passed the CRYPT_SILEN
    flag
    >> This returns a handle to the CSP, called HCRYPTPROV. Even if the silen
    flag can't be passed, if I could preserve this HCRYPTPROV between calls, a
    least the dialog would only be displayed once
    >> Does anyone have any idea how to make the .NET Framework do either o
    these things? Any suggestions or comments would be much appreciated - I hav
    been looking for a solution to this for ages..
    >> Cheer
    >> Pet

Free Magazines

Get these publications absolutely FREE for up to 12 months. There are no hidden fees and no obligation. Simply choose a title, complete the application form and submit it. Read more ...

Oracle MagazineNetwork ComputingComputer WorldBio-IT WorldeWeekInformation WeekInfosecurity
 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2008 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.