I too would like to know the answers to these questions!
I am new to WSE3.0 but may be able to help you a bit...
Installing certificates on the users machine can be done by sending them a
password encrypted .pfx file, one for the server certificate and another for
the client. They then double click on it and follow the import wizard
instructions. Of course you have sent the .pfx file password seperately. Not
ideal by any means, they will also have to select which certificate store to
install the certificate which is different for both the client and server
certificates.
Are you sure you need thousands of client certificates? What I am doing and
I don't know if this is the best way, but I just use the client/service
certificates to secure the link to the server. Identifing the client is done
by them logging in, in a normal way, sending a username/password which
authenticates them. Since the entire link from client machine to server is
encrypted you don't have to worry about sending passwords over the link
(unlike SSL where the client data is sent over the LAN unencrypted before
being encrypted for sending out of the building).
There is alot of information at
http://msdn2.microsoft.com/en-us/library/aa480545.aspx --
Best regards
Mark
[quoted text, click to view] "MarkH" <MarkH@discussions.microsoft.com> wrote in message
news:17B7A002-0434-4D9E-BB1D-179B84C4B78E@microsoft.com...
>I was doing some research into using X509 certificates to implement message
> level security and watched the MSDN .NET Nugget session on the topic, I
> could
> see how to install the certificates that came with WSE 3.0 (for dev
> purposes)
> which is fine, the problem I have (relating to certificate issuing and
> client app deployment) is as follows:
>
> 1) In a real world situation you would not want your users having to mess
> about with .PFX or .CER certificate files and you certainly don't want
> them
> to have to install them using the MMC snap in for the certificate store
> before they can use your application so how do you interact with the
> certificate store programmatically?
>
> 2) How do you pass the servers public key to the client app and how do you
> get it into the users certificate store?
>
> Could you include the .CER file with the application installer and install
> it into the certificate store (in code) when you install the application
> with
> a custom Install class?
> I assume you can use a certificate for the server like one you would use
> in
> a standard SSL scenario?
>
> 3) How do you generate the client certificate (there could be hundreds or
> even thousands of clients)
>
> 4) Once you have generated a client certificate how do you get it on to
> the
> users machine and installed into the users certificate store?
>
> Any help much appreciated.
>
> Mark H.
