> I'm looking for information on how to programmatically validate a
> client certificate.
>
> I found this article http://support.microsoft.com/kb/315588/ but it
> stops short in describing how to actually validate the cert.
>
> HttpClientCertificate cert = Request.ClientCertificate;
> if (cert.IsPresent)
> certDataLabel.Text = cert.Get("SUBJECT O");
> else
> certDataLabel.Text="No certificate was found.";
> I can get this part working. However, when I revoke the certificate
> it is still present and would allow the user in. I'm looking for how
> to say something like:
>
> if (cert.IsNotRevoked)
> Do Something();
> How do you check that the client certificate is not revoked? Interact
> with the CA and the CRL programmatically?
>
> Thanks in advance!
>

"JT" <jtaylor1024@gmail.com> wrote in message
news:1156551193.771065.276480@m79g2000cwm.googlegroups.com...
> Thanks for your reply. Well I'm using 1.1 and 2.0 in different
> projects so I actually need both. The IsValid property is true but it
> remains true even if I revoke the cert (we are our own ca). I was
> surprised at this (although perhaps it is cached somewhere). My app
> presents sensitive data so if I revoke a cert I need it to deny the
> user at that very moment.
>
> Is IsValid the only thing people are doing or is there a more thorough
> approach to validating the certs?
>
> Thanks again.
>
>
>
> Dominick Baier wrote:
>> Which .NET Version?
>>
>> What's the value of the IsValid property?
>>
>>
>>
>> ---
>> Dominick Baier, DevelopMentor
>> http://www.leastprivilege.com
>>
>> > I'm looking for information on how to programmatically validate a
>> > client certificate.
>> >
>> > I found this article http://support.microsoft.com/kb/315588/ but it
>> > stops short in describing how to actually validate the cert.
>> >
>> > HttpClientCertificate cert = Request.ClientCertificate;
>> > if (cert.IsPresent)
>> > certDataLabel.Text = cert.Get("SUBJECT O");
>> > else
>> > certDataLabel.Text="No certificate was found.";
>> > I can get this part working. However, when I revoke the certificate
>> > it is still present and would allow the user in. I'm looking for how
>> > to say something like:
>> >
>> > if (cert.IsNotRevoked)
>> > Do Something();
>> > How do you check that the client certificate is not revoked? Interact
>> > with the CA and the CRL programmatically?
>> >
>> > Thanks in advance!
>> >
>

> The ideal thing would be to get IIS to check the revocation of the
> certificate for you. If that was to happen, the user would never
> authenticate in the first place and your code would never run. I'm
> not sure exactly how you configure SSL in IIS to do this though.
> There is probably either a metabase or registry setting somewhere. I
> am pretty sure that schannel in Windows 2003 can check CRLs though.
>
> If you want to do this in code, the X509Chain class in .NET 2.0 can be
> used to try to verify this sort of thing. You don't have good options
> in .NET 1.1 (p/invoke to the crypto API).
>
> Best of luck!
>
> Joe K.
>