Implementing mTLS Between Two Apps Using ASP.NET

Thanks Bruce,

Here is the Server side validation code hosted in Azure app service

using System;

using System.Security.Cryptography.X509Certificates;

using Microsoft.AspNetCore.Mvc;

namespace mtlsserver1.Controllers

{

public class MTLSController : Controller

{

    private readonly ILogger<MTLSController> _logger;

    public MTLSController(ILogger<MTLSController> logger)

    {

        _logger = logger;

    }

    [HttpGet]

    [Route("api/validate")]

    public IActionResult ValidateClientCertificate()

    {

        foreach (var header in Request.Headers)

        {

            _logger.LogInformation("Header: {Key} = {Value}", header.Key, header.Value);

        }

        string clientCertBase64 = Request.Headers["X-ARR-ClientCert"];

        if (string.IsNullOrEmpty(clientCertBase64))

        {

            _logger.LogWarning("No client certificate provided in the request.");

            return StatusCode(403, "Client certificate is required.");

        }

        try

        {

            byte[] clientCertBytes = Convert.FromBase64String(clientCertBase64);

            var clientCertificate = new X509Certificate2(clientCertBytes);

            string clientThumbprint = clientCertificate.Thumbprint;

            var certProperties = new

            {

                Subject = clientCertificate.Subject,

                Issuer = clientCertificate.Issuer,

                Thumbprint = clientCertificate.Thumbprint,

                ExpirationDate = clientCertificate.NotAfter,

                EffectiveDate = clientCertificate.NotBefore,

                SerialNumber = clientCertificate.SerialNumber

            };

            _logger.LogInformation("Client Certificate Properties: {@CertProperties}", certProperties);

            // Log or return the properties for display

            //Console.WriteLine($"Client Certificate Properties:\n" +

            //                  $"  Subject: {certProperties.Subject}\n" +

            //                  $"  Issuer: {certProperties.Issuer}\n" +

            //                  $"  Thumbprint: {certProperties.Thumbprint}\n" +

            //                  $"  Effective Date: {certProperties.EffectiveDate}\n" +

            //                  $"  Expiration Date: {certProperties.ExpirationDate}\n" +

            //                  $"  Serial Number: {certProperties.SerialNumber}");

            if (IsTrustedClient(clientThumbprint))

            {

                _logger.LogInformation("Client certificate is valid.");

                return Ok(new { message = "Client certificate is valid." });

            }

            else

            {

                _logger.LogWarning("Invalid client certificate. Thumbprint: {Thumbprint}", clientThumbprint);

                return StatusCode(403, "Invalid client certificate.");

            }

        }

        catch (Exception ex)

        {

            _logger.LogError(ex, "Error processing client certificate.");

            return StatusCode(500, $"Error processing client certificate: {ex.Message}");

        }

    }

    private bool IsTrustedClient(string thumbprint)

    {

        _logger.LogInformation("Checking if thumbprint {Thumbprint} is in the trusted list.", thumbprint);

        var trustedThumbprints = new[]

        {

    "5f4xxxxxxxx33010328aa30108dxxxxxxx",

    "46sxxxxxxxxx9729CE24AE398Cxxxxx",

    "3F6Dxxxxxxxxx4756D9C71458BExxxxxxx"

};

        return Array.Exists(trustedThumbprints, t => t.Equals(thumbprint, StringComparison.OrdinalIgnoreCase));

    }

}

}

and Client side validation code hosted in Azure app service, certificate is being fetched from azure
-----------------------------------------------------------

public async Task<IActionResult> Index()

{

 try

 {

     // Define the thumbprint of the client certificate

     string certThumbprint = "4627A80F95745C9729CE24AE398C34B658537BBD";

     // Fetch the client certificate from the local machine store

     X509Certificate2 clientCert = GetCertificateByThumbprint(certThumbprint);

     if (clientCert == null)

     {

         //ViewBag.Message = "Client certificate not found.";

         //return View();

         return NotFound("Client certificate not found.");

     }

     // return View(clientCert.FriendlyName);

     // Display some certificate properties

     var certProperties = new

     {

         Subject = clientCert.Subject,

         Issuer = clientCert.Issuer,

         Thumbprint = clientCert.Thumbprint,

         ExpirationDate = clientCert.NotAfter,

         EffectiveDate = clientCert.NotBefore,

         SerialNumber = clientCert.SerialNumber

     };

     //ViewBag.CertProperties = certProperties;

     // Log or return the properties for display

     //return Ok($"Client Certificate Properties:\n" +

     //                  $"  Subject: {certProperties.Subject}\n" +

     //                  $"  Issuer: {certProperties.Issuer}\n" +

     //                  $"  Thumbprint: {certProperties.Thumbprint}\n" +

     //                  $"  Effective Date: {certProperties.EffectiveDate}\n" +

     //                  $"  Expiration Date: {certProperties.ExpirationDate}\n" +

     //                  $"  Serial Number: {certProperties.SerialNumber}");

     // Create an HttpClientHandler and attach the client certificate

     var handler = new HttpClientHandler();

     handler.ClientCertificates.Add(clientCert);

     handler.ServerCertificateCustomValidationCallback = (sender, cert, chain, sslPolicyErrors) => true;

     // Create an HttpClient instance

     using (var client = new HttpClient(handler))

     {

         // Send the request to the MTLS-enabled server

         var response = await client.GetAsync("https://mtlsserver-xxxxxxxxxxx.azurewebsites.net/api/validate");

         if (response.IsSuccessStatusCode)

         {

             var responseBody = await response.Content.ReadAsStringAsync();

           // return Ok($"Server response: {responseBody}");

             return Ok(new

             {

                 ServerResponse = $"Server response: {responseBody}",

                 CertificateProperties = certProperties

             });

             //ViewBag.ServerResponse = "Server response: " + responseBody;

         }

         else

         {

             return StatusCode((int)response.StatusCode, "Request failed.");

         }

     }

 }

 catch (Exception ex)

 {

     return StatusCode(500, $"Error: {ex.Message}");

 }

 //return View();

}

private X509Certificate2 GetCertificateByThumbprint(string thumbprint)

{

 // Open the local machine certificate store

 using (var store = new X509Store(StoreLocation.CurrentUser))

 {

     store.Open(OpenFlags.ReadOnly);

     // Find the certificate by thumbprint

     var certCollection = store.Certificates.Find(

         X509FindType.FindByThumbprint,

         thumbprint,

         validOnly: false);

     // Return the first certificate found

     return certCollection.Count > 0 ? certCollection[0] : null;

 }

}

as Im extracting the header from the client certificate in the server side and validating with Thumbprint, if thumbprint is matches, im going to allow.. All works well, but when i see in the logs kudu i can see this error, can i ignore this?
Pls suggest. after this I can close out the thread, your help is appreciated

2025-01-16 15:32:25.378 +00:00 [Trace] Microsoft.AspNetCore.HttpsPolicy.HstsMiddleware: Adding HSTS header to response.
2025-01-16 15:32:25.392 +00:00 [Warning] Microsoft.AspNetCore.Authentication.Certificate.CertificateAuthenticationHandler: Certificate validation failed, subject was CN=clientmtls-f9bsckaye2aqahda.canadacentral-01.azurewebsites.net, O=Internet Widgits Pty Ltd, S=Some-State, C=AU. PartialChain A certificate chain could not be built to a trusted root authority., RevocationStatusUnknown The revocation function was unable to check revocation for the certificate., OfflineRevocation The revocation function was unable to check revocation because the revocation server was offline.
2025-01-16 15:32:25.392 +00:00 [Information] Microsoft.AspNetCore.Authentication.Certificate.CertificateAuthenticationHandler: Certificate was not authenticated. Failure message: Invalid client certificate.

Hi,

Just checking in. I haven’t heard back from you for a while, I hope everything works out as you expected. I understand things can get busy or priorities may shift.

If you’re still experiencing the issue or need further support, feel free to jump back in at any time. I will always be here and happy to help.

Wishing you all the best with your work!