Secure Socket connection with client certificate

Question

I have an application that we would like to port to Windows Runtime (Metro). It uses a SSL socket connection and must authenticate itself with a client certificate (if not the connection handshake will fail). On other platforms we used openssl to achieve this.

Checking the available documentation it seems that I can set up a SSL socket. But how can I setup the corresponding CA certificate (should only be imported for the application) and client certificate?

Thanks for your time. - Martin

Answer 1

Hi Martin - you can use a Manifest Extension which will package and deploy the certificates for your application.

http://msdn.microsoft.com/en-us/library/windows/apps/hh465052.aspx

http://msdn.microsoft.com/en-us/library/windows/apps/hh464981.aspx

 

The documentation for Metro-style Crypto/PKI is here:

http://msdn.microsoft.com/en-us/library/windows/apps/hh464964.aspx

 

I hope this answers your question.

---

Matt Small - Microsoft Escalation Engineer - Forum Moderator

Answer 2

Hi Martin - a fellow Microsoft employee saw this post and pointed out to me that different network technologies have different levels of support for client certificates. The HTTP APIs generlly support them, but the StreamSocket does not.  I wanted to make it clear for others that might see this post.

---

Matt Small - Microsoft Escalation Engineer - Forum Moderator

Answer 3

Matt, when you refer to "HTTP APIs", which APIs are you talking about?  Could you provide a link?  Thanks!

Answer 4

Microsoft Windows HTTP Services (WinHTTP)     http://msdn.microsoft.com/en-us/library/windows/desktop/aa382925(v=vs.85).aspx

Answer 5

The original question was about Metro and WinHTTP is not allowed in Metro.  I am hoping that Matt had a different recommendation because otherwise there still is no story here in the Metro world.

Answer 6

For anyone reading this thread later, it turns out that IXMLHTTPRequest2 does certificate authentication automatically if prompted by the server and if your app has the "Shared User-Certificates" permission applied.