Implementing mTLS Between Two Apps Using ASP.NET

Abdul Baba Syed 21

Guidance is requested on implementing mTLS between two applications using ASP.NET MVC in C#. or any .net code. The setup will involve a handshake between the server app and client app, developed in a localhost environment, utilizing OpenSSL or another tool for self-signed certificates.Once the proof of concept is successful, the intention is to migrate the solution to Azure App Services. Thank you.

AgaveJoe 29,281 Reputation points

2025-01-07T13:55:58.1033333+00:00

Guidance is requested on implementing mTLS between two applications using ASP.NET MVC in C#

Have you tried Google?

https://www.google.com/search?q=mtls+.net
XuDong Peng-MSFT 10,931 Reputation points Microsoft Vendor

2025-01-08T08:20:10.6966667+00:00

Hi @Abdul Baba Syed,

Guidance is requested on implementing mTLS between two applications using ASP.NET MVC in C#. or any .net code.

It seems that you want to configure certificate authentication in your code, maybe you can refer to this official document, it includes sample steps such as code (.NET Core), creating certificates, etc.: https://learn.microsoft.com/zh-cn/aspnet/core/security/authentication/certauth?view=aspnetcore-9.0

In addition, whether your requirements are restricted to a specific environment, .NET framework or .NET Core?
Abdul Baba Syed 21 Reputation points

2025-01-08T16:01:29.5233333+00:00

Thanks, I got a confirmation, that POC should be done in azure app service, appreciate some guidance or code for the server and client (both) using mtls cert for app service with self signed certs. Appreciate your help

1 answer

Bruce (SqlWork.com) 69,121 Reputation points

2025-01-08T16:22:28.95+00:00

Follow this article

https://learn.microsoft.com/en-us/azure/app-service/app-service-web-configure-tls-mutual-auth?tabs=azurecli%2Cflask
Please sign in to rate this answer.
Abdul Baba Syed 21 Reputation points

2025-01-09T05:19:44.3366667+00:00

Thanks

how to validate at the server side code, not just a header? and how does the client carry certificate and present to the server and how to validate it. (Both side process im looking) Thanks

Bruce (SqlWork.com) 69,121 Reputation points

2025-01-09T17:05:27.4733333+00:00

it depends on how the server code is hosted.

if the server code is hosted by IIS then IIS manages the all connection and certificate validation. see:

https://learn.microsoft.com/en-us/iis/configuration/system.webServer/security/authentication/iisClientCertificateMappingAuthentication/

if using Kestrel then something like:

https://learn.microsoft.com/en-us/aspnet/core/security/authentication/certauth?view=aspnetcore-9.0

from the client:

https://learn.microsoft.com/en-us/dynamics365/business-central/dev-itpro/developer/methods-auto/httpclient/httpclient-addcertificate-secrettext-secrettext-method

Abdul Baba Syed 21 Reputation points

2025-01-11T06:27:10.23+00:00

Thanks Bruce

Below is the client Side code:

using System;

using System.Net.Http;

using System.Security.Cryptography.X509Certificates;

using System.Threading.Tasks;

namespace ClientCertificateSender

{

class Program { static async Task Main(string[] args) { // Path to your client certificate (PFX file) and password string certPath = "path_to_your_client_certificate.pfx"; // e.g., "C:\\certs\\clientcert.pfx" string certPassword = "your_cert_password"; // Load the client certificate X509Certificate2 clientCert = new X509Certificate2(certPath, certPassword); // Create an HttpClientHandler and add the client certificate HttpClientHandler handler = new HttpClientHandler(); handler.ClientCertificates.Add(clientCert); // Allow self-signed certificates for testing (optional) handler.ServerCertificateCustomValidationCallback = (message, cert, chain, errors) => true; using (HttpClient client = new HttpClient(handler)) { // The server URL (replace with the actual URL of your server) string serverUrl = "https://yourserver.com/Cert"; try { // Send a GET request to the server HttpResponseMessage response = await client.GetAsync(serverUrl); // Read and display the response string responseBody = await response.Content.ReadAsStringAsync(); Console.WriteLine($"Response: {responseBody}"); } catch (Exception ex) { Console.WriteLine($"Error: {ex.Message}"); } } } }

}

But at the client side, the client is loading the certificate from the path given above.

Im confused, do we send the client the .pfx cert or a private key? is the above code is valid?

As the azure app service (Server side) will check this cert and currently we are in multi-tenant app vm, does not have public key/pfx at the server side to validate. Only way is to check whether at the server side in app is the header as the value

// Configure the application to client certificate forwarded the frontend load balancer services.AddCertificateForwarding(options => { options.CertificateHeader = "X-ARR-ClientCert"; });

and extract the client thumprint validate from the Json/list and allow the app to access it.. appreciate your guidance, if any code available both for client and server based on the above requirement.. Thanks

Bruce (SqlWork.com) 69,121 Reputation points

2025-01-11T19:14:25.48+00:00

The certificate must be installed on the server. It used to verify the ssl connection. Typically the certificate is generated and installed on the server, then sent to clients to install. the certificate is verified by the server ssl endpoint. The ssl connection will fail if a valid certificate is not supplied.

The azure load balancer does not support ssl certificates, so cannot be used. In azure you use application gateways that support ssl certificates. the gateway has support for the certificate validation. The gateway can pass the certificate to server as forward header, so the server can know the client using the connection.

normally the .pfx which has the certificate inside is password encrypted, so a password is required to read the certificate value. The private key (only know by the server) is used by the server validating the certificate
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Implementing mTLS Between Two Apps Using ASP.NET

1 answer

Your answer