How to troubleshot HttpWebRequest if X509Certificate is not added properly

Kuler Master 266

Hello all,

I am adding a X509Certificate to the HttpRequest like the following:

HttpWebRequest request = (HttpWebRequest)WebRequest.Create("webserviceurl");

request.ClientCertificates.Clear(); 

X509Certificate certificate = new X509Certificate(
    certificateFilePath, certificatePassword, 
    X509KeyStorageFlags.MachineKeySet | 
    X509KeyStorageFlags.PersistKeySet | 
    X509KeyStorageFlags.Exportable);

if(certificate != null) 
    request.ClientCertificates.Add(certificate);

However, sometimes the certificate is not added correctly or is blocked by something (ISP, Firewall etc. etc.) and we get an error from the web service we send it toward. It happens like 3 times out of 10. Meaning it works 3 times, then this problem occurs or works 5 times and then happens 2 times in a row - no specific pattern of when it happens. How do I troubleshot and figure out what could be the reason for this?

Thank you in advance!

JasonPan - MSFT 5,991 Reputation points Microsoft Vendor

2024-11-05T06:42:11.3033333+00:00

Hi @Kuler Master,

We can try using Try... Catch.. to check if there is any exception.

I'd also like to know how often you mentioned the ten http requests? Because it is possible that webserviceurl server may have some rate limiting configuration.

Best Regards

Jason
Kuler Master 266 Reputation points

2024-11-05T07:53:59.29+00:00

Hello Jason,

Thank you for replying - it's much appreciated. I am using try catch block indeed, but I didn't include it for the sake of clarify. The exception is the following:

The request was aborted: Could not create SSL/TLS secure channel.

Obviously, it is not very helpful because it only implies that the certificate is not included.
Yeah, I talked with their support and they told me that our failing requests arrive without the certificate so they reject them.

Meaning, we have defined the problem but I still don't know where to start looking for the solution.

Talking about the limitation; There is no such limitation at all as we are using the very same WS for years and it always worked fine. Since recently we started getting the above exception.

BTW, we don't use this web service too often. Maybe like 20-30 times per day.

Thank you!

JasonPan - MSFT 5,991 Microsoft Vendor

Hi @Kuler Master,

We can use locking mechanisms such as the lock keyword to ensure thread safety. Here is the sample code for you.

private static readonly object certLock = new object();
private static X509Certificate2 certificate;
public void SendRequest()
{
    lock (certLock)
    {
        if (certificate == null)
        {
            certificate = new X509Certificate2(
                certificateFilePath, certificatePassword,
                X509KeyStorageFlags.PersistKeySet);
        }
    }
    HttpWebRequest request = (HttpWebRequest)WebRequest.Create("webserviceurl");
    request.ClientCertificates.Add(certificate);
    // ...
}

Also, I want to know why HttpClient is not used? By the way, if the problem has only occurred recently, please check Windows Update or whether there is any other newly installed software.

Best Regards

Jason

Kuler Master 266 Reputation points

2024-11-05T09:50:00.23+00:00

I'll give it a try. BTW, this is an old application built with ASP.NET WebForms technology and that's why I use HttpWebRequest. However, I recently tried with HttpClient but it didn't help at all so I restored the old code.

I'll keep you posted. Thank you!
Kuler Master 266 Reputation points

2024-11-12T12:12:45.42+00:00

Nope. Using lock made it completely unreachable. None of the requests was successful. Hmm
JasonPan - MSFT 5,991 Reputation points Microsoft Vendor

2024-11-20T09:22:02.9366667+00:00

Hi @Kuler Master,

Thanks for your patience. Please try to Configure network tracing, we need to compare the difference between the working and the not working from network logs.

Please also hide the sensitive information from the logs, it can protect your data safely.

Best Regards

Jason

1 answer

Bruce (SqlWork.com) 67,401 Reputation points

2024-11-12T18:05:31.48+00:00

as you are creating a new certificate on each request, it unclear why you persist the keys.
Please sign in to rate this answer.
Kuler Master 266 Reputation points

2024-11-13T09:57:07.5366667+00:00

Hello Bruce,

I was trying with and without persisting the keys, but nothing changed.

var certificate = new X509Certificate2(certificateFilePath, certificatePassword);

Currently I have this code but it still happens although in the past when it was working fine, it worked even with the keys being persistent. In my opinion it doesn't matter. Completely wild situation :)
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to troubleshot HttpWebRequest if X509Certificate is not added properly

1 answer

Your answer