Call WebService from C# application using SSL

Question

In my C# desktop application, I am calling web services developed in php. I can have the CA file. I don't know how to call the web service via SSL and authenticating the certificate. What do I have to pass the server and what to expect in response form the server for authenticating ? Honestly I have no idea.

EDIT : Referred from : http://weblogs.asp.net/jan/archive/2003/12/04/41154.aspx

// Before calling web service System.Net.ServicePointManager.CertificatePolicy = new MyPolicy();

public class MyPolicy : ICertificatePolicy
{
    X509Certificate clientCert = null;

    public MyPolicy() {
        clientCert = X509Certificate.CreateFromSignedFile(HTTPUtility.CERT_FILE);
    }

    public bool CheckValidationResult(ServicePoint srvPoint, X509Certificate certificate, WebRequest request, int certificateProblem)
    {
        Console.WriteLine("********* Into CheckValidationResult : " + certificate.ToString());

        Console.WriteLine("####### Client Certificate : " + clientCert.ToString() + "\n" + "Subject = " + clientCert.Subject);
        Console.WriteLine("Issuer : " + clientCert.Issuer + "\n Seral No : " + clientCert.GetSerialNumberString());
        Console.WriteLine("Not Before : " + clientCert.GetEffectiveDateString() +" \n Not After : " + clientCert.GetExpirationDateString());
        Console.WriteLine("Thumb Print : " + clientCert.GetPublicKeyString());
        Console.WriteLine("######## EQuals SERVER CERT : " + clientCert.Equals(certificate));

        // Force to return true
        return true;
    }
}

Is the above method of checking correct ? If not why and what can be the solution. I also get this warning "'System.Net.ServicePointManager.CertificatePolicy' is obsolete: 'CertificatePolicy is obsoleted for this type, please use ServerCertificateValidationCallback instead.".

With this how can I know if the CheckValidationResult() returned false ?

Any help is highly appreciated.

Thanks

Solution 1

Have you tried using ServerCertificateValidationCallback as recommended in the obsolescence message? For example, you could add a method like the following to your existing MyPolicy class:

public bool ValidateServerCertificate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
    Console.WriteLine(sslPolicyErrors);  // Or whatever you want to do...
    return true;
}

Once that's done, you could replace your existing

System.Net.ServicePointManager.CertificatePolicy = new MyPolicy();

line with the following:

MyPolicy policy = new MyPolicy();
System.Net.ServicePointManager.ServerCertificateValidationCallback = policy.ValidateServerCertificate;

Solution 2

Take a look at this: How to call a Web service by using a client certificate for authentication in an ASP.NET Web application

You can find 2 examples at the bottom of that page.