tags:

views:

239

answers:

2

This is kind of not a question, but need a clarification. Here is the code. All this code is doing is sending sending a cer file to server in httpwebrequest which is placed on a local drive. My question is, what happens if multiple users try to access the application at a time. I mean 5-10 requests reading the same cer at a time. will it break saying that the cer file is locked by some other thread to read/or will it not break because it's just read only?

//You must change the path to point to your .cer file location. 
X509Certificate Cert = X509Certificate.CreateFromCertFile("C:\\mycert.cer");
// Handle any certificate errors on the certificate from the server.
ServicePointManager.CertificatePolicy = new CertPolicy();
// You must change the URL to point to your Web server.
HttpWebRequest Request = (HttpWebRequest)WebRequest.Create("https://YourServer/sample.asp");
Request.ClientCertificates.Add(Cert);
Request.UserAgent = "Client Cert Sample";
Request.Method = "GET";
HttpWebResponse Response = (HttpWebResponse)Request.GetResponse();
// Print the repsonse headers.
Console.WriteLine("{0}",Response.Headers);
Console.WriteLine();
// Get the certificate data.
StreamReader sr = new StreamReader(Response.GetResponseStream(), Encoding.Default);
int count;
char [] ReadBuf = new char[1024];
do
{
 count = sr.Read(ReadBuf, 0, 1024);
 if (0 != count)
 {
  Console.WriteLine(new string(ReadBuf));
 }

}while(count > 0);
+1  A: 

Reads don't lock files in Windows....

Stobor
That is a very bold statement. I would just claim that files opened in shared mode can be also open by other processes that request shared mode. http://msdn.microsoft.com/en-us/library/system.io.fileshare.aspx
Remus Rusanu
@Remus Rusanu: I agree; with the additional point that File.OpenRead defaults to Read-shared mode.
Stobor
A: 

Why not send the certificate from the user store instead of file and eliminate the concern, as in the second method described in How to send a client certificate by using the HttpWebRequest. You need to load the private key into the key store anyway, so I really don't see any point in using the certificate from a .cer file.

Remus Rusanu
yeah, I know that link that's where I got this code from. But you know I have tried it and it's a pain to get it working. Also the reason I went for this implementation because our code is hosted on a App server. So I really don't have to worry about security. 2nd. I don't need to load the private key from cert store. I can give access to the user account that is going to read cert private key using "winhttpcertcfg.exe" - It works.
Broken Link
That winhttpcertcfg.exe run that's what is doing, loads the private key into the user cert store. How else do you explain that your code does not specify the location of the private key, nor a password to access it?. Anyway, loading it from a .cer file works OK. There is no threat in someone reading the .cer file (since is *public* anyway). Also replacing the .cer file is not a real threat either, a different private key is needed too and if it has access to a private key, then isn't really an attack. Only serious concern is operational, an accidental delete or move of the .cer file.
Remus Rusanu
YES, I don't specify private key or password in my code. There is a trick that you need to do. 1. Grant private key access to the .p12 file for the account that's going to read (typically ASPNET)2. Then export that p12 file to Cert store to "local computer" account 3. Now export that cert from cert store to your local drive. That's it. you don't have to use private key/password in your code. And the account will get access to private key. HTH.
Broken Link
I will vote your answer for the time you took and replied :) Thanks!
Broken Link