Using the "Service Account" certificate store with .NET 2.0 HttpWebRequest

Question

I have a .net 2.0 windows service application written in C# that access a non-soap web service via SSL with HttpWebRequest. My windows service runs under the NETWORK SERVICE account.

I am able to make SSL work by issuing a cert to the web server that my windows service talks to from a CA, then installing the CA's cert to the Local Machine\trusted root store.

What I would like to be able to do is to install the CA's cert to the "service account" trusted root cert store instead of the "local machine" store, and have this "just work."

In other words, it seems that the SSL authentication used by the .net framework is hard coded to check the current user store, and the local machine store for trusted roots when validating an SSL certificate, but is there any clean way to get it to check the "service account" store instead of (or in addition to) the other stores?

The only solution I can come up with is to override the ServicePointManager.ServerCertificateValidationCallback and then P/Invoke to the Crypto API to open the "service account" cert store in Win32, and manually search for the root in there. I'd rather not do that, since it would seem to be a pretty large performance penalty, having to wait for failure from 2 cert stores I don't intend to use anyway.

Possibly, i'm taking entirely the wrong approach here, but it really seems like I'm missing a simply way to solve my problem.

Answer 1

If your code controls the server it is talking to, then why dont you just return "true" from the CertValidationCallback? It is not as if the server cert will change every time you make a request?

Unless you really need the system to also verify other things related to the cert, for eg CRL, expiry etc, you might just make it work by implementing a custom cert validation callback.

If you really want to install the cert into the NETWORK_SERVICE a/c context, then there are tools from Microsoft to help you do that.

http://support.microsoft.com/kb/901183 http://web.asu.edu/community/installing-client-certificate-windows-machine http://www.derkeiler.com/Newsgroups/microsoft.public.dotnet.security/2008-03/msg00011.html

good luck!