How to check SSL certificate of client browser

How do I check the SSL certificate of the client browser in my ASP.net code I want to make sure that if any https proxy like fiddler is running then my application won't load I still haven't done this: My site is on Https In IIS I set Require SSL = true Require 128 bit encryption = true accept certificate = true

in my default.aspx Page_Load I am trying to read the value of Request.ClientCertificate, the collection comes as empty.

+2


source to share


2 answers


There is no way to do what you are trying to do unless you run the ActiveX control on the client.

Internet Explorer and other browsers do not expose server SSL certificate information to JavaScript on the page, which means that there is no way for your page running on the client to know if it was delivered with your certificate or another certificate.



Having said that, even if such a method were proposed, it probably would not help you in any way. Presumably you want to do this to prevent viewing / modifying your traffic, but there are other tools that connect directly to the browser (after HTTPS decryption, pre HTTPS encryption) that can view / modify traffic without postponing it like Fiddler and other proxies do.

Also, your code will not work in corporate environments where an edge proxy (eg BlueCoat, Forefront) performs content validation using the same mechanisms as Fiddler.

+1


source


Are you expecting the client to install the certificate? Most users do not have client certificates installed.



That said, I'm not sure exactly how a client certificate would protect you in the situation you describe ...

0


source







All Articles