X.509 certificate can't find with "FindBySubjectName"

Question

After a brutal struggle with WCF Security, I think I'm at the final stage now and can see the light.

I've got a Client certificate installed on my server, and is now, as advised, in the Trusted People folder of the certificate store.

However, when I try and read the certificate application -> service, I get this error:

Cannot find the X.509 certificate using the following search criteria: StoreName 'My', StoreLocation 'CurrentUser', FindType 'FindBySubjectName', FindValue 'Forename Surname'.

With the "Forename Surname" being the "Issued to" part of my certificate. In all tutorials I have seen, this is just one word; is this the problem? I received my certificate from my CA with these two words, with a space.

Anyone ever come across this, is there something I'm blatantly doing wrong?

Update, cert can be seen here:

Update:

It gets even more strange:

I installed Visual Studio on my web server, and used the following code to pick up the cert by Thumbprint:

var store = new X509Store(StoreName.TrustedPeople, StoreLocation.CurrentUser);
store.Open(OpenFlags.ReadOnly);
var certs = store.Certificates.Find(X509FindType.FindByThumbprint, "71995159BFF803D25BFB691DEF7AF625D4EE6DFB", false);

This actually RETURNS a valid result. When I put this information into the web.config of my service/client though, I still get the error.

Imogen

You're managing the certificates for the current user. Presumably somedomain\cdixon. Does the web service run as somedomain\cdixon or something else, say, NETWORK SERVICE? – Eulogistic

Answer 1

I think..You installed certificate at location Trusted People and searching at store name my

var store = new X509Store(StoreName.TrustedPeople, StoreLocation.CurrentUser);
store.Open(OpenFlags.ReadOnly);
var certs = store.Certificates.Find(X509FindType.FindBySubjectDistinguishedName, certificateSubject, false);

Also there are two search terms FindBySubjectName or FindBySubjectDistinguishedName, the later is more relevant with keywords and first one will find anything with search keywords.

So basically you need to look for Subject and if you use above code then your search string would be .."CN=urs.microsoft.com, O=DO_NOT_TRUST, OU=Created by http://fiddler2.com"

Federal

I've tried both of those - storeName "TrustedPeople" and "FindBySubjectDistinguishedName" still return no results, how frustrating! I've updated my post with an image of my cert, should I definately be using "CurrentUser" and not "LocalMachine" ? The service and client are on the same web box. – Imogen

if edits doesn't work, can you post screenshot of subject like I did and also code as well. – Federal

I've got my Subject, but it's far more detailed than the sceenshot above, it has address, postcode, email, etc, a very long string when all together. Do I need all of this? – Imogen

I think it doesn't matter.. but you don't have to search with all keywords, just use which are unique in context. – Federal

Pecualiar thing about searching using Distinguished Name is that it must be formatted verbatim as it is encoded inside the ASN.1 data, for example, "CN=Name, O=Company" is valid, while "CN=Name,O=Company" and "CN = Name, O = Company" are invalid. I'd suggest formatting it first using this code: new X500DistinguishedName("CN=Name,O=Company", X500DistinguishedNameFlags.None).Format(false) and passing returned value to Find method. – Sickener

Answer 2

https://i.sstatic.net/QtYvV.png

private X509Certificate2 GetCertificateFromStore()
        {
            var store = new X509Store(StoreName.My, StoreLocation.LocalMachine);
            store.Open(OpenFlags.ReadOnly);
            var certCollection = store.Certificates;
            var currentCerts = certCollection.Find(X509FindType.FindBySubjectDistinguishedName, "CN=sf.sandbox.mapshc.com", false);
                return currentCerts.Count == 0 ? null : currentCerts[0];
        }

Trail