Question

I’m trying to develop an ASP.net site that reads the clientCertificate to ensure a smart card was used to access the website (trying to do away with username/password login).

The process I have in my mind is:

1. User registers an account and C# records user’s clientCertificate (public).
2. The user can then log in the next time with that same clientCertificate, and they are now an authenticated user if hash valid.
3. I will use the code below to ensure authenticity of certificate. The browser should deal with private keys and ensure the certificate was NOT faked.
4. Based on Subject+certificate combination, C# assigns them their role-access.

The following code can be used for authenticity of certificate right?

X509Certificate x509Cert = new X509Certificate(Request.ClientCertificate.Certificate);
SHA1 sha = new SHA1CryptoServiceProvider();
byte[] hashvalue = sha.ComputeHash(Request.ClientCertificate.Certificate);
byte[] x509Hash = x509Cert.GetCertHash();
// compare x509Hash WITH hashvalue to ensure they are a match. 
// If not, possibly faked certificate, not a real smartcard???

Is this how SmartCard authentication process should work???

Answer 1

If you just need to authenticate users with client certificates you should do this in IIS. You do not need to add any code at all to your application:

Specify Whether to Use Client Certificates (IIS 7)

Unless you need to link client certificates with database accounts or perform an additional validation step. But still for client certificate authentication I would stick with IIS settings.

Update:
In case you need to manipulate the client certificate you can do:

X509Certificate2 x509Cert2 = new X509Certificate2(Page.Request.ClientCertificate.Certificate);

And then access its properties such as:

x509Cert2.Subject

However, leave the validation piece up to IIS. If the client presents a bad certificate your asp.net code will not even execute since IIS will reject it