SSLStream example – how do I get certificates that work?

You can get the example to work even with self-signed certificates. I’ve extracted the commands from the makecert tutorial that you’re using with minor modifications:

makecert -sv RootCATest.pvk -r -n "CN=FakeServerName" RootCATest.cer
makecert -ic RootCATest.cer -iv RootCATest.pvk -n "CN=FakeServerName" -sv  TempCert.pvk -pe -sky exchange TempCert.cer
cert2spc TempCert.cer TempCert.spc
pvkimprt -pfx TempCert.spc TempCert.pvk

makecert and cert2psc can be found in your Microsoft SDKs\Window\v7.0A\Bin folder.
The pvkImport.exe installer can be downloaded here (Provided by @Jospeph and VirusTotal verified). This used to be downloadable from the Microsoft Site, but they have since taken it down. Alternatively, @Dweeberly pointed us to a new Microsoft-provided replacement, pvk2pfx.

For this next step make sure that you select to EXPORT the private key when the dialog from pvkimprt comes up:

pvkimprt -pfx TempCert.spc TempCert.pvk

pvkimprt will prompt you for a password when you elect to include the private key. You will need to provide this password later when you import the generated .pfx file into the personal store of your server machine

Next, import RootCATest.cer into your Computer store’s Trusted Root Certification Authorities (on both the server and client). Notice that the certificate is issued to FakeServerName. This must match the server name that the SslTcpClient expects: sslStream.AuthenticateAsClient(serverName), where serverName is the value of the second argument passed to SslTcpClient.exe.

When your client connects, the server presents a certificate that tells the client “I’m FakeServerName”. The client will accept this claim if the client machine trusts the CA that issued the certificate, which is achieved by importing RootCATest.cer into the client’s Trusted Root Certification Authorities.

Finally, you need to import the private key that the server is going to use into the server machine’s Personal store. This step is important because it addresses The server mode SSL must use a certificate with the associated private key.. This is achieved by importing the .pfx file that you generated earlier. Make sure that you change the file type filter to “all files” so that you can see the .pfx file that you generated:

The sample code provided by MSDN uses port 443 (which is the standard ssl port). Since I created console applications, I changed the port used by the sample classes to 8080:

SslTcpServer:

TcpListener listener = new TcpListener(IPAddress.Any, 8080);

SslTcpClient:

TcpClient client = new TcpClient(machineName, 8080);

Here’s the output:

you would launch your server like this:

SslTcpServer.exe TempCert.cer 

from the client, you would connect like this:

SslTcpClient.exe <ip to your server> FakeServerName

generate your certificate using this command:

makecert -r -pe -n "CN=localhost" -m 12 -sky CertSubject -ss my serverCert.cer

and then from client connect to the server like this (assuming we are using MSDN example you mentioned):

SslTcpClient.RunClient ("localhost", "CertSubject");

you will get validation errors in ValidateServerCertificate() call – but that’s expected – you are using self-signed certificate. Just return true there.

UPDATE:

I disagree with Tung’s suggestion of adding self-signed certificate into the client’s Trusted Root Certification Authorities. I think it can cause issues later on if you plan to distribute/support your software. For example, client might reinstall windows, or move his profile to another PC, or whatever – and understanding WHY your software suddenly stopped working will be a pain (again, i’m talking long-term – a year or two from now, when you completely forget this little “trick”).

Instead i would rather suggest to “hardcode” your certificate (by comparing subject and thumbprint) into client’s logic, something like this:

X509Certificate2 certificate = (X509Certificate2)cert;
if (certificate.Subject.StartsWith("CN=FAKE_SERVER_WHATEVER") &&
    !string.IsNullOrEmpty(certificate.Thumbprint) &&
    certificate.Thumbprint.ToLower() == "11c4446c572a9918ced3618728b91b3a07982787")
{
     return true;
}
return false;