3

I'm using Sitecore 9.2 scaled environment on Azure, and am trying to make a .Net core 2.2 project published on azure app service connects to XConnect which is also on Azure, am following this link from Sitecore documentation.

but this time when I tried this code from this link. To get the certificate from Azure:

X509Store certStore = new X509Store(StoreName.My, StoreLocation.CurrentUser);
certStore.Open(OpenFlags.ReadOnly);
X509Certificate2Collection certCollection = certStore.Certificates.Find(
                        X509FindType.FindByThumbprint,
                        // Replace below with your certificate's thumbprint
                        "E661583E8FABEF4C0BEF694CBC41C28FB81CD870",
                        false);

I found the certificate. but when I tried to connect using this connection string:

var xdbCollectionCert = "StoreName=My;StoreLocation=CurrentUser;FindType=FindByThumbprint;FindValue={thumbprintvalue}";
var xdbClient = "{XConnectName}"
var odataEndpoint = xdbClient + "/odata";
var collectionEndpoint = xdbClient + "/configuration";
var options = CertificateHttpClientHandlerModifierOptions.Parse(xdbCollectionCert);

var certificateModifier = new CertificateHttpClientHandlerModifier(options);

It gives an error that certificate not found, although I added the certificate in TLS and added WEBSITE_LOAD_CERTIFICATES

Sitecore.XConnect.XdbCollectionUnavailableException: The certificate was not found. Store: My, Location: CurrentUser, FindType: FindByThumbprint, FindValue: {thumbprintValue}, InvalidAllowed: False.
at Sitecore.Xdb.Common.Web.CertificateHttpClientHandlerModifier.Process(HttpClientHandler handler)
at Sitecore.Xdb.Common.Web.CommonWebApiClient`1.CreateRequestHandler()

Can someone please advise how can I changeCertificateHttpClientHandlerModifier to X509Certificate2? or why the code can not find the certificate?

  • Looks like code is unable to find a cert in the current user's personal store. Can you update StoreName from My to Root in your xdbCollectionCert connectionString and check? – Surya Nov 29 '19 at 10:34
  • @Surya I tried all possible combination between StoreName and StoreLocation, but it gives the same error "The certificate is not found". I can't figure out why it can't find the certificate even I added the public key certificate – Fatema elsayed Nov 29 '19 at 18:55
  • @Fatemaelsayed I've looked a bit at the source code and I can't find any CertificateWebRequestHandlerModifier, but I can find a CertificateHttpClientHandlerModifier, and that one basically ends up fetching the certificate the same way you have successfully done (from what I've seen in the source). What happens if you use CertificateHttpClientHandlerModifier instead? – GTHvidsten Nov 29 '19 at 21:05
  • @GTHvidsten Its my mistake am already using CertificateHttpClientHandlerModifierOptions I edited the question, but do you have any idea why the code can not find the certificate? – Fatema elsayed Nov 30 '19 at 11:26
  • 1
    Looking at the code I can see that CertificateHttpClientHandlerModifier inherints from IHttpClientHandlerModifier. Maybe you could try to create your own implementation of this interface, get the certificate in the Process() method using the code you know works, then set the certificate to the handler provider as input to this method: handler.ClientCertificateOptions = ClientCertificateOption.Manual; handler.ClientCertificates.Add(yourCertificate);. – GTHvidsten Nov 30 '19 at 13:07
2

Based on the code in CertificateHttpClientHandlerModifier the certificate should have been loaded. However, you can create your own certificate handler by implementing IHttpClientHandlerModifier.

public class CustomHandler : IHttpClientHandlerModifier {
    public void Process(HttpClientHandler handler) {
        X509Certificate cert = LoadYourCertificateHere();
        handler.ClientCertificateOptions = ClientCertificateOption.Manual;
        handler.ClientCertificates.Add(cert);
    }
}

Now you can use your own code to load the certificate in LoadYourCertificateHere() using code you know works. This will also give you better logging/debugging options as everything happens in your own code.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.