How to replace `CertificateHttpClientHandlerModifier` to `X509Certificate2`

Question

I'm using Sitecore 9.2 scaled environment on Azure, and am trying to make a .Net core 2.2 project published on azure app service connects to XConnect which is also on Azure, am following this link from Sitecore documentation.

but this time when I tried this code from this link. To get the certificate from Azure:

X509Store certStore = new X509Store(StoreName.My, StoreLocation.CurrentUser);
certStore.Open(OpenFlags.ReadOnly);
X509Certificate2Collection certCollection = certStore.Certificates.Find(
                        X509FindType.FindByThumbprint,
                        // Replace below with your certificate's thumbprint
                        "E661583E8FABEF4C0BEF694CBC41C28FB81CD870",
                        false);

I found the certificate. but when I tried to connect using this connection string:

var xdbCollectionCert = "StoreName=My;StoreLocation=CurrentUser;FindType=FindByThumbprint;FindValue={thumbprintvalue}";
var xdbClient = "{XConnectName}"
var odataEndpoint = xdbClient + "/odata";
var collectionEndpoint = xdbClient + "/configuration";
var options = CertificateHttpClientHandlerModifierOptions.Parse(xdbCollectionCert);

var certificateModifier = new CertificateHttpClientHandlerModifier(options);

It gives an error that certificate not found, although I added the certificate in TLS and added WEBSITE_LOAD_CERTIFICATES

Sitecore.XConnect.XdbCollectionUnavailableException: The certificate was not found. Store: My, Location: CurrentUser, FindType: FindByThumbprint, FindValue: {thumbprintValue}, InvalidAllowed: False.
at Sitecore.Xdb.Common.Web.CertificateHttpClientHandlerModifier.Process(HttpClientHandler handler)
at Sitecore.Xdb.Common.Web.CommonWebApiClient`1.CreateRequestHandler()

Can someone please advise how can I changeCertificateHttpClientHandlerModifier to X509Certificate2? or why the code can not find the certificate?

Answer 1

Based on the code in CertificateHttpClientHandlerModifier the certificate should have been loaded. However, you can create your own certificate handler by implementing IHttpClientHandlerModifier.

public class CustomHandler : IHttpClientHandlerModifier {
    public void Process(HttpClientHandler handler) {
        X509Certificate cert = LoadYourCertificateHere();
        handler.ClientCertificateOptions = ClientCertificateOption.Manual;
        handler.ClientCertificates.Add(cert);
    }
}

Now you can use your own code to load the certificate in LoadYourCertificateHere() using code you know works. This will also give you better logging/debugging options as everything happens in your own code.