SslStream Authentication Fails Due to LOCAL SYSTEM Account

Question

I have this code:

string certificateFilePath = @"C:\Users\Administrator\Documents\Certificate.pfx";

string certificateFilePassword = "Some Password Here";

X509Certificate clientCertificate = new X509Certificate(certificateFilePath, certificateFilePassword);

TcpClient client = new TcpClient(host, port);

SslStream stream = new SslStream(client.GetStream(), false, (sender, certificate, chain, errors) => true);

X509CertificateCollection clientCertificates = new X509CertificateCollection {clientCertificate};

stream.AuthenticateAsClient(host, clientCertificates, SslProtocols.Tls, false);

When I run the code in the Console application, everything works fine, stream.IsAuthenticatedand stream.IsMutuallyAuthenticatedreturn trueand stream.LocalCertificatecontains the correct certificate object.

However, when you run the same code in Windows Service (as LOCAL SYSTEM user), although stream.IsAuthenticatedreturns true, stream.IsMutuallyAuthenticatedreturns falseand stream.LocalCertificatereturns null.

This happens in both scenarios, after starting the first line it clientCertificateloads the correct certification data and contains the correct information for the certificate Subjectand Issuer.

I also tried to get SslStream to select a Certificate using this code:

string certificateFilePath = @"C:\Users\Administrator\Documents\Certificate.pfx";

string certificateFilePassword = "Some Password Here";

X509Certificate clientCertificate = new X509Certificate(certificateFilePath, certificateFilePassword);

TcpClient client = new TcpClient(host, port);

SslStream stream = new SslStream(client.GetStream(), false, (sender, certificate, chain, errors) => true, (sender, host, certificates, certificate, issuers) => clientCertificate);

X509CertificateCollection clientCertificates = new X509CertificateCollection {clientCertificate};

stream.AuthenticateAsClient(host, clientCertificates, SslProtocols.Tls, false);

, stream.IsMutuallyAuthenticated false stream.LocalCertificate null.

, . .

Edit: WinHttpCertCfg , , LOCAL SYSTEM , : .

Answer 1

, , X509.

, :

string host = "The Host";

int port = 777;

string certificateFilePath = @"C:\Users\Administrator\Documents\Certificate.pfx";

string certificateFilePassword = "Some Password Here";

X509Certificate clientCertificate = new X509Certificate(certificateFilePath, certificateFilePassword);

X509Certificate2 clientCertificate2 = new X509Certificate2(clientCertificate); //<== Create a X509Certificate2 object from the X509Certificate which was loaded from the file. The clientCertificate2 loads the proper data

TcpClient client = new TcpClient(host, port);

SslStream stream = new SslStream(client.GetStream(), false, (sender, certificate, chain, errors) => true);

X509CertificateCollection clientCertificates = new X509CertificateCollection { clientCertificate2 }; //<== Using the clientCertificate2 which has loaded the proper data instead of the clientCertificate object

stream.AuthenticateAsClient(host, clientCertificates, SslProtocols.Tls, false);

, X509Store, .

. , MSDN, .

Answer 2

, , - PsExec. .

-s .

" ", .

, ,

PsExec.exe -s cmd

WhoAmI

C:\Windows\system32>whoami
nt authority\system

, .

SYSTEM .

, . . Windows . .

, SPN .