I want to know whether it is possible to do asp.net client certificate authentication without a private key. My experiment proves that we can.
Here is the scenario.
I have a asp.net web service on server 1 which calls another webservice on server2.
I setup client certificate on server1\localmachinestore\personal store. i also gave permission to private key only for the service account1 that asp.net web service uses on server1. Now when i call asp.net web service on server1 with it using app pool identity as service account1, everything works. Now i change the app pool identity to some other service account2 which does not have private key access and reset the iis and then access the app again on server 1. Surprisingly, the app works fine. I expect an access denied error. That indicates that client cert authentication is possible without access to private key and only access to certificate.
my asp.net code is
//load certs from machine store und ...
Go to the complete details ...