title: WebRequest client certificate null on WebAPI side
body: <p>I have a WebApi controller action that I decorated with my <code>[x509Authorize]</code> attribute. I'm debugging this endpoint locally - and at the same time running a console application that tries to call this endpoint.</p>
  
  <p><strong>Client side</strong></p>
  
  <p>Here's the client code - slightly simplified:</p>
  
  <pre><code>X509Certificate Cert = X509Certificate.CreateFromCertFile("C:\\Temp\\ht-android-client.pfx");               
  HttpWebRequest Request = (HttpWebRequest)WebRequest.Create("https://localhost:44300/api/mobile/predict");
  Request.ClientCertificates.Add(Cert);
  HttpWebResponse Response = (HttpWebResponse)Request.GetResponse();
  ....
  </code></pre>
  
  <p>I've asserted that the <code>Cert</code> is the correct certificate. I've installed the <code>.pfx</code> in my <code>CurrentUser\Personal</code> store and in the <code>LocalMachine\Personal</code> store - and modified to take the Cert from that store, as suggested <a href="https://stackoverflow.com/questions/23451024/webrequest-not-sending-client-certificate">here</a> but that doesn't seem to make a difference:</p>
  
  <pre><code>var store = new X509Store(StoreName.My, StoreLocation.LocalMachine);
  store.Open(OpenFlags.OpenExistingOnly | OpenFlags.ReadOnly);
  var Cert = store.Certificates.Find(X509FindType.FindBySubjectName, "Android", true)[0];
  </code></pre>
  
  <p><strong>Server side</strong> </p>
  
  <p>And I'm listening on the WebAPI endpoint like with the following code:</p>
  
  <pre><code>public class x509AuthorizeAttribute : AuthorizeAttribute
  {
      public override Task OnAuthorizationAsync(HttpActionContext actionContext, CancellationToken cancellationToken)
      {
          var cert = actionContext.Request.GetClientCertificate();
         // value of 'cert' is null
  </code></pre>
  
  <p>I hit a breakpoint in the console app first - see that the correct certificate is selected. Then I hit the breakpoint on the server and see that the value of <code>.GetClientCertificate()</code> is <code>null</code>. What am I doing wrong? The other SO questions <a href="https://stackoverflow.com/questions/23451024/webrequest-not-sending-client-certificate">1</a> and <a href="https://stackoverflow.com/questions/22197762/webapi-httpclient-not-sending-client-certificate">2</a> didn't help me any further.</p>
  
  <p><strong>Additional information on the certificates</strong></p>
  
  <p>I've created a self-signed CA certificate which is installed on the <code>LocalMachine\Trusted root CA</code> store. I've created the android client cert - and signed it with my self-signed CA certificate. Then I converted that into a <code>pkcs12</code> file. This is the certificate that the client is using - which is also installed in my personal stores ( both machine and currentUser ) and is valid ( you can see the chain go back to the ROOT CA cert ).</p>
  
  <p>Also - the certificate's purpose is set to clientAuth:
  <a href="https://i.stack.imgur.com/OPwzh.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/OPwzh.png" alt="enter image description here"></a></p>