title: Sign a SOAP message with a client certificate located on the client's Smartcard via an asp.net web application
body: <p>I am able to retrieve the required certificate and sign the SOAP message within a desktop application running on my local machine just fine. (The process was basically: open my certificate store as the current user,select the correct certificate, enter pin, and the SOAP message was sent and responded to correctly).</p>
  
  <p><strong>Example of desktop application certificate retrieval working:</strong></p>
  
  <pre><code>   X509Store store = new X509Store("MY",StoreLocation.CurrentUser);
                  store.Open(OpenFlags.ReadOnly | OpenFlags.OpenExistingOnly);
                  X509Certificate2Collection collection = (X509Certificate2Collection)store.Certificates;
  </code></pre>
  
  <p>Now we are moving this technology to a new intranet webapp and therefore we want our users to be able to use the same certificate to sign the same SOAP message to allow for data retrieval. </p>
  
  <p>Reading several similar questions it looks as though opening my local certificate store is impossible in a WebApp as the client has no access to the local certificates located within the smart card. So with that I have shifted to forcing the website to require/negotiate SSL. From here I can go to the website and enter my pin and return the correct certificate via: <code>X509Certificate2 cert = new X509Certificate2(HttpContext.Request.ClientCertificate.Certificate);</code></p>
  
  <p>This however returns the error "Could not create SSL/TLS secure channel", the same error I got previously when I did not use the correct <code>SecurityProtocolType</code>option. I also noticed that when the certificate is accessed this way the Boolean <code>HasPrivateKey</code> is false versus being true when the certificate is accessed via the local store on the desktop application.</p>
  
  <p>My questions are: </p>
  
  <p>1) Is requiring the WebApp to negotiate Ssl and accessing the certificate via <code>Request.ClientCertificate.Certificate</code> (versus opening a certificate store in a particular fashion) the correct path to sign a SOAP message with a certificate?</p>
  
  <p>2) I've saw several articles reference creating an ActiveX control to do this, if this is the correct way to accomplish the task where could I find some tutorials/resources on how to do this?</p>
  
  <p><strong>Actual Problem Clarification:</strong> Retrieving the personal certificate I need after forcing the web application to negotiate SSL via <code>X509Certificate2 cert = new X509Certificate2(HttpContext.Request.ClientCertificate.Certificate);</code> has <code>HasPrivateKey</code>set to false and I'm pretty sure this is why I'm getting the error message "Could not create SSL/TLS secure channel" when trying to sign my SOAP message and retrieve a SAML token.</p>
  
  <p><strong>Web Server Information:</strong>
  IIS 7.0, SSL required, windows authentication.</p>
  
  <p><strong>Client PC information:</strong>  The smart card software installed on the clients machine is ActivClient.</p>
  
  <p><strong>Misc:</strong> 
  I am currently using SecurityProtocolType.Tls12.</p>