fiddler capture of azure mgmt service calls using client certificate security
robertob
var cloudServiceName = "CS-NorthCentralUS-scheduler";
var jobCollectionName = "MyJobCollection";
request.Method = "GET";
request.Headers.Add("x-ms-version", "2013-03-01");
request.Accept = "application/xml";
request.ContentType = "application/xml; charset=utf-8";
request.ClientCertificates.Add(managementCertificate);
HttpWebResponse response = null;
try { response = (HttpWebResponse)request.GetResponse(); }
catch (Exception ex) { var message = ex.Message; throw ex; }
x-ms-version: 2013-03-01
Accept: application/xml
Content-Type: application/xml; charset=utf-8
Host: management.core.windows.net
Connection: Keep-Alive
Content-Length: 288
Content-Type: application/xml; charset=utf-8
Server: Microsoft-HTTPAPI/2.0
Date: Mon, 17 Feb 2014 19:18:55 GMT
EricLaw
Excerpted from the Fiddler book:
HTTPS Client Certificates
...
One of the key design goals of Client Certificate authentication is to prevent network intermediaries (like Fiddler) from abusing the client’s credentials. Even if the client application sent its certificate to Fiddler, Fiddler cannot successfully reuse that certificate to respond to the server’s demand, because the client never provides Fiddler with its private key.
To resolve this limitation, you can supply any necessary client certificates and private keys directly for Fiddler to use when handshaking with the server. By default, if a server prompts the client for a certificate, Fiddler will look inside the %USERPROFILE%\Documents\Fiddler2\ folder for a file named ClientCertificate.cer and will use that certificate when responding to the server’s certificate demand.
In some cases, you may want to use a different client certificate for each secure connection. To do so, specify the location of the certificate using the https-Client-Certificate property on the CONNECT tunnel to the secure server. For instance, you can write code like this:
static function OnBeforeRequest(oSession: Session)
{
if (oSession.HTTPMethodIs("CONNECT") {
if (oSession.HostnameIs("exampleA")) {
oSession["https-Client-Certificate"] = "C:\\certs\\CertA.cer";
}
else
if (oSession.HostnameIs("exampleB")) {
oSession["https-Client-Certificate"] = "C:\\test\\CertB.cer";
}
}
//...
A .CER file does not contain the private key associated with the certificate’s public key. Instead, the .CER file merely acts as reference to Windows’ Personal certificates store (certmgr.msc). The Windows certificate store holds the private key associated with the certificate and releases it only as needed. Client certificates stored on a Smartcard will automatically appear within the Personal store when the Smartcard is inserted:
When the Smartcard is inserted, you may export a .CER file from certmgr.msc and use it just like any other client certificate. Note that your Smartcard must remain inserted for Fiddler to use its private key.
If the desired certificate isn't yet installed Windows’ Personal certificates store (e.g. you only have a .pfx file) you must first import it into the certificate store, then export a .CER file. After your certificate is installed, simply right-click the certificate and choose All Tasks > Export…. Save the .CER file to either the default ClientCertificate.cer location or the location you will specify via the https-Client-Certificate flag.
robertob
if (oSession.HostnameIs("management.core.windows.net")) oSession["https-Client-Certificate"] = "d:\\Users\\Shared\\Documents\\Settings\\Sbx\\myAzureSubMgmtCred050414.cer";
//else if (oSession.HostnameIs("some.other.domain.com")) oSession["https-Client-Certificate"] = "%userprofile%\\documents\\fiddler2\ClientCertificate.cer";
}
EricLaw
robertob
robertob
}
X-CLIENT-CERT: CN=Windows Azure Tools Serial#05FCC918CD5BBFAE4F8636F2FFD49D76
robertob
Jack Ma
EricLaw
Jack Ma
if (oSession.HTTPMethodIs("CONNECT")) {
var securedZenithUrl = oSession.uriContains("command") || oSession.uriContains("querypre");
if (!securedZenithUrl) {
oSession["x-no-decrypt"] = "do not care.";
} else {
oSession["https-Client-Certificate"] = "C:\\Users\\jackma\\Desktop\\zenith_migration_work\\svc_client.cer";
////FiddlerObject.log(oSession["https-Client-Certificate"]);
}
}
