SslClientAuthenticationOptions Class
System.Net.Security
Specifies the options that are used for SSL/TLS client authentication. This class provides a comprehensive way to configure the client-side behavior during the SSL/TLS handshake.
Summary
The SslClientAuthenticationOptions class allows developers to customize various aspects of the client's SSL/TLS authentication process, including certificate selection, protocol versions, and cipher suites. It is crucial for establishing secure communication channels with servers.
Properties
| Name | Type | Description |
|---|---|---|
AllowRenegotiation |
bool |
Gets or sets a value that indicates whether renegotiation is allowed. |
ClientCertificates |
System.Collections.Generic.ICollection<System.Security.Cryptography.X509Certificates.X509Certificate2> |
Gets the collection of client certificates that can be used for authentication. |
ClientCertificateUsage |
System.Net.Security.ClientCertificateUsage |
Gets or sets the usage of the client certificate. |
EnabledSslProtocols |
System.Security.Authentication.SslProtocols |
Gets or sets the SSL/TLS protocols that are allowed for the connection. |
EncryptionPolicy |
System.Net.Security.EncryptionPolicy |
Gets or sets the encryption policy for the SSL/TLS connection. |
TargetHost |
string |
Gets or sets the target host name for validating the server's certificate. |
ValidateChain |
bool |
Gets or sets a value that indicates whether the server's certificate chain should be validated. |
RemoteCertificateValidationCallback |
System.Net.Security.RemoteCertificateValidationCallback |
Gets or sets the callback delegate that is used to validate the server's certificate. |
Methods
| Name | Description |
|---|---|
SslClientAuthenticationOptions() |
Initializes a new instance of the SslClientAuthenticationOptions class. |
Remarks
This class is used in conjunction with SslStream to configure how a client initiates an SSL/TLS connection. By setting the properties of SslClientAuthenticationOptions, you can control the security parameters of the connection, ensuring it meets the requirements of the server and your application's security policies.
Key configurations include:
- Specifying which SSL/TLS protocols to support (e.g., TLS 1.2, TLS 1.3).
- Providing client certificates for mutual authentication.
- Defining custom logic for validating the server's certificate using
RemoteCertificateValidationCallback. - Setting the encryption policy to control the level of data encryption.
Example
```csharp
using System;
using System.Net.Security;
using System.Net.Sockets;
using System.Security.Authentication;
using System.Security.Cryptography.X509Certificates;
using System.Threading.Tasks;
public class SslClientExample
{
public static async Task ConnectSecurelyAsync(string host, int port)
{
try
{
using (var tcpClient = new TcpClient())
{
await tcpClient.ConnectAsync(host, port);
using (var sslStream = new SslStream(tcpClient.GetStream(), false,
new RemoteCertificateValidationCallback(ValidateServerCertificate), null))
{
var authOptions = new SslClientAuthenticationOptions
{
TargetHost = host,
EnabledSslProtocols = SslProtocols.Tls12 | SslProtocols.Tls13,
ClientCertificateUsage = ClientCertificateUsage.NoCertificate,
RemoteCertificateValidationCallback = ValidateServerCertificate
};
await sslStream.AuthenticateAsClientAsync(authOptions);
Console.WriteLine($"Successfully connected to {host}:{port} with {sslStream.SslProtocol} and {sslStream.CipherAlgorithm} using {sslStream.HashAlgorithm} with keysize {sslStream.KeyExchangeAlgorithm}.");
// ... proceed with sending and receiving data using sslStream ...
}
}
}
catch (Exception ex)
{
Console.Error.WriteLine($"Error connecting securely: {ex.Message}");
}
}
public static bool ValidateServerCertificate(object sender, X509Certificate? certificate, X509Chain? chain, SslPolicyErrors sslPolicyErrors)
{
if (sslPolicyErrors == SslPolicyErrors.None)
return true;
Console.WriteLine($"Certificate error: {sslPolicyErrors}");
// In a production environment, you would implement more robust validation.
// For example, checking if the certificate is trusted by a known CA,
// checking revocation status, and ensuring the hostname matches.
return false;
}
// Example usage:
// await ConnectSecurelyAsync("www.example.com", 443);
}
```
Requirements
Namespace: System.Net.Security
Assembly: System.Net.Security.dll