System.Net.Security Namespace

Example

The following C# code snippet demonstrates how to use CertificateSupplyContext to programmatically select a client certificate for an SSL connection.

using System;
using System.Net.Security;
using System.Security.Cryptography.X509Certificates;
using System.Threading.Tasks;

public class CertificateSelector
{
    public async Task ConnectWithClientCertificateAsync(string host, int port)
    {
        // Assume clientCertificates is populated with X.509 certificates
        X509Certificate2Collection clientCertificates = GetClientCertificates(); 

        var options = new SslClientAuthenticationOptions
        {
            TargetHost = host,
            ClientCertificates = clientCertificates,
            CertificateSelectionCallback = (sender, targetHost, localCertificates, remoteCertificate, acceptableIssuers) =>
            {
                // Use CertificateSupplyContext to help select the best certificate
                var context = new CertificateSupplyContext(localCertificates, targetHost);
                
                // You can add custom logic here to pick a certificate based on needs
                // For simplicity, let's try to get a certificate by usage
                var cert = context.GetCertificateByUsage(X509KeyUsageFlags.DataEncipherment);

                if (cert == null)
                {
                    // Fallback to the first available certificate if none match usage
                    cert = localCertificates.FirstOrDefault();
                }
                return cert;
            }
        };

        using (var tcpClient = new System.Net.Sockets.TcpClient())
        {
            await tcpClient.ConnectAsync(host, port);
            using (var sslStream = new SslStream(tcpClient.GetStream(), false))
            {
                await sslStream.AuthenticateAsClientAsync(options);
                Console.WriteLine("SSL connection established with client certificate.");
                // ... perform secure communication ...
            }
        }
    }

    private X509Certificate2Collection GetClientCertificates()
    {
        // In a real application, you would load certificates from a store or file
        // For demonstration purposes, returning an empty collection
        return new X509Certificate2Collection(); 
    }
}