{"id":192,"date":"2013-05-25T08:39:35","date_gmt":"2013-05-25T07:39:35","guid":{"rendered":"http:\/\/oso.com.pl\/?p=192"},"modified":"2013-05-25T09:00:35","modified_gmt":"2013-05-25T08:00:35","slug":"windows-phone-8-these-are-not-the-certificates-you-are-looking-for","status":"publish","type":"post","link":"https:\/\/oso.com.pl\/?p=192&lang=en","title":{"rendered":"Windows Phone 8: these are not the certificates you are looking for"},"content":{"rendered":"

tl;dr Looks like SSL stack on Windows Phone 8 is completely broken.<\/p>\n

We were running some tests of WP8 devices against a server that requires client certificate-based authentication. After issuing a device certificate from our own CA – the device would authenticate against the server. Sometimes it would authenticate using our certificate, but sometimes it would show up with a completely different certificate.<\/p>\n

Here are snippets of the SSL handshake. The interesting part starts when server sends a Certificate Request (click the image for full resolution):<\/p>\n

\"Certificate<\/a><\/p>\n

 <\/p>\n

Our server issues a Certificate Request, with the request for the client to provide a certificate matching the Distinguished Name of our own local CA.<\/p>\n

And here’s the response we see from the client:<\/p>\n

\"\"<\/a><\/p>\n

So what happened here? The client responded with a certificate issued by Microsoft, rather than providing our certificate or failing the authentication.<\/p>\n

The hierarchy of certificate is:<\/p>\n