Solved

Ignoring client certificate using ServerXMLHTTP (VB6)

Posted on 2014-01-27
5
3,478 Views
Last Modified: 2014-03-19
Any idea how I can force the ServerXMLHTTP to ignore requests for a client-certificate and fail-over to the Basic Authorization credentials provided?

I am trying to achieve this in Visual Basic 6 and ASP Classic.

Code so far:
Set XMLHTTP = CreateObject("MSXML2.ServerXMLHTTP.6.0")
Call XMLHTTP.Open("GET", "https://server/path", False)
XMLHTTP.setRequestHeader "Authorization", "BASIC authhere=="
XMLHTTP.Send

Result so far:
msxml3.dll error '80072f0c'
A certificate is required to complete client authentication
0
Comment
Question by:syswin2
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 15

Expert Comment

by:pateljitu
ID: 39815238
Try code as provided below (you would still require Client certificate to be installed on the server making this call) :

Const SXH_SERVER_CERT_IGNORE_UNKNOWN_CA = 256
Const SXH_SERVER_CERT_IGNORE_WRONG_USAGE = 512
Const SXH_SERVER_CERT_IGNORE_CERT_CN_INVALID = 4096
Const SXH_SERVER_CERT_IGNORE_CERT_DATE_INVALID = 8192
Const SXH_SERVER_CERT_IGNORE_ALL_SERVER_ERRORS = 13056

Set XMLHTTP = CreateObject("MSXML2.ServerXMLHTTP.6.0")
XMLHTTP.SetOption(2, XMLHTTP.GetOption(2) - SXH_SERVER_CERT_IGNORE_ALL_SERVER_ERRORS)
XMLHTTP.Open("GET", "https://server/path", False)
XMLHTTP.setRequestHeader "Authorization", "BASIC authhere=="
XMLHTTP.Send

Open in new window


setOption:
http://msdn.microsoft.com/en-us/library/windows/desktop/ms763811%28v=vs.85%29.aspx

getOption:
http://msdn.microsoft.com/en-us/library/windows/desktop/ms753798%28v=vs.85%29.aspx
0
 
LVL 35

Accepted Solution

by:
mccarl earned 500 total points
ID: 39816678
Unfortunately, you have no way of controlling this from the client side. If the server is configured to require certificates, than there is nothing that the client can do about it.

Do you have control over the server that you are connecting to? If so, you need to look at the servers config to see if you can disable the requirement for client certificates.
0
 

Author Closing Comment

by:syswin2
ID: 39863152
Hi mccarl,

Thanks for the information, I had no control over the server so I ended up getting my VB6/ASP script to talk via SOAP to a PHP script which then talked to the target server using cUrl which had an option to ignore server certificates.

A bit round the houses but it works.

Thanks,
Peter
0
 
LVL 35

Expert Comment

by:mccarl
ID: 39863559
I'm glad that you got it working! :)

However, I'm still a little perplexed...
using cUrl which had an option to ignore server certificates.
There should be no way that ANY client (ServerXMLHTTP, cURL or any other) can bypass client authentication.

What option did you use with cURL that made this work?
0
 

Author Comment

by:syswin2
ID: 39940534
We ended up using cUrl option "CURLOPT_SSL_VERIFYPEER" = False which caused it to fall-back to basic authentication (over SSL).
0

Featured Post

Revamp Your Training Process

Drastically shorten your training time with WalkMe's advanced online training solution that Guides your trainees to action.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
age from date of birth 4 58
Select case on click 3 26
Powerpoint 2013: Change cell reference in excel link 3 122
IIS components 2 36
Online collaboration is quickly becoming embedded in the workplace, and its benefits are tangible. See what the current landscape looks like and what the future holds for collaboration tools and the future of work.
Since upgrading to Office 2013 or higher installing the Smart Indenter addin will fail. This article will explain how to install it so it will work regardless of the Office version installed.
Get people started with the process of using Access VBA to control Outlook using automation, Microsoft Access can control other applications. An example is the ability to programmatically talk to Microsoft Outlook. Using automation, an Access applic…
This lesson covers basic error handling code in Microsoft Excel using VBA. This is the first lesson in a 3-part series that uses code to loop through an Excel spreadsheet in VBA and then fix errors, taking advantage of error handling code. This l…

730 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question