Storing and Utilizing X509 Certificates in Microsoft Dynamics CRM 2011 Online or On-Premise

I have been working on a project recently where I have been tasked with making secure web service calls using X509 client certificates. This proved to be a semi-daunting task but we soon got it figured out as a team.

Here is how it works:

1. You must first store the X509 certificates as a web resource in CRM. I made a post on storing files of any type as web resources here. http://mileyja.blogspot.com/2011/04/storing-any-file-type-in-microsoft.html

2. Now you must retrieve the content attribute of the web resource and use it to instantiate an X509 certificate. This example retrieves the needed client certificate, and attaches it to the secure call to a web service that requires client-certificate authentication.

  RetrieveMultipleRequest rmr = new RetrieveMultipleRequest();
                        RetrieveMultipleResponse resp = new RetrieveMultipleResponse();
                        Entity wr = new Entity();

                        QueryExpression query = new QueryExpression()
                        {
                            EntityName = "webresource",
                            ColumnSet = new ColumnSet("content"),
                            Criteria = new FilterExpression
                            {
                                FilterOperator = LogicalOperator.And,
                                Conditions = 
                                {
                                    new ConditionExpression
                                    {
                                        AttributeName = "name",
                                        Operator = ConditionOperator.Equal,
                                        Values = { "new_mywebresourcename" }
                                    }
                                }
                            }
                        };

                        rmr.Query = query;
                        resp = (RetrieveMultipleResponse)service.Execute(rmr);
                        wr = (Entity)resp.EntityCollection.Entities[0];
                        byte[] certbytes = Convert.FromBase64String(wr.Attributes["content"].ToString());

                        X509Certificate2 cert = new X509Certificate2(certbytes, "certpassword");

                        //make call
                        using (WebServiceClient client = new WebServiceClient())
                        {
                            

                            client.Url = @"https://domain.com/mysecurewebservice.asmx";
                            client.ClientCertificates.Add(cert);
                            entity.Attributes.Add("description", client.HelloWorld());

                        }

3. Now let's examine the gotcha that was involved in this scenario.

- You have to use the X509Certificate2 class, not the X509Certificate class when you instantiate the certificate from the returned byte array if you intend to use the call in a sandbox environment.