You can sign outgoing REST or SOAP requests with a client certificate by providing its thumbprint in the ViewModel that makes the request; this is for MDriven developers integrating with services that require client-certificate authentication.

How client-certificate signing works

MDriven locates the certificate by its thumbprint in the current user's personal certificate store:

X509Store(StoreName.My, StoreLocation.CurrentUser)

To select the certificate, add a root-level ViewModel column with the exact name ClientCertThumbPrint. The name is case-sensitive. Set that column to the thumbprint of the certificate that the service should use.

This applies when the ViewModel uses restGet, restPost, or SoapCall. For the general structure of outgoing REST requests and request headers, see Documentation:OCLOperators RestPost.

Configure the ViewModel

1. Open the ViewModel that performs the outgoing call.
2. Add a column on the root ViewModel class.
3. Set the column name to ClientCertThumbPrint. Keep this exact spelling and casing.
4. Set the column type to string.
5. Assign the certificate thumbprint to the column before executing restGet, restPost, or SoapCall.

For example, if the certificate dialog shows this thumbprint:

78 3f f5 92 55 c3 7d 1d 6b 68 fd b4 a7 a5 cc e7 5f 26 ee 78

set ClientCertThumbPrint to the same value without spaces:

783ff59255c37d1d6b68fdb4a7a5cce75f26ee78

The column must be on the root ViewModel class, not on a nesting used for request content or headers.

Install the certificate where the service runs

The certificate must be available to the account that runs the service, because MDriven searches StoreName.My in StoreLocation.CurrentUser.

Deployment	What you must do
On-premises server	Install the certificate on every server machine that needs to send the signed request. Add it for the user that runs the service.
Azure	Upload the certificate and create the required app setting as described in Using Certificates in Azure Websites Applications. Ensure that the certificate is available to the user running the service.

If an integration works on one server but not another, verify the certificate installation and the running-service user on each server. For certificate installation and file-format guidance, see Documentation:Certificate.

Avoid thumbprint lookup failures

Certificate dialogs can copy an invisible Unicode character together with the displayed thumbprint. That hidden character causes the lookup to miss an otherwise correctly installed certificate.

Use this process when you copy a thumbprint from a certificate dialog:

1. Paste the thumbprint into Notepad.
2. Save the file as ANSI.
3. Close and reopen the file.
4. Remove the erroneous character that is now visible, if present.
5. Remove all spaces.
6. Copy the cleaned, space-free value into ClientCertThumbPrint.

Do not assume that a value which looks correct is clean. A thumbprint with spaces or an invisible copied character will not match the certificate-store entry.

Troubleshooting

Symptom	Check
The certificate is not found	Confirm that ClientCertThumbPrint is a root ViewModel string column, that its spelling and casing are exact, and that the value contains no spaces or hidden characters.
The certificate is found on one server but not another	Install the certificate for the user running the service on every server that sends the request.
The application runs in Azure and cannot find the certificate	Confirm that the certificate was uploaded and that the required Azure app setting was created. Follow the linked Azure guidance.
You are diagnosing a certificate error involving IIS or the application's own URL	Check that the URL and MDrivenServer match the certificate, as described in Documentation:Fault-finding certificate problems in IIS.

See also

• Documentation:OCLOperators RestPost
• Documentation:Rest API
• Documentation:Certificate
• Documentation:Fault-finding certificate problems in IIS
• Documentation:Log in with code