Используя клиентский сертификат не в хранилище сертификатов

Потенциальная проблема может заключаться в кэшировании сеансов SSL (кэш Schannel). Только первый запрос согласовывает рукопожатие SSL. Последующие запросы будут использовать тот же идентификатор сеанса и надеяться, что сервер его примет. Если сервер очищает SessionId, запросы завершатся ошибкой 403. Чтобы отключить кеширование локального ssl-сеанса (и принудительно согласовать SSL для каждого запроса), вам необходимо открыть папку реестра Windows:

[HKEY_LOCAL_MACHINE] [System] [CurrentControlSet] [Control] [SecurityProviders] [SCHANNEL]

и добавьте ключ с именем ClientCacheTime (DWORD) со значением 0.

Эта проблема описана здесь:

http : //support.microsoft.com/? id = 247658

Вам нужен пароль для сертификата? Если да, то в конструкторе есть поле для него.

X509Certificate cert = new X509Certificate(PathToCertificate,YourPassword);

You have the potential for at least two problems...

First...

Your client certificate file cannot contain a private key unless it's accessed with a password. You should be using a PKCS #12 (*.pfx) certificate with a password so that your client has access to the private key. You client code will have to provide the password when opening the certificate as others have already posted. There are several ways to create this, the easiest is to use the following command-line to first generate the certificate, then use the MMC certificate manager to export the certificates private key:

Process p = Process.Start(
    "makecert.exe",
    String.Join(" ", new string[] {
        "-r",//                     Create a self signed certificate
        "-pe",//                    Mark generated private key as exportable
        "-n", "CN=" + myHostName,// Certificate subject X500 name (eg: CN=Fred Dews)
        "-b", "01/01/2000",//       Start of the validity period; default to now.
        "-e", "01/01/2036",//       End of validity period; defaults to 2039
        "-eku",//                   Comma separated enhanced key usage OIDs
        "1.3.6.1.5.5.7.3.1," +//    Server Authentication (1.3.6.1.5.5.7.3.1)
        "1.3.6.1.5.5.7.3.2", //     Client Authentication (1.3.6.1.5.5.7.3.2)
        "-ss", "my",//              Subject's certificate store name that stores the output certificate
        "-sr", "LocalMachine",//    Subject's certificate store location.
        "-sky", "exchange",//       Subject key type <signature|exchange|<integer>>.
        "-sp",//                    Subject's CryptoAPI provider's name
        "Microsoft RSA SChannel Cryptographic Provider",
        "-sy", "12",//              Subject's CryptoAPI provider's type
        myHostName + ".cer"//       [outputCertificateFile]
    })
);

Second...

Your next problem is going to be server-side. The server has to allow this certificate. You have the right logic, but on the wrong side of the wire, move this line to the web server handling the request. If you cannot, you must then take the '.cer' file saved above to the server and add it to the server computer's trust list:

ServicePointManager.ServerCertificateValidationCallback = (a,b,c,d) => true;