HttpWebRequest 是否通过互联网发送证书的私钥？

Question

我想知道在 HttpWebRequest 的 header 部分添加带有私钥的证书是否会将私钥暴露给 public？如下所示添加带有私钥的证书是否安全？

public class WebClientHandler : WebClient
{
    X509Certificate2 clientCertifiacte;

    public WebClientHandler(X509Certificate2 clientCertifiacte)
    {
        this.clientCertifiacte= clientCertifiacte;
    }

    protected override WebRequest GetWebRequest(Uri address)
    {
        HttpWebRequest request = (HttpWebRequest)base.GetWebRequest(address);
        request.ClientCertificates.Add(clientCertifiacte);
        return request;
    }
}

Answer 1

adding the certificate with private key in header section of the HttpWebRequest will expose the private key to the public or not ?

不，不会。客户端身份验证期间将使用私钥 challenge/handshake。密钥本身不在任何地方 sent/exposed。

Is it safe to add certificate with private key as shown below ?

你必须这样做。没有私钥的证书不能用于身份验证，因为基于证书的身份验证需要数据签名，没有私钥是不可能的。

HttpWebRequest 是否通过互联网发送证书的私钥？

does HttpWebRequest send certificate's Private Key over internet?

c#

httpwebrequest

webclient

x509certificate2