how elevate the service?

[giesalabs]

Hello,

thanks for the nice project,
i'm trying to integrate on a c# project service without success on https
well the http works, but i have problem like some other guy with the certificate on https (the problem is only on DecryptSsl = true)

i know that i have to execute the service as administrator to install the certificate
and i tested to register the service as LocalSystem that shoud be like root on unix system (i tested the LocalService, too)
but the problem with the certificate is still here
i also try to manual register the pfx certificate by certutil.exe -f -importpfx "--the pfx path---" as administrator without success

so o think that i miss the right way to elevate the service as admin user, can you tell me the right way to elevate a service?

thanks for discussion and the project

p.s. witth ssl decode = false also the https "works", but will never called (on https) the OnBeforeResponse Task so i think that ssl deocde should be = true, but in this case Firefox gove back SEC_ERROR_BAD_SIGNATURE so i think to don't have the certificate installed

[giesalabs]

well, after some random command and reboot OnBeforeResponse works
but i don't know what command fixed it

this (to add the certificate):
certutil.exe -f -importpfx "--the pfx path---" as administrator
or this (to change the service role):
sc config YourServiceNameHere obj= "LocalSystem"

any idea?

[justcoding121]

You usually don't need to elevate the running service. Install/trust the root once (as admin), then the service can just load that same cert.

For a Windows service:

// one-time setup (run elevated / installer), then persist the pfx
proxyServer.CertificateManager.CertificateEngine = CertificateEngine.BouncyCastle;
proxyServer.CertificateManager.CreateRootCertificate(true);
proxyServer.CertificateManager.TrustRootCertificateAsAdmin(); // Local Machine store

Then on service start, just load it (don't recreate every time):

proxyServer.CertificateManager.RootCertificate =
    proxyServer.CertificateManager.LoadRootCertificate();

Notes that match your symptoms:

• LocalSystem is fine; the important part is the root living in Local Machine\Trusted Root, not only Current User.
• Firefox has its own cert store ? import the root into Firefox separately or you'll get SEC_ERROR_BAD_SIGNATURE.
• DecryptSsl = false skips HTTPS inspection, so BeforeResponse won't see decrypted HTTPS (expected).

Closing ? your reboot likely picked up the machine-store trust. Reopen if Firefox still complains after importing the root there.