Блог

Я пытаюсь настроить 2-сторонний SSL. Я получаю

 'Client certificate is required.  No certificate was found in the request.  This might be because the client certificate could not be successfully validated by the operating system or IIS.  For information on how to bypass those validations and use a custom X509CertificateValidator in WCF please see http://go.microsoft.com/fwlink/?LinkId=208540.'
 

в журнале трассировки WCF.

В клиентском приложении я получаю сообщение об ошибке
«HTTP-запрос был запрещен с помощью схемы аутентификации клиента ‘Anonymous'».

WCF размещается в IIS и использует подстановочный сертификат ‘*.mySite.com ‘

Мой WCF web.config:

 <serviceBehaviors>
        <behavior name="MySslServiceBehavior">

          <serviceMetadata httpsGetEnabled="true" />
          <dataContractSerializer maxItemsInObjectGraph="16777216" />
          <serviceDebug includeExceptionDetailInFaults="true" />

            <serviceCredentials>
            <userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="Wcfproject.Util.MyServiceAuthorizationManager, MyProjectName"/>
            <serviceCertificate findValue="*.mySite.com" 
                                x509FindType="FindBySubjectName"
                                storeLocation="LocalMachine" storeName="Root"
                                />
            <clientCertificate>
              <authentication certificateValidationMode="PeerTrust"/>
            </clientCertificate>            
          </serviceCredentials>

        </behavior>
</serviceBehaviors>
<bindings>
    <basicHttpBinding>          

            <binding name="2WaySecureBinding">
              <security mode="Transport">
                <transport clientCredentialType="Certificate"></transport>          
              </security>
            </binding>

    </basicHttpBinding>
</bindings>     

<services>

      <service behaviorConfiguration="MySslServiceBehavior" name="MyServiceName">             
        <!--2 way SSL-->
        <endpoint bindingNamespace="http://myNamespace/V1" binding="basicHttpBinding" bindingConfiguration="2WaySecureBinding" name="httpsBinding" contract="MyServiceName"/>   

      </service>
 </services>
 

Конфигурация моего клиента:

 <client>
  <endpoint address="https://2wayWcfProject.mySite.com/MyServiceName.svc" binding="customBinding"
        bindingConfiguration="httpsBinding" contract="MyServiceReference.MyServiceName" behaviorConfiguration="CustomBehavior"
        name="httpsBinding" />
</client>

<behaviors>
  <endpointBehaviors>
    <behavior name="CustomBehavior">
        <clientCredentials>
          <clientCertificate findValue="*.ClientSite.com" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="Root" />
        </clientCredentials>
      </behavior>
  </endpointBehaviors>
</behaviors>


 <bindings>     
  <customBinding>
    <binding name="httpsBinding">
      <security defaultAlgorithmSuite="Default" authenticationMode="UserNameOverTransport"
          requireDerivedKeys="true" includeTimestamp="true" messageSecurityVersion="WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10">
        <localClientSettings detectReplays="false" />
        <localServiceSettings detectReplays="false" />
      </security>
      <textMessageEncoding messageVersion="Soap11" />
      <httpsTransport />
    </binding>
  </customBinding>

</bindings>
 

Я экспортировал сертификат клиентского сайта ‘*.ClientSite.com ‘ как .pfx и добавил / импортировал его в доверенные сертификаты на сервере (mmc.exe ) -> Сертификаты (локальный компьютер) в разделе «Личные» и «Доверенные корневые центры сертификации».