我们应该将服务器的证书放在哪个证书存储中
假设系统S拥有证书C。以下引用表明，如果 S 的 服务应用要使用 C 向客户端验证自身身份，则 C 应存储在 >濒海战斗舰。但是，如果 S 客户端应用程序要使用 C 向服务验证自身身份，则 C 应存储在 CUS< 内/代码>：
• 本地计算机存储(LCS)。 这包含证书 由机器进程访问，例如 ASP.NET。使用此位置来存储 认证的证书 服务器到客户端。
• 当前用户存储(CUS)。交互的 应用程序通常放置 此处为计算机的证书 当前用户。如果您正在创建一个 客户端应用程序，这是您的地方 通常放置证书 对服务的用户进行身份验证。
但下一个引用有点否定了上面的内容，因为它说如果S的服务嵌入在用户帐户下运行的应用程序中，那么证书C应该存储在中>CUS
选择存储证书的位置 取决于服务的方式和时间或 客户端运行。一般如下 适用规则：
• 如果该服务是 Windows 服务， 以“服务器”模式运行的服务 没有任何用户界面 网络服务帐号，使用本地 机器商店。请注意管理员 需要权限才能安装 证书到本地机器 商店。
• 如果服务或客户端是嵌入的 在运行于以下的应用程序中 用户帐户，然后使用当前 用户存储。
a) 服务嵌入到应用程序中是什么意思？是在 Net 中运行的 WCF 服务。控制台应用程序或 Asp.Net 应用程序中是否被视为嵌入？
b) 为什么如果应用程序（嵌入 WCF 服务）在用户帐户下运行（即使该帐户具有管理员权限），证书应该位于 CUS 中？这是否意味着如果它位于 LCS 内，那么 S（又名尝试将此证书发送到服务器的客户端应用程序）将无法找到证书？
谢谢
Assume system S owns a certificate C. The following quote suggests that if C is to be used by S's service apps to authenticate themselves to clients, then C should be stored in LCS. But if C is to be used by S's client apps to authenticate themselves to a service, then C should be stored inside CUS:
• The local computer store (LCS).
This contains the certificates
accessed by machine processes, such as
ASP.NET. Use this location to store
certificates that authenticate the
server to clients.• The current user store (CUS). Interactive
applications typically place
certificates here for the computer's
current user. If you are creating a
client application, this is where you
typically place certificates that
authenticate a user to a service.
But next quote sort of negates the above, since it says if S's service is embedded in an application that runs under a user account, then certificate C should be stored inside CUS
Selecting where to store a certificate
depends how and when the service or
client runs. The following general
rules apply:• If the service is a Windows service,
a service running in "server" mode
without any user interface under a
Network service account, use the local
machine store. Note that administrator
privileges are required to install
certificates into the local machine
store.• If the service or client is embedded
in an application that runs under a
user account, then use the current
user store.
a) what is meant by service being embedded within an application? Is a WCF service running within Net. console application or within Asp.Net application considered to be embedded?
b) And why if app ( which embeds WCF service ) runs under the user account ( even if this account has admin priviliges ), should certificate be located in CUS? Does that mean if it is located within LCS, then S ( aka client app trying to send this certificate to the server ) won't be able to locate certificate?
thank you
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
a) 根据该描述，在 .NET 控制台应用程序中运行的 WCF 服务将被视为“嵌入式”服务。这也称为自托管服务。
如果服务在 ASP.Net 应用程序中运行，则取决于托管 ASP.Net 应用程序的进程，但通常会被视为以“服务器”模式运行的服务。
b) 为了使服务能够向客户端验证自身身份，运行服务进程的用户需要访问与证书对应的私钥。实现此目的的最便捷方法是将证书（带有私钥）安装在运行该进程的用户的证书存储中。
只要安全权限允许，以任意用户身份运行的应用程序就可以访问存储在本地计算机存储中的证书和私钥。
这一切都归结为正在运行的进程的身份以及它是否有权访问与所需证书关联的私钥。
a) A WCF service running within a .NET console application would be considered an "embedded" service according to that description. This is also referred to as a Self-hosted service.
If the service is running within an ASP.Net application, then it depends on what process is hosting the ASP.Net application, but normally that would be considered a service running in "server" mode.
b) In order for a service to authenticate itself to clients, the user under which the service process runs needs access to the private key corresponding to the certificate. The most convenient way to make this happen is to have the certificate (with private key) installed in the certificate store of the user that runs the process.
It is possible for an application running as any arbitrary user to access a certificate and private key stored in the local computer store as long as security permissions on them allow it.
It all boils down to the identity of the running process and whether it has permission to access the private key associated with the desired certificate.