从 WCF 服务访问客户端证书属性
我正在编写一个 WCF 服务，我需要访问用于连接到该服务的客户端证书的哈希代码。
我正在寻找类似于 ASP.NET 2.0 时代的 Request.ClientCertificate 的属性或方法，但找不到任何可以轻松访问客户端证书的内容。
我们的服务设置为使用 basicHttpBinding 和“传输”安全模式通过 SSL 运行。
IIS 已设置为需要 SSL 并接受证书。
需要注意的一件事是，我们用于保护端点的服务器证书来自与客户端证书不同的 CA - 客户端证书旨在仅通过自定义代码进行验证（因此需要获取连接的哈希代码）证书）。
我创建了 IDispatchMessageInspector 的自定义实现，以查看是否可以从那里访问客户端证书，但无济于事。
有没有人尝试过这个并且之前取得过成功？
I am writing a WCF service where I need to access the Hash Code of client certificates that are used to connect to the service.
I am looking for a property or method similar to Request.ClientCertificate from ASP.NET 2.0 days but cannot find anything that allows easy access to the client certificate.
Our service is set up such that it is running with SSL using basicHttpBinding and security mode of "Transport".
IIS has been set up to Require SSL and Accept certificates.
One thing to note is that our server certificate used to secure the endpoint is from a different CA to that of the client certificates - the client certificates are intended to be validated solely through custom code (thus the need to get the hash code of a connecting certificate).
I have created a custom implementation of the IDispatchMessageInspector to see if there is any access to a client certificate from there but to no avail.
Has anyone attempted this and had success before?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
看起来您最好的选择是为您的服务实现自定义证书验证器。这基本上是一个派生自 X509CertificateValidator 的类然后通过配置文件注册。
本文提供了有关如何执行此操作的更完整信息。
Looks like what the best option for you would be to implement a custom Certificate Validator for your service. This is basically a class that derives from X509CertificateValidator and is then registered through the config file.
There's more complete information on how to do this on this article.
作为参考，如果其他人尝试应用客户端证书身份验证，则需要执行以下步骤才能使其正常工作（我们在此实例中使用 WCF 中的 basicHttpBinding 并在 IIS 的本地实例中运行）：
确保根证书（用于创建任何客户端证书的证书）位于运行 IIS 的本地计算机的“受信任的根证书颁发机构”内。
注意如果您处于开发环境中，您可能需要生成自己的根证书，makecert 命令行应用程序对此非常有用；只需运行以下命令：
makecert -n "CN=My Test Auth" -r -cy Authority -a sha1 -sv "My Private Key.pvk" TestAuth.cer
这将创建一个名为 TestAuth.cer 的证书（需要将其添加到计算机的“受信任的根”中）认证机构”）和一个名为“My Private Key.pvk”的私钥文件。
现在要生成客户端证书，您可以运行以下命令：
makecert -a sha1 -n "CN=myConnectionCert" -ic "TestAuth.cer" -iv "My Private Key.pvk" -ss My
这创建了一个主题为 myConnectionCert 的证书，并将其添加到您的个人证书存储中 - 当您现在访问该站点（例如查看服务页面） IE 应该提示您选择证书 - 选择您刚刚创建的证书，您应该可以正常看到服务页面。
For reference if anyone else attempts to apply client certificate authentication the following steps were required to get it to work (we are using basicHttpBinding within WCF for this instance and running in a local instance of IIS):
Ensure that the root certificate (the one used to create any client certificates) is within the "Trusted Root Cerrtification Authorities" for the Local Computer on which IIS is running.
NOTE If you are in a development environment you may need to generate your own root certificate, the makecert command line application is very useful for this; simply run the following command:
makecert -n "CN=My Test Auth" -r -cy authority -a sha1 -sv "My Private Key.pvk" TestAuth.cer
This creates a certificate called TestAuth.cer (which needs to be added to the Computer's "Trusted Root Cerrtification Authorities") and a private key file called "My Private Key.pvk".
Now to generate a client certificate you can run this command:
makecert -a sha1 -n "CN=myConnectionCert" -ic "TestAuth.cer" -iv "My Private Key.pvk" -ss My
This created a certificate with a subject of myConnectionCert and adds it to your personal certificate store - when you now access the site (to view the service page for example) IE should prompt you to select the certificate - chose the one you have just created and you should see the service page as normal.