使用通配符证书的 WCF 服务给出 DNS 身份错误
我有一个 WCF Web 服务，设置为使用基于消息的安全性。该服务正在使用通配符证书来保护消息：*.domain.com
续订 SSL 证书后，该服务现在会引发以下错误：
“传出消息的身份检查失败。远程端点的预期 DNS 身份为 '* .domain.com'，但远程端点提供了 DNS 声明“domain.com”...”
如何解决此问题，以便服务仍以 *.domain.com 作为 DNS 声明进行响应？
不幸的是，更新客户端配置并不是通过 DNS 身份属性使用新 DNS 声明的真正选项。
谢谢， 标记
I have a WCF web service that is setup to use Message based security. The service is using a wildcard certificate for securing the message: *.domain.com
After renewing the SSL cert, the service now throws the following error:
"Identity check failed for outgoing message. The expected DNS identity of the remote endpoint was '*.domain.com' but the remote endpoint provided DNS claim 'domain.com'. ..."
How do I fix this so the service still responds with *.domain.com as the DNS claim?
Unfortunately updating the client configs is not really an option to use the new DNS claim via the DNS identity property.
Thanks,
Mark
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
这是 WCF 中的一个错误。如果存在阻塞问题，请访问连接站点并投票。 http://connect.microsoft.com/wcf/feedback/details/683178/wcf-x509-certificate-validation-only-checks-last-dnsname-in-subject-alternative-name
This is an bug in WCF. Visit the connect site and upvote if its a blocking issue. http://connect.microsoft.com/wcf/feedback/details/683178/wcf-x509-certificate-validation-only-checks-last-dnsname-in-subject-alternative-name
结果发现问题出在通配符证书上的 SAN 列表上。域的列出顺序为：
WCF 基本上总是解析到 SAN 列表中的最后一项。我确实偶然发现了几篇 Office Communicator 也有类似问题的文章。我不确定这是否是 WCF 错误。
我的解决方案是要求证书颁发机构为我生成一个不带 SAN 属性的通配符证书。
Turns out the issue was with the SANs list on the Wild Card Cert. The order that the domains were listed were:
WCF was basically always resolving to the last item in the SANs list. I did stumble across a few articles where Office Communicator had a similar issue. I'm not sure if this is a WCF bug or not.
My solution was to ask the Certificate Authority to generate me a wildcard cert without the SANs attribute.
客户端的 dns 设置仅用于验证证书的真实性，因此您只需将客户端的 dns 设置为“domain.com”而不是“service.domain.com”即可。
The dns setting for the client is simply used to verify the certificates authenticity, so you can simply set the dns of the client to "domain.com" instead of "service.domain.com".