使用传输安全时，WCF 是否需要 SSL？
好吧，我的 WCF 配置可能已经太过分了，无法透过树木看到森林，所以我想检查安全性。
我在 WCF 服务中公开了 (2) 个绑定，供客户端使用的选项：netTcpBinding 和 wsHttpBinding（都很好并且可以工作）。我都配置了默认值：clientCredentialType="Windows"。我将 wsHttpBinding 配置为使用 SSL 证书并通过 https 公开端点（我想要这个），并且还为 netTcpBinding 配置了 SSL 证书以使用 TCP 上的 SSL（我也想要这个）。
这是我不断获得混合信息的地方。显然“传输”安全本质上是安全的。这是否意味着如果我想保护传输层，我不需要需要 SSL 证书？
OK I am probably getting too far in the weeds with my WCF configuration and can't see the forest through the trees, so I want to checkpoint on security.
I have (2) bindings exposed in a WCF service for options on the client side consuming: netTcpBinding and wsHttpBinding (both fine and working). I have both configured with the default: clientCredentialType="Windows". I have the wsHttpBinding configured to use a SSL certificate and expose the endpoint via https (I want this), and also have an SSL cert configured for the netTcpBinding to use SSL over TCP (I want this too).
Here is where I keep getting mixed information. Apparently "Transport" security is inheriently secure. Does this mean I do not need a SSL cert then if I want to secure the Transport layer?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我必须在多篇文章之间进行大量阅读，才能从原始帖子中获取我想要的详细信息。帮助我理清思路的信息如下：
每个协议（TCP、HTTP、MSMQ、NamedPipes）都有自己的机制来传递凭据和处理消息保护。
以上内容来自WCFSecurityGuide
主要来自 Web 背景，我对 HTTP 有很好的理解并使用它来保护它一个SSL 证书。然而，在 Windows 环境中 net.tcp 不需要这个确切的过程，它在 Windows 中使用自己的方法来保护传输层。
因此，归根结底，以下是我想了解的有关在 Windows 环境中保护 HTTP 绑定和 net.tcp 安全的 (2) 说明：
对于 net.tcp： 服务和客户端使用 Windows 身份验证进行身份验证，消息在传输级别由 Windows 安全性保护
对于 HTTP 绑定（即 wsHttpBinding）： 当使用 HTTP 绑定时，运输安全由SSL。 SSL 证书用于提供消息保护。
因此，我不需要用于 net.tcp 绑定的 SSL 证书，因为该证书由 Windows 安全性处理，并且在使用传输时本质上是安全的安全。使用 wsHttpBinding 时，我仍然需要使用 SSL 证书来保护传输，正如前面提到的那样，并通过 HTTPS 公开绑定。
如果未来的读者有类似的问题，我发布的 WCF 指南链接和下面的链接是一个很好的起点：
常见 WCF 安全场景：
http://msdn.microsoft.com/en-us/library/ms730301.aspx
I had to do a lot of reading between multiple articles to get the details I was looking for from my original post. The information that helped things to clear up a bit for me was the following:
Each protocol (TCP, HTTP, MSMQ, NamedPipes) has its own mechanism for passing credentials and handling message protection.
Above is from the WCFSecurityGuide
Coming from a primarily web background I have a pretty good understanding of HTTP and securing it with a SSL cert. However this exact procedure is not required in a Windows environment for net.tcp which uses its own method in Windows to secure the transport layer.
So when it gets down to it, here are the (2) explinations in regards to securing a HTTP binding and net.tcp in a Windows environment that I wanted to understand:
For net.tcp: The service and clients are authenticated using Windows authentication, and the messages are secured at the transport level by Windows security
For a HTTP binding (i.e. wsHttpBinding): When using HTTP bindings, the transport security is provided by SSL. The SSL certificate is used to provide the message protection.
So I will not need a SSL cert for the net.tcp binding as that is handled by Windows Security and is inheriently secure when using Transport security. When using a wsHttpBinding I will still need to secure the Transport with a SSL certificate which I had done as mentioned previously, and exposed the binding via HTTPS.
If any future readers have similar questions the WCF guide link I posted and the link below are a good place to start:
Common WCF Security Scenarios:
http://msdn.microsoft.com/en-us/library/ms730301.aspx
在此设置中，“传输”安全性是您告诉 WCF 您确实希望它使用 SSL 的方式。为了使 SSL 工作，您需要客户端可以验证的服务器证书（来自签名机构或安装在客户端上的自签名证书）。
所以你做对了。 :)
In this setup, "Transport" security is how you tell WCF that you really want it to use SSL. In order for SSL to work you need a server certificate that the client can verify (either from a signing authority or a self-signed one that you install on the client).
So you've got it right. :)