在 WCF 中使用 X.509 证书连接失败

Question

如果我尝试连接到 WCF 服务，则会收到以下错误： 未为目标“http://localhost:8081/OEGNOSControlService/ws”提供服务证书。在 ClientCredentials 中指定服务证书。

但我已经指定了服务证书！

服务的app.config：

<system.serviceModel> 
 <behaviors>
  <serviceBehaviors>  
  <behavior name="ServiceCredentialsBehavior">
   <serviceMetadata httpGetEnabled="true" />
   <serviceDebug includeExceptionDetailInFaults="true" />
   <serviceCredentials>
   <serviceCertificate findValue="localhost"
        storeLocation="LocalMachine"
        storeName="My"
        x509FindType="FindBySubjectName" />
   </serviceCredentials>
  </behavior>
  </serviceBehaviors>
 </behaviors> 
 <bindings>
  <wsHttpBinding>
  <binding name="MessageAndUserName">
   <security mode="Message">
   <message clientCredentialType="UserName" negotiateServiceCredential="false"
    algorithmSuite="Default" establishSecurityContext="true" />
   </security>
  </binding>
  </wsHttpBinding>
 </bindings>
 <services>
  <service behaviorConfiguration="ServiceCredentialsBehavior"
    name="OEGNOS.ControlServiceLibrary.ControlService">
  <clear/>
  <endpoint
   name="WSHttpBinding_IControlService"
   address="ws"
     binding="wsHttpBinding"
     bindingConfiguration="MessageAndUserName"
     contract="OEGNOS.ControlServiceLibrary.IControlService" />
  <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />
  <host>
   <baseAddresses>
   <add baseAddress="http://localhost:8081/OEGNOSControlService/" />
   </baseAddresses>
  </host>
  </service>
 </services>
 </system.serviceModel>

客户端的app.config：

<system.serviceModel>
  <behaviors>
   <endpointBehaviors>
    <behavior name="ClientCredentialsBehavior">
     <clientCredentials>
      <serviceCertificate>
       <authentication certificateValidationMode="PeerOrChainTrust" />
      </serviceCertificate>
     </clientCredentials>
    </behavior>
   </endpointBehaviors>
  </behaviors>
  <bindings>
   <wsHttpBinding>
    <binding name="WSHttpBinding_IControlService" closeTimeout="00:01:00"
     openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
     bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard"
     maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Text"
     textEncoding="utf-8" useDefaultWebProxy="true" allowCookies="false">
     <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
      maxBytesPerRead="4096" maxNameTableCharCount="16384" />
     <reliableSession ordered="true" inactivityTimeout="00:10:00"
      enabled="false" />
     <security mode="Message">
      <message clientCredentialType="UserName" negotiateServiceCredential="false"
       algorithmSuite="Default" establishSecurityContext="true" />
     </security>
    </binding>    
   </wsHttpBinding>
  </bindings>
  <client>
   <endpoint address="http://localhost:8081/OEGNOSControlService/ws"
    binding="wsHttpBinding" bindingConfiguration="WSHttpBinding_IControlService"
    contract="ServiceReference.IControlService" name="WSHttpBinding_IControlService">
    <identity>
     <certificate encodedValue="AwAAAAEAAAAUAAAA76QJWw679+g8dC71G0FPkVBqP84gAAAAAQAAALUBAAAwggGxMIIBX6ADAgECAhC+qdh0bQjNsUbkHmHD4dv1MAkGBSsOAwIdBQAwFjEUMBIGA1UEAxMLUm9vdCBBZ2VuY3kwHhcNMTEwODI0MDcxNzIzWhcNMzkxMjMxMjM1OTU5WjAUMRIwEAYDVQQDEwlsb2NhbGhvc3QwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALhYR3qBO1xZlHJux2pTPWnwltvXzhtIyQJJXJwaNoyJz1rAr6LsTOxXbjXXRB4TV74TjgTzVtY8z/bkJhjexBmrq/79myw1y1RZegOSF64p4oYlQX2+uw/AlGgP+VBDgHWamVK6Fdansn/9kQRHRHbfK/DJLdBCzWWHj3tR+jiVAgMBAAGjSzBJMEcGA1UdAQRAMD6AEBLkCS0GHR1PAI1hIdwWZGOhGDAWMRQwEgYDVQQDEwtSb290IEFnZW5jeYIQBjdsAKoAZIoRz7jUqlw19DAJBgUrDgMCHQUAA0EAITzB2uIn2MuJ11s1uXwNtPOESTrfKlVIfrccGzkuggUJgAiHEQkj/1PwQN+Q47wD5aWYzjUN5CCVMefD9djBYA==" />
    </identity>
   </endpoint>   
  </client>
 </system.serviceModel>

Answer 1

尝试在客户端上安装证书并更新客户端配置

<behavior name="ClientCredentialsBehavior">
     <clientCredentials>
      <serviceCertificate>
         <!-- path for client certificate-->
        <defaultCertificate findValue="localhost"
            storeLocation="LocalMachine"
            storeName="My"
            x509FindType="FindBySubjectName"/>
       <authentication certificateValidationMode="None" />
      </serviceCertificate>
     </clientCredentials>
</behavior>

如果你做得正确，不会有异常。注意storeLocation值，导入后默认为CurrentUser（不是LocalMachine）。您可以使用“cmd ->”查看它mmc->证书”。

实际上您不必安装证书，只需向客户端发送证书编码值即可。为此，请勿使用 svcutil.exe（通过单击 Visual Studio 中的“添加服务引用”来使用它）。

相反，

1. 使用 mmc util 在证书存储中查找您的证书。
2. 右键单击证书->出口。
3. 选择“不导出私钥”和 base-64 编码。
4. 保存后使用文本编辑器打开文件，您将获得编码值。
5. 将找到的编码值放入客户端配置身份部分。