IIS ApplicationPoolIdentity 和对证书吊销服务器的访问
我收到错误“X.509 证书...链构建失败。使用的证书具有无法验证的信任链。替换证书或更改证书验证模式。吊销功能无法检查吊销，因为吊销服务器离线。”
当我在 IIS 中使用“ApplicationPoolIdentity”下的应用程序池运行 wcf 服务时，出现此错误。我已向“ApplicationPoolIdentity”帐户（iis apppool*）授予对存储中证书的私钥访问权限。它在“网络服务”下工作正常。该证书是由我们的域控制器之一内部颁发的。我认为微软现在希望网站在“ApplicationPoolIdentity”下运行。有没有办法为“ApplicationPoolIdentity”授予正确的权限以避免此错误，或者我应该使用“网络服务”来代替？
I have the error "The X.509 certificate ... chain building failed. The certificate that was used has a trust chain that cannot be verified. Replace the certificate or change the certificateValidationMode. The revocation function was unable to check revocation because the revocation server was offline."
I get this error when I run my wcf service in IIS with an apppool under the "ApplicationPoolIdentity". I have given the "ApplicationPoolIdentity" accounts (iis apppool*) private key access permissions to the certificates in the store. It works fine under "Network Service". The certificate is internally issued from one of our domain controllers. I thought that Microsoft wants websites to be run under "ApplicationPoolIdentity" now. Is there a way to give the correct permissions to the "ApplicationPoolIdentity" in order to avoid this error or should I just use "Network Service" instead?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
当您使用像 WireShark 这样的网络嗅探器在线时，您可能会注意到，运行应用程序池的身份不允许访问证书链中吊销参数中 URL 提到的位置。正如您所描述的，当应用程序池在 NETWORK 服务帐户下运行时，不会出现该问题。
正如记录给您的错误所述，您还可以更改
replicationMode="NoCheck"以禁用 WCF 检查已吊销的证书。请阅读http://msdn.microsoft.com/en-us/library/aa347699。 aspx 了解详细信息。但您应该只在安全的封闭环境或出于开发目的时才这样做。What you will probably notice when you put a network sniffer like WireShark on the line, is that the identity that your application pool is running under is not allowed to go to the location mentioned as URL in the revocation parameter in your certificate chain. That problem does not occur when the application pool is running under the NETWORK service account, as you describe.
As stated by the error logged to you, you can also change the
revocationMode="NoCheck"to disable WCF checking for revoked certificates. Read http://msdn.microsoft.com/en-us/library/aa347699.aspx for details. But you should only do that either is a safe closed environment or for development purposes.