具有服务证书的WCF Restful Service

Question

I have develop a securized WCF Service with wsHttpBinding using ssl and a SERVICE certificate (not a client certificate, but a service one!). Only clients storing the self signed certificate in their certificate store will be allowed to consume the service.

I used a configuration similar as :

<security mode="Transport">
  <transport clientCredentialType="None" />
   <message clientCredentialType="None" negotiateServiceCredential="true" />
</security>

<behaviors>
    <serviceBehaviors>
    <behavior name="CertificateServiceBehavior">
            <serviceCredentials>
...
                <serviceCertificate storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" findValue="server" />
            </serviceCredentials>
...
        </behavior>
    </serviceBehaviors>
</behaviors>

---

I am quite new to WCF Securisation. I've search a lot a bout securisation but i need you to help me out with my questions.

Today I was asked to securize a WCF Restful service.
Looking over internet I have found that we could :

• use ssl
• authenticate client with Credential (using => Certificate = Client Certificate)

My questions are:

a) From my first example at the beginning, I have assumed that when we setup a service certificate, this isto securize a wcf service at the message level (in comparaison with transport, as ssl is taking care of transport). Please correct me if i am wrong ?

b) For WCF Restful Service, the binding we use is WebHttpBinding. According to http://msdn.microsoft.com/fr-fr/library/bb412176%28v=vs.110%29.aspx there is no element under :

 <security mode="None/Transport/TransportCredentialOnly">
    // here there is only <transport> available with clientCredential="certificate" available.
 </security>

So, could we setup a service certificate for a restful Service?

Thanks for helping !

Answer 1

Admittedly, I had a bit of difficulty understanding the details of your question, but discerned (hopefully correctly) that you are looking for recommendations to secure your WCF service with certificates. When facing a similar consideration, our team found that the following MSDN article provided a comprehensive and easy to understand walk-through of Message Security with Mutual Certificates.

http://msdn.microsoft.com/en-us/library/ms733102(v=vs.110).aspx

The article clearly indicates the necessary requirements and provides code and configuration examples.

Regards,