在Azure Web角色中为WCF终结点添加其他SSL行为

Question

Our azure web application already uses https port 443 with our site certificate, we have a WCF service within this webrole that has an https endpoint using our cert to authenticate (1-way ssl), this same service needs an additional https endpoint supporting 2-way auth using our cert and the third party's cert. We have uploaded the cert, updated the service definition file, and added an endpoint that we are hoping will work, but in testing we are getting the error: The SSL settings for the service 'SslRequireCert' does not match those of the IIS 'None'.

so the endpoint that does work is: https://environemnt.application.com/Services/Service.svc the endpoint that generates the error: https://environment.application.com/Services/Service.svc/twa

The key requirement is that it is https, port 443, at the above new endpoint, without altering the SSL behavior of the rest of the role, I have seen entries to change the IIS configuration or use the role editor to add an Https Input endpoint, but as we already have an Https Input endpoint on port 443 using our site cert I don't want to alter/affect the whole role.

If it is helpful the service is a WCF Service which consumes an Mtom encoded soap 1.2 message

here are the new values that we have entered, what else do I need?

<behaviors>
 <serviceBehaviors>
   <behavior name="SSLServiceBehavior">
     <serviceMetadata httpsGetEnabled="true" />
     <serviceDebug includeExceptionDetailInFaults="true" />
     <dataContractSerializer maxItemsInObjectGraph="2147483647" />
   </behavior>
 </serviceBehaviors>
 <endpointBehaviors>
  <behavior name="OneWayAuthEndpointBehavior">
  </behavior>
  <behavior name="TwoWayAuthEndpointBehavior">
      <endpointDiscovery enabled="true"></endpointDiscovery>
      <clientCredentials>
        <clientCertificate findValue="thumprint..." storeLocation="LocalMachine" storeName="CertificateAuthority" x509FindType="FindByThumbprint"  />
      </clientCredentials>
    </behavior>
 </endpointBehaviors>
</behaviors>
<services>
 <service behaviorConfiguration="SSLServiceBehavior" name="Service">
  <endpoint address="" behaviorConfiguration="OneWayAuthEndpointBehavior"binding="wsHttpBinding" bindingConfiguration="HttpsMtomOneWay" contract="ITestService" />
  <endpoint address="twa" behaviorConfiguration="TwoWayAuthEndpointBehavior" binding="wsHttpBinding" bindingConfiguration="HttpsMtomTwoWay" contract="ITestService"/>
</services>
<bindings>
 <wsHttpBinding>
  <binding name="HttpsMtomOneWay" messageEncoding="Mtom">
    <security mode="Transport">
      <transport clientCredentialType="None" />
    </security>
  </binding>
  <binding name="HttpsMtomTwoWay" messageEncoding="Mtom">
    <security mode="Transport">
      <transport clientCredentialType="Certificate" />
    </security>
  </binding>
 </wsHttpBinding>
</bindings>

thank you much

Answer 1

Fixed through these steps:

• Added serviceCredentials.serviceCertificate (cert details for our cert) to the service behavior
• Eliminated Endpoint behavior definitions
• Changed the HttpsMtomTwoWay binding to securityMode=Message

Now the message handlers handle the authentication exchange and external cert validation, then pass on to the transport endpoint, and we did not need to mess with the site wide SSL or endpoint settings. Tested and verified with numerous 3rd parties.