使用WCF和gSOAP将证书添加到服务器和客户端

Question

I have WCF web service that need to be secured using SSL/TLS protocol. In the other hand I have C++ client that consume WCF web service using gSOAP library . Already only server needs to have certificate. Now I have tasked to enforce client to have certificate. My earlier implementation for client is like this:

    soap_ssl_init();
    int soapResult = soap_ssl_client_context(soapPtr, SOAP_SSL_NO_AUTHENTICATION, "client.pem", NULL,
        NULL, "cacert.pem", NULL);
    if (soapResult)
    {
        soap_print_fault(soapPtr, stderr);
        throw new ClientLogException("Can not use ssl for comminucations!");
    }
    else
    {

    }

    struct soap mySoap = *soapPtr;
    WSHttpBinding_USCOREILogServicesProxy proxy(mySoap);
    input.request = &request;
    int callCode = proxy.CallWebService(WEB_SERVICE_ADDRESS, NULL, &input, response);
    if (callCode != 0)
    {
        cout << "Web service call code: " + callCode << endl;
        throw new ClientLogException("Error in calling web service with call code: " + callCode);
    } 

which I does it from gSOAP documents . It works fine with only server required to have certificate. I viewed communication using WireShark and connection was completely encrypted.

Now for enforcing client to use certificate, I am going to use Nine simple steps to enable X.509 certificates on WCF article. But the article uses a C# WCF client. I must implement client configuration in my gSOAP C++ client. I can add client certificate in above code when calling soap_ssl_client_context and in third parameter.

I have 2 problem here:

1- I don't know is it possible calling web service that both client and server have certificates and communication be secured when server uses WCF and client uses gSOAP.

2- In the CodeProject article it seems that web service call is using http and I am wonder there is no encryption in communication.

In the end if anyone has better solution, or recommend other tools will be welcome.

Answer 1

HTTPS works out of the box with gsoap if you compile with -DWITH_OPENSSL and link against the OpenSSL libs. The out-of-the-box default settings will encrypt messages with https:// , but this does not enforce authentication because you need to register the server certificates first with soap_ssl_client_context() as you point out.

To authenticate both server and client, the gsoap manual suggests the following:

int soapResult = soap_ssl_client_context(soapPtr,
    SOAP_SSL_DEFAULT,  // requires server to authenticate
    "client.pem",      // client cert (+public key) to authenticate to server
    "password",        // you need this when client.pem is encrypted
    NULL,              // capath to certs, when used
    "cacert.pem",      // should contain the server cert
    NULL);

Also, you may need to convert PEM to CER (or the other way) for windows.