这就是WCF SSL安全通道出现故障的原因吗？

Question

I'm supporting a project where we recently needed to apply a series of upgrades to a newer version of the .Net Framework. This has largely succeeded but for one final component that's been around for a very long time.

Our client uses InfoPath templates to populate information for other users to consume. Everything the templates need comes from a WCF web service we host. We set the web service call up with the following code.

    private WSHttpBinding CreateBinding()
    {
        var wsHttpBinding = new WSHttpBinding();
        wsHttpBinding.CloseTimeout = TimeSpan.FromMinutes(10);
        wsHttpBinding.OpenTimeout = TimeSpan.FromMinutes(10);
        wsHttpBinding.ReceiveTimeout = TimeSpan.FromMinutes(10);
        wsHttpBinding.SendTimeout = TimeSpan.FromMinutes(10);
        wsHttpBinding.BypassProxyOnLocal = false;
        wsHttpBinding.TransactionFlow = false;
        wsHttpBinding.HostNameComparisonMode = HostNameComparisonMode.StrongWildcard;
        wsHttpBinding.MaxBufferPoolSize = 524288;
        wsHttpBinding.MaxReceivedMessageSize = 2147483647;
        wsHttpBinding.MessageEncoding = WSMessageEncoding.Text;
        wsHttpBinding.TextEncoding = Encoding.UTF8;
        wsHttpBinding.UseDefaultWebProxy = true;
        wsHttpBinding.AllowCookies = false;
        wsHttpBinding.ReaderQuotas.MaxDepth = 32;
        wsHttpBinding.ReaderQuotas.MaxStringContentLength = 2147483647;
        wsHttpBinding.ReaderQuotas.MaxArrayLength = 16384;
        wsHttpBinding.ReaderQuotas.MaxBytesPerRead = 4096;
        wsHttpBinding.ReaderQuotas.MaxNameTableCharCount = 16384;
        wsHttpBinding.ReliableSession.Ordered = true;
        wsHttpBinding.ReliableSession.InactivityTimeout = TimeSpan.FromMinutes(10);
        wsHttpBinding.ReliableSession.Enabled = false;

        wsHttpBinding.Security.Mode = SecurityMode.TransportWithMessageCredential;
        wsHttpBinding.Security.Transport.ClientCredentialType = HttpClientCredentialType.None;
        wsHttpBinding.Security.Transport.ProxyCredentialType = HttpProxyCredentialType.None;
        wsHttpBinding.Security.Transport.Realm = string.Empty;
        wsHttpBinding.Security.Message.ClientCredentialType = MessageCredentialType.UserName;
        wsHttpBinding.Security.Message.NegotiateServiceCredential = false;
        wsHttpBinding.Security.Message.AlgorithmSuite = SecurityAlgorithmSuite.Basic256;

        return wsHttpBinding;

    }

    private EndpointAddress CreateEndPoint()
    {
        X509Store store = new X509Store(StoreName.My, StoreLocation.CurrentUser);
        store.Open(OpenFlags.ReadOnly);
        X509Certificate2 certificate = store.Certificates.Find(X509FindType.FindBySubjectName, "*.wildcard.address.foo", false)[0];
        store.Close();

        EndpointIdentity identity = EndpointIdentity.CreateX509CertificateIdentity(certificate);

        string address = getWcfServiceUrl();

        AddressHeader header = AddressHeader.CreateAddressHeader(address);
        List<AddressHeader> headerList = new List<AddressHeader> { header };
        Uri uri = new Uri(address); 
        var endpointAddress = new EndpointAddress(uri, identity, headerList.ToArray());
        return endpointAddress;
    }
}

This works fine and if we're testing it out, calls can be made successfully for all other intents and purposes. Except for one .

In one case we need to get information from a 3rd party resource. In that situation, our web service makes a separate call out to this 3rd party at an HTTPS address (passed in to the url parameter here:

    private string requestURL(string url)
    {
        string toReturn = null;
        Stream stream = null;
        try
        {
            HttpWebRequest request = (HttpWebRequest)WebRequest.Create(url);
            request.Method = httpMethod;
            stream = ((HttpWebResponse)request.GetResponse()).GetResponseStream();
            StreamReader reader = new StreamReader(stream);
            toReturn = reader.ReadToEnd();
        }
        catch(Exception e)
        {
            throw new Exception("Error with that service please try again: " + e.Message, e);
        }
        finally
        {
            if(stream != null)
            {
                stream.Close();
            }
        }
        return toReturn;
    }

In this case, the following error is returned:

The request was aborted: Could not create SSL/TLS secure channel.

My suspicion is that we're setting up a very specific set of constraints around the SSL connection between our local client (ie InfoPath) and the web service but the call from that web service to the 3rd party is not set up with any constraints beyond simply calling over HTTPS.

What should I be looking out for in trying to fix this issue?

Answer 1

WCF IMHO is particular about configuration at both ends and asks for things like transport credential specifically in the back and forth. I suspect you have no control of how the security is managed at the third party and can't change it, but your generic method to call all web services won't work because the configuration doesn't match.