如何避免在客户端设置 DnsEndpointIdentity

Question

So basically I have an application where I have one client and two services that expose endpoints via netTcpBinding or netNamedPipe. Additionally, whole communication between services and client is secured with certificate(for now I'm using self-trusted one).

It is working fine, but during creation of EndpointAddress instance, I need also set DnsEndpointIdentity with the name of the certificate that is used on the service side. So it looks like this:

new EndpointAddress(serviceUrl, new DnsEndpointIdentity("MyCertificateName"));

So my question is: Is this normal? Is there a way to avoid setting it on client side?

Answer 1

This is a normal phenomenon, the identity could not be ignorant, it represents that the identity of the server. Third-party can impersonate the service program to let the client-side call, in order to achieve the purpose of stealing the client-side information. To ensure that the client does not find the wrong server, the hostname in the certificate(subject) must be the same as the hostname that the client provides (DNS identity). We could also use the public key of the certificate as the identity since the public key of the certificate is public to outside.

<identity>
                  <rsa value="...."/>
                </identity>

Here is a sample code to get the public key of the certificate.

X509Store store = new X509Store(StoreName.My, StoreLocation.CurrentUser);
            store.Open(OpenFlags.ReadOnly);
            X509Certificate2 cert = null;
            foreach (var certificate in store.Certificates)
            {
                if (certificate.Subject.Contains("myhostname"))
                {
                    cert = certificate;
                    break;
                }
            }
            if (cert==null)
            {
                return;
            }
            //output the public key
            string xmlKey = cert.PublicKey.Key.ToXmlString(false);
            //encoded
            string encodedkey = System.Net.WebUtility.HtmlEncode(xmlKey);
            Console.WriteLine($"Public key:\n{encodedkey}");
            store.Close();
            store.Dispose();

By the way, these configurations are able to automatically generated when calling the service by using the Add Service Reference dialog.
Feel free to let me know if there is anything I can help with.