在 WCF 服务网 tcp 中使用客户端证书

Question

I have a WCF application running as net tcp and installed a server certificate (xxx.domain.com) in server.

Enabled Transport with certificate security. IIS web site configured and its working fine with above certificate also its not installed in local machine as its found correct root ca and intermediate certificate.

Can i call the wcf service with out installing certificate if yes which one i should use Root CA or intermediate. Please see the certificate chain below

Root CA
Intermediate
xxx.domain.com

Here is the code used in client

channel.Credentials.ClientCertificate.SetCertificate(
StoreLocation.LocalMachine,
StoreName.CertificateAuthority,
X509FindType.FindByThumbprint,
"tried intermediate and root CA its not working ");

Answer 1

When a WCF service created by Nettcpbinding authenticates the client with a certificate, we need to specify a service certificate in the service credentials.

sh.Credentials.ServiceCertificate.SetCertificate(StoreLocation.LocalMachine, StoreName.My, X509FindType.FindByThumbprint, "5ba5022f527e32ac02548fc5afc558de1d314cb6");

Then the service will work properly. Subsequently, the client should provide a client certificate when calling the service since the Clientcredentialtype property is Certificate on the server-side.

binding.Security.Transport.ClientCredentialType = TcpClientCredentialType.Certificate;

Client-side.

ServiceReference1.ServiceClient client = new ServiceClient();
client.ClientCredentials.ClientCertificate.SetCertificate(StoreLocation.LocalMachine, StoreName.My, X509FindType.FindByThumbprint, "f0969c5725b2f142b7f150515ec2bd12bc45250b");
            var result = client.Test();
            Console.WriteLine(result);

During this process, please note we should install the certificate each other in the Root CA so that the certificate trust relationship between the client-side and the server-side can be established.
Look back to your question, the cause might be the certificate trust relationship cannot be established between the client-side and the server-side. We have to ensure that the client-side has installed the service certificate in the Root CA and the server has installed the client certificate in the Root CA.
Feel free to let me know if there is anything I can help with.