从 .Net Core 3.1 调用 WCF BasicBinding 服务

Question

I have a WCF SOAP service on IIS that uses basicHttpBinding and is configured to require client certificate:

<basicHttpBinding>
  <binding>
    <readerQuotas/>
    <security mode="Transport">
      <transport clientCredentialType="Certificate"></transport>
    </security>
  </binding>             
</basicHttpBinding>

I have to call that service from .Net Core 3.1 app. Here is what I have:

    BasicHttpBinding binding = new BasicHttpBinding(BasicHttpSecurityMode.Transport);
    binding.Security.Message.ClientCredentialType = BasicHttpMessageCredentialType.Certificate;

    ChannelFactory<PaymentRequestService> factory = new ChannelFactory<PaymentRequestService>(binding, new EndpointAddress(new Uri(_apiOptions.Value.PaymentRequestServiceEndpoint)));
    factory.Credentials.ClientCertificate.Certificate = GetClientCertificate(certBase64, certPass); // X509Certificate2
    PaymentRequestService client = factory.CreateChannel();
    var rx = client.SavePaymentRequestAsync(myRequest);

When I check the factory in debug I see that client credential certificate (SHA256) is there, however it looks like the client credential doesn't reach the webservice, because I keep getting The HTTP request was forbidden with client authentication scheme 'Anonymous'

It makes no difference if I use BasicHttpSecurityMode.TransportWithMessageCredential or set the certificate using factory.Credentials.ClientCertificate.SetCertificate()

Any ideas?

Answer 1

Turns out starting with Windows Server 2012 you need to set SendTrustedIssuerList and ClientAuthTrustMode registry settings in HKLM\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL

https://configmgrblog.com/2014/02/23/configmgr-2012-r2-internet-facing-mp-windows-server-2012-r2-note/