自托管WCF服务+客户端证书身份验证

Question

i'm trying to implement a self hosted WCF-Service which should use client authentication by certificate. Unfortunately the authentication fails. The log file says, that the client does not provide a certificate. If try to reach the service through firefox, it says: "Error 403 - Forbidden".

The following code shows the configuration via the app-config file.

  <serviceBehaviors>
    <behavior name="sslbehaviour">
      <serviceMetadata httpsGetEnabled="true" /> 
      <serviceDebug includeExceptionDetailInFaults="true"/>
      <serviceCredentials>
        <clientCertificate>
          <authentication certificateValidationMode="ChainTrust" trustedStoreLocation="CurrentUser"/>
        </clientCertificate>
        <serviceCertificate findValue="cert-thumb-print" x509FindType="FindByThumbprint" storeLocation="CurrentUser" storeName="My"/>
      </serviceCredentials>            
    </behavior>
  </serviceBehaviors>

endpoint address="https://localhost:443/service" binding="wsHttpBinding"
      bindingConfiguration="BindingForResultPost" contract="MobD.IEndpointService" />

The error msg: System.ServiceModel.Channels.HttpsClientCertificateNotPresent.aspx

i guess that i've created and installed my certs correctly.

I would be very grateful for every hint...

Kind regards, Michael

Answer 1

You say that when you try and reach it through Firefox you get a 403. Has Firefox got the client certificate installed?

What is the Http sub code? My guess is you are getting a 403.7 (which means the client certificate is not installed, or not being presented by the browser), 403.16 (client certificate is untrusted), 403.17 (client certificate has expired) or possibly 403.13 (client certificate revoked).

One problem I have seen - on servers that do not have outgoing web access - is you get one of the above 403 codes (can't remember which) because the server is unable to get a certificate revocation list - and so it declines all certificates. This check can be disabled, but obviously there are security considerations to be aware of.

Answer 2

Please refer to the below steps on where to install the client certificates:

You need to have the client certificate as follows:

On the client machine :

Current User --> Personal folder should have client certificate MyClientCert.pfx installed

On Server machines:

Local Machine --> TrusterPeople should have MyClientCert.cer installed

Make sure that the setup is correct. I see that you have the client certificate in the TrustedPeople of current user. Hope now its clear on the certificates installation

Please refer to this LINK that explains a bit on client certificate being installed and how to tell the browser to pick one from the store:

NOTE: When to use the .pfx and .cer files

Answer 3

You have to assign port rights in Windows when you are self hosting WCF services.

See this article on MSDN: How to: Configure a Port with an SSL Certificate

You can also use OpenSSL to check the port status.