客户端在WCF中是否需要用于用户名身份验证的证书

Question

Does the client need to install a certificate, when using username athentication on a wsHttpBinding with WCF, or is this only needed on the host? And in any case, does this certificate need to be signed by a third party or will it also work with a self signed one?

My understanding is that i can use a selfSigned certificate and set

<authentication certificateValidationMode="None" /> 

on the server side. Is this correct?

And one more thing. Do i need to put the cert in any specific store, if i use a self signed cert, or is that all the same? - Answer to self: The store is of no importance as long as the right store is set in code.

Answer 1

WCF will not permit username authentication without transport mode security which means that you need a certificate.

There two ways, as far as I known, to get a proper certificate:

1. Purchase one from a trusted Certificate Authority.
2. Become a Certificate Authority yourself and create certificates. This is not very usuful unless you control both side of the conversation. If you decide to make you own certificates you can use MakeCert and Pvk2Pfx or OpenSSL to create chained encrypted certificates. Have a look at this how-to article that uses OpenSSL. Last but not least note that you should keep the private key at a secure location.

Now you should have the following files (the names are for demonstrative purposes):

• server.cer (public key for the server)
• server.pfx (key exchange file for the server)
• client.cer (public key for the client)
• client.pfx (key exchange file for the client)

Then you can do the following:

• On the server, in the local computer certificate store:

  1. Import server.pfx to the Personal folder. This will allow the server to encrypt messages with its private key and to decrypt message that have been encrypted with its public key.
  2. Import client.cer to the Trusted People folder. This will allow the server to encrypt message with the client's public key and decrypt messages that have been encrypted with the client's private key.

• On the client, in the local computer certificate store:

  1. Import client.pfx to the Personal folder. This will allow the client to encrypt messages with its private key and to decrypt message that have been encrypted with its public key.
  2. Import server.cer to the Trusted People folder. This will allow the client to encrypt message with the server's public key and decrypt messages that have been encrypted with the server's private key.

Finally on the configuration file of both client and service set:

<authentication certificateValidationMode="ChainTrust"/> 

which will ensure that only certificates that can chain up to a certificate authority in the Trusted Root Store will be valid.