WCF with WSHttpBinding, Message Security, clientCredentialType=“UserName” Cerificate SelfHosted Issue

Question

I have created a Service where I need the client to pass the credentials (username and password). This behavior requires a X509 certificate, so i started for development issues with a self-signed one using makecert.exe.

Because I'm so newbie with certificates, i see that this certificate created on the IIS Server Certificates section, I need my service to be self hosted later on a windows service, for testing purposes i use a console host application and a simple winform app client.

So my question is, How do i deploy this certificate? I don't want to use IIS in anyway, I can embed the certificate where i noticed i can export as .pfx file inside the console/windows service host? And how?

I'm posting my service and client config files for help on understanding what I need.

Server Configuration:

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
  <system.serviceModel>
    <services>
      <service name="B2B.WCF.Service.B2BService" behaviorConfiguration="wsBehavior">
        <endpoint name="WSHttpEndpointB2B"
                  bindingConfiguration="WSBinding"
                  address ="http://localhost:8768/ServB2B"
                  binding="wsHttpBinding"
                  contract="B2B.WCF.Contracts.IB2BContracts">
        </endpoint>
      </service>
    </services>
    <behaviors>
      <serviceBehaviors>
        <behavior name="wsBehavior">
          <serviceMetadata httpsGetEnabled="false"/>
          <serviceDebug includeExceptionDetailInFaults="true" />
          <serviceCredentials>
            <serviceCertificate findValue="MyServerCert" x509FindType="FindBySubjectName" 
                                storeLocation="LocalMachine" storeName="My" />
            <userNameAuthentication userNamePasswordValidationMode="Custom" 
                                    customUserNamePasswordValidatorType="B2B.WCF.Service.UserValidator, B2B.WCF.Service" />
          </serviceCredentials>
        </behavior>
      </serviceBehaviors>
    </behaviors>
    <bindings>
      <wsHttpBinding>
        <binding name="WSBinding">
          <security mode="Message">
            <message clientCredentialType="UserName" />
          </security>
        </binding>
      </wsHttpBinding>
    </bindings>
  </system.serviceModel>
</configuration>

Client Configuration:

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
  <system.serviceModel>
    <client>
      <endpoint name="WSHttpEndpointB2B"
                bindingConfiguration="WSBinding" behaviorConfiguration="wsBehavior"
                address ="http://localhost:8768/ServB2B"
                binding="wsHttpBinding"
                contract="B2B.WCF.Contracts.IB2BContracts">
        <identity>
          <dns value="MyServerCert"/>
        </identity>
      </endpoint>
    </client>
    <behaviors>
      <endpointBehaviors>
        <behavior name="wsBehavior">
          <clientCredentials>
            <clientCertificate findValue="MyServerCert" x509FindType="FindBySubjectName"
                                storeLocation="LocalMachine" storeName="My"/>
            <serviceCertificate>
              <authentication certificateValidationMode="None"/>
            </serviceCertificate>
          </clientCredentials>
        </behavior>
      </endpointBehaviors>
    </behaviors>
    <bindings>
      <wsHttpBinding>
        <binding name="WSBinding">
          <security mode="Message">
            <message clientCredentialType="UserName" />
          </security>
        </binding>
      </wsHttpBinding>
    </bindings>
  </system.serviceModel>
</configuration>

Thanx in advance

Answer 1

Your certificates need to be imported into the Windows Certificate Store on the machine that is hosting your web service (ie "the server") and (optionally) on the machine that is using your web service (ie "the client", if it is a different machine).

You should use the Microsoft Management Console (MMC) to do this. First, you should set it up according to this article. Then import your certificates according to the steps in this article. Make sure you choose the correct store for the client certificate (ie 'Personal') and root certificate (ie 'Trusted Root Certification Authorities').

Your web service won't start unless it finds the correct certificates that are referenced in your configuration files. In your case, this is the "MyServerCert" certificate that you want to store in the 'Personal' store.