WCF SSL证书使用企业CA

问题描述：

对于一个应用程序，我需要一个WCF服务的SSL证书，WCF SSL证书使用企业CA

所以我们安装了它。如果我使用浏览器通过https浏览器访问互联网浏览器，我没有任何问题，也没有警告，没有任何内容，所以我想这个证书被认为对Windows有效。

的问题是，当我试图连接到我的WCF的服务器，我得到这个错误：

The X.509 certificate CN=myHostName, OU=tom, O=myDomainName, 
L=MyLocation, S=SO, C=CH chain building failed. The certificate that was used has a trust chain that cannot be verified. Replace the certificate or change the certificateValidationMode. The revocation function was unable to check revocation because the revocation server was offline.

什么可能是错误的？我怎么知道链条的哪一部分是无效的？有什么方法可以知道缺失的部分是什么？

这里是我的代码服务器：

ServiceHost myHost = new ServiceHost(typeof(MyService)); 
WSHttpBinding binding = new WSHttpBinding 
{ 
    ReaderQuotas = { MaxStringContentLength = int.MaxValue, MaxArrayLength = int.MaxValue, MaxDepth = int.MaxValue, MaxBytesPerRead = int.MaxValue, MaxNameTableCharCount = int.MaxValue }, 
    MaxReceivedMessageSize = int.MaxValue 
}; 
TimeSpan timeoutSpan = TimeSpan.FromMilliseconds(timeout); 
binding.CloseTimeout = timeoutSpan; 
binding.OpenTimeout = timeoutSpan; 
binding.ReceiveTimeout = timeoutSpan; 
binding.SendTimeout = timeoutSpan; 
binding.ReliableSession.InactivityTimeout = timeoutSpan; 

binding.MaxBufferPoolSize = int.MaxValue; 

//we set the security type 
binding.Security.Mode = SecurityMode.Message; 
binding.Security.Message.ClientCredentialType = MessageCredentialType.UserName; 
binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.None; 

//we set the server's certificate 
myHost.Credentials.ServiceCertificate.SetCertificate(StoreLocation.LocalMachine, StoreName.My, X509FindType.FindBySubjectName, ConfigurationManager.AppSettings["Hostname"]); 
myHost.Credentials.ClientCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.None; 
//we add the endPoint(and we indicate which methods are exposed through the interface 

myHost.AddServiceEndpoint(services[port], binding,     String.Format("http://localhost:{0}", port)); 




//Some services doesn't need an authentication 
if (!servicesWithoutAuth.Contains(services[port])) 
{ 
    //We set the authentifier: 
    myHost.Credentials.UserNameAuthentication.UserNamePasswordValidationMode = UserNamePasswordValidationMode.Custom; 
    myHost.Credentials.UserNameAuthentication.CustomUserNamePasswordValidator = new CustomUserNameValidator(); 
    myHost.Authorization.PrincipalPermissionMode = PrincipalPermissionMode.Custom; 


    //we set the AuthorizationPolicy 
    List<IAuthorizationPolicy> policies = new List<IAuthorizationPolicy> { new CustomAuthorizationPolicy() }; 
    myHost.Authorization.ExternalAuthorizationPolicies = policies.AsReadOnly(); 
} 
else 
{ 
    //We set the authentifier: 
    myHost.Credentials.UserNameAuthentication.UserNamePasswordValidationMode = UserNamePasswordValidationMode.Custom; 
    myHost.Credentials.UserNameAuthentication.CustomUserNamePasswordValidator = new NoUserNamePasswordValidator(); 
} 

//We bypass the certificate verification(our certificate is only self signed) 
//HACK Only to desactivate the SSL check: 
ServicePointManager.ServerCertificateValidationCallback += ValidateCertificate; 



//HACK: Remove when debug finished 
private static bool ValidateCertificate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslpolicyerrors) 
{ 
    return true; 
}

我的客户端：

// the remote adress is of the form "net.tcp://localhost:8000" 
string remoteAddress = String.Format("{0}://{1}:{2}", Tools.GetDescription(accessInfo.ServiceHost.Protocol), accessInfo.ServiceHost.HostName, accessInfo.PortNumber); 

// HACK: binding depends on protocol -> switch over accessInfo.ServiceHost.Protocol 

// avoid seralization/deserialization problems with large XML's 
WSHttpBinding binding = new WSHttpBinding(); 
binding.ReaderQuotas.MaxStringContentLength = int.MaxValue; 
binding.ReaderQuotas.MaxArrayLength = int.MaxValue; 
binding.MaxReceivedMessageSize = int.MaxValue; 
binding.ReaderQuotas.MaxStringContentLength = int.MaxValue; 
binding.ReaderQuotas.MaxArrayLength = int.MaxValue; 
binding.ReaderQuotas.MaxDepth = int.MaxValue; 
binding.ReaderQuotas.MaxBytesPerRead = int.MaxValue; 
binding.ReaderQuotas.MaxNameTableCharCount = int.MaxValue; 
TimeSpan timeoutSpan = DateTime.Now.AddMinutes(30) - DateTime.Now; 
binding.CloseTimeout = timeoutSpan; 
binding.OpenTimeout = timeoutSpan; 
binding.ReceiveTimeout = timeoutSpan; 
binding.SendTimeout = timeoutSpan; 
binding.ReliableSession.InactivityTimeout = timeoutSpan; 


//++ 
binding.MaxBufferPoolSize = int.MaxValue; 

//we set the security type 
binding.Security.Mode = SecurityMode.Message; 
binding.Security.Message.ClientCredentialType = MessageCredentialType.UserName; 
binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.None; 

ChannelFactory<TService> channelFactory = new ChannelFactory<TService>(binding, remoteAddress); 

channelFactory.Credentials.UserName.UserName = ((UsernamePasswordAuthentication)authInfos).Username; 
channelFactory.Credentials.UserName.Password = ((UsernamePasswordAuthentication)authInfos).Password; 


//We set the maxItemsInObjectGraph 
foreach (OperationDescription op in channelFactory.Endpoint.Contract.Operations) 
{ 
    DataContractSerializerOperationBehavior dataContractBehavior = op.Behaviors.Find<DataContractSerializerOperationBehavior>(); 
    if (dataContractBehavior != null) 
    { 
     dataContractBehavior.MaxItemsInObjectGraph = int.MaxValue; 
    } 
} 
SamlSecurityTokenAuthenticator authenticator = new SamlSecurityTokenAuthenticator(new List<SecurityTokenAuthenticator>(new SecurityTokenAuthenticator[] { new RsaSecurityTokenAuthenticator(), new X509SecurityTokenAuthenticator(X509CertificateValidator.None) }), TimeSpan.FromDays(5)); 

_service = channelFactory.CreateChannel();

答

How can I know which part of the chain is unvalid? Is there any way to know what is the missing part?

好了，从我的经验，如果你打开你的密钥库并查看它，你应该看到你的证书明确形成了一个链。我不知道你用什么工具查看你的密钥库（或者如果你使用的是Windows密钥库），但是当你查看你的密钥时，你应该看到一些类似的链。如果链形成正确，它将显示正确，并且没有任何缺少的部分。

我的猜测是，当你导入你的证书回复时，由于某种原因它没有形成链。换句话说，您的证书作为“unchained”公钥存放在您的密钥库中。

WCF SSL证书使用企业CA

相关推荐