WCF X509Certificates证书认证

1 证书有两种作用,一种是SSL传输用,一种作为公钥私钥容器(非对称加密用)。

2,WCF安全分传输安全和消息安全。消息安全一种模式为Certificate。 

<system.serviceModel>
    <bindings>
      <wsHttpBinding>
        <binding name="wsHttpBinding">
          <security mode="Message">
            <message clientCredentialType="Certificate" />
          </security>
        </binding>
      </wsHttpBinding>     
    </bindings>
    <services>
      <service name="Test.Contract">
          <endpoint  address="Wshttp" binding="wsHttpBinding"
                   bindingConfiguration="wSHttpBinding"  name="wsHttpEndpoint" contract="Test.IContract">         
          <identity>
        <!--<dns value="localhost.com" />-->
      </identity>           
      </endpoint>               
        <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />
      </service>
    </services>
    <behaviors>
      <serviceBehaviors>
        <behavior>
          <!-- To avoid disclosing metadata information, set the value below to false and remove the metadata endpoint above before deployment -->
          <serviceMetadata httpGetEnabled="true" />
          <!-- To receive exception details in faults for debugging purposes, set the value below to true.  Set to false before deployment to avoid disclosing exception information -->
          <serviceDebug includeExceptionDetailInFaults="false" />
          <serviceCredentials>
            <serviceCertificate storeLocation="CurrentUser" findValue="CN=TesteCert" />
          </serviceCredentials>
        </behavior>
      </serviceBehaviors>
    </behaviors>

 客户端 配置  

<system.serviceModel>
      <behaviors>
        <endpointBehaviors>
          <behavior>
            <clientCredentials>
              <serviceCertificate>
                <authentication certificateValidationMode="PeerTrust" trustedStoreLocation="CurrentUser" revocationMode="NoCheck"/>
              </serviceCertificate>
              <clientCertificate  storeLocation="CurrentUser" findValue="CN=TesTCert"/>
            </clientCredentials>
             
          </behavior>
        </endpointBehaviors>
      </behaviors>
       
        <bindings>
            <wsHttpBinding>
                <binding name="wsHttpEndpoint">
                    <security>
                        <message clientCredentialType="Certificate" />
                    </security>
                </binding>
            </wsHttpBinding>
        </bindings>
        <client>
            <endpoint address="http://localhost/test.svc"
                binding="wsHttpBinding" bindingConfiguration="sHttpEndpoint"
                contract="Test.IContract" name=“wsHttpEndpoint">
                <identity>
                    <certificate encodedValue="AwnvvqieXuGbI1rIMwGXUhxNdtUJlyKIgJdRI4xWlYEUU5vTXso/Xxpzu25EkVjslUj5bbY9VwhoFN5CCDINU7xukkxG0bErweXIJPW7Oo8LAQ3OduSD0r+2INkoziiLRxYoVcAgt8+9dLTfR+5QLrFrlxnp//eDiXY=" />
                </identity>
            </endpoint>
        </client>
    </system.serviceModel>

 

注意,1 :测试证书一定要是CA认证的,而能是self-sign的。 如何创建CA证书,可以参见

http://msdn.microsoft.com/en-us/library/ff648360.aspx 

 (Steps 7,

makecert -sk MyKeyName -iv RootCATest.pvk -n "CN=tempCert" -ic RootCATest.cer -sr CurrentUser -ss my -sky signature -pe tempCert.cer
应该改为
makecert -sk MyKeyName -iv RootCATest.pvk -n "CN=tempCert" -ic RootCATest.cer -sr CurrentUser -ss my -sky exchange -pe tempCert.cer

2:encodedValue可以通过wsdl获取,或者导出证书base604版本获取。

3:证书要复制到证书管理mmc里的”Trustd People“。

WCF X509Certificates证书认证

上一篇:TP5.0 PHP+jQuery 实现ajax文件上传


下一篇:JWTUtil工具类