WCF 相互证书的消息安全
下面是MSDN提供的方案。演示使用消息安全模式保护的 Windows Communication Foundation (WCF) 服务和客户端。 使用证书对客户端和服务进行身份验证。
.gif)
实例代码下载
创建服务及客户端证书
相互证书的信息安全需要服务端和客户端进行相互验证，因此我们需要2个证书：服务端证书和客户端证书。接下来我们通过.NET自带的makecert.exe 先创建两个X.509证书：WCF.SecuritySampleCA（服务端）和WCF.SecuritySampleClientCA（客户端）。
Note：以下生成证书过程均在服务端完成。makecert.exe生成的证书只能作为开发测试使用，在正式部署时请不要使用。
创建服务端证书
makecert.exe -sr LocalMachine -ss MY -a sha1 -n CN=WCF.SecuritySampleCA -sky exchange -pe
echo
echo ************
echo setting privileges on server certificates
echo ************
for /F "delims=" %%i in ('"FindPrivateKey.exe" My LocalMachine -n CN^=WCF.SecuritySampleCA -a') do set PRIVATE_KEY_FILE=%%i
set WP_ACCOUNT=NT AUTHORITY\NETWORK SERVICE
(ver | findstr /C:"5.1") && set WP_ACCOUNT=%COMPUTERNAME%\ASPNET
echo Y|cacls.exe "%PRIVATE_KEY_FILE%" /E /G "%WP_ACCOUNT%":R
pause
注意：
如果您使用的是非美国 英文版本的 Microsoft Windows，则必须编辑 Setup.bat 文件，并用与您所在的区域对应的帐户名称替换“NT AUTHORITY\NETWORK SERVICE”帐户名称。
FindPrivateKey.exe可以在实例代码包中找到。
makecert.exe -sr LocalMachine -ss TrustedPeople -a sha1 -n CN=WCF.SecuritySampleClientCA -sky exchange -pe
<system.serviceModel>
<services>
<service name="WcfSecuritySampleLibrary.Service"
behaviorConfiguration="ServiceBehavior">
<!-- Service Endpoints -->
<endpoint address=""
binding="wsHttpBinding"
contract="WcfSecuritySampleLibrary.IService"
bindingConfiguration="WcfSecuritySampleBinding">
<!--
Upon deployment, the following identity element should be removed or replaced to reflect the
identity under which the deployed service runs. If removed, WCF will infer an appropriate identity
automatically.
-->
</endpoint>
<endpoint address="mex"
binding="mexHttpBinding"
contract="IMetadataExchange"/>
</service>
</services>
<bindings>
<wsHttpBinding>
<binding name="WcfSecuritySampleBinding">
<security mode="Message">
<message clientCredentialType="Certificate"
establishSecurityContext="false"
negotiateServiceCredential="false"/>
</security>
</binding>
</wsHttpBinding>
</bindings>
<behaviors>
<serviceBehaviors>
<behavior name="ServiceBehavior">
<!-- To avoid disclosing metadata information, set the value below to false and remove the metadata endpoint above before deployment -->
<serviceMetadata httpGetEnabled="true"/>
<!-- To receive exception details in faults for debugging purposes, set the value below to true. Set to false before deployment to avoid disclosing exception information -->
<serviceDebug includeExceptionDetailInFaults="false"/>
<serviceCredentials>
<serviceCertificate storeLocation="LocalMachine"
findValue="WCF.SecuritySampleCA"
storeName="My"
x509FindType="FindBySubjectName"/>
<clientCertificate>
<!--
Setting the certificateValidationMode to PeerOrChainTrust means that if the certificate
is in the user's Trusted People store, then it is trusted without performing a
validation of the certificate's issuer chain. This setting is used here for convenience so that the
sample can be run without having certificates issued by a certificate authority (CA).
This setting is less secure than the default, ChainTrust. The security implications of this
setting should be carefully considered before using PeerOrChainTrust in production code.
-->
<authentication certificateValidationMode="PeerOrChainTrust" />
</clientCertificate>
</serviceCredentials>
</behavior>
</serviceBehaviors>
</behaviors>
</system.serviceModel>
svcutil.exe http://leo.isoftstone.com:6515/Service.Message.MutualCertificate/Service.svc?wsdl
<system.serviceModel>
<bindings>
<wsHttpBinding>
<binding name="WSHttpBinding_IService">
<security mode="Message">
<message clientCredentialType="Certificate"
establishSecurityContext="false"
negotiateServiceCredential="false"/>
</security>
</binding>
</wsHttpBinding>
</bindings>
<client>
<endpoint address="http://leo.isoftstone.com:6515/Service.Message.MutualCertificate/Service.svc"
binding="wsHttpBinding"
bindingConfiguration="WSHttpBinding_IService"
contract="IService"
name="WSHttpBinding_IService"
behaviorConfiguration="ClientCredentialsBehavior">
<identity>
<certificate encodedValue="AwAAAAEAAAAUAAAAv1KUaGzvpF2I/2nb55A3qyb4+QUgAAAAAQAAAMABAAAwggG8MIIBaqADAgECAhBL/0cYj41XmU7yomd4SulEMAkGBSsOAwIdBQAwFjEUMBIGA1UEAxMLUm9vdCBBZ2VuY3kwHhcNMDgwNjA2MDc0MjAxWhcNMzkxMjMxMjM1OTU5WjAfMR0wGwYDVQQDExRXQ0YuU2VjdXJpdHlTYW1wbGVDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAzbZ8uOt+yvfZHqp0pqmEYiv+S/2t4msC1mP4hkWK8nHT38vhOaHk3QYuaLDaBo1+cPPlhi2wsE+3aQteScsQTYbAiFkHVGhcSsxVCfnT6YdOA39Rpmc66EnZmiM8t1FAKGfD5jAe17lQN63hKk4jM3HbV/QTw3+IvxgkP7eKTSECAwEAAaNLMEkwRwYDVR0BBEAwPoAQEuQJLQYdHU8AjWEh3BZkY6EYMBYxFDASBgNVBAMTC1Jvb3QgQWdlbmN5ghAGN2wAqgBkihHPuNSqXDX0MAkGBSsOAwIdBQADQQBbx4i4WMz7tb7CjFQogCjoR1Z4gdMUY1Nb/4T/RP90aINADATRHYShYDduq8kU89e5BcwhvUBoacclkBUFGCof" />
</identity>
</endpoint>
</client>
<behaviors>
<endpointBehaviors>
<behavior name="ClientCredentialsBehavior">
<clientCredentials>
<clientCertificate findValue="WCF.SecuritySampleClientCA"
storeLocation="CurrentUser"
storeName="My"
x509FindType="FindBySubjectName"/>
<serviceCertificate>
<defaultCertificate findValue="WCF.SecuritySampleCA"
storeLocation="CurrentUser"
storeName="TrustedPeople"
x509FindType="FindBySubjectName"/>
</serviceCertificate>
</clientCredentials>
</behavior>
</endpointBehaviors>
</behaviors>
</system.serviceModel>
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。