使用SSL的WCF服务

Question

我知道SSL证书用于应用程序的安全目的，因此数据传输应采用加密形式。据我所知，我们必须在我们的应用程序的主机服务器中安装SSL证书。

这些天我在WCF服务工作。客户希望我们使用SSL证书制作WCF服务。

我想知道的是在SSL证书的代码级别中需要做什么。我将在IIS中托管我的服务。

使用SSL证书配置WCF服务的步骤是什么？

我知道一点知识总是危险:(

请详细

在此先感谢

Answer 1

为了配置2路SSL服务下面的步骤是：。

1. 创建一个网站，其中包含https绑定映射
2. 当https绑定映射该网站要求提供服务器SSL证书，以便保护您的传输通道。
3. 在希望部署服务的位置创建一个虚拟目录。
4. 现在，构建的WCF服务需要具有指定该服务使用https的配置，并且客户端使用证书进行了身份验证。
5. 将您的虚拟目录的SSL设置选项设置为“接受”，其中指出客户端可能通过证书。如果您将其设置为需要，则客户端需要才能通过证书。

注意：使用证书时，您需要确定哪些证书需要安装在哪个证书存储区中。你可能有一些例外的自签名证书，但他们可以在客户端通过使用下面的代码可以绕过：

ServicePointManager.ServerCertificateValidationCallback = (sender, cert, chain, error) => true; 

如何实现自定义的证书验证和使用它的一些代码：

public class CustomX509CertificateValidator : System.IdentityModel.Selectors.X509CertificateValidator 
    { 
     // This Validation function accepts any X.509 Certificate that is self-issued. As anyone can construct such 
     // a certificate this custom validator is less secure than the default behavior provided by the 
     // ChainTrust X509CertificateValidationMode. The security implications of this should be carefully 
     // considered before using this validation logic in production code. 
     public override void Validate(X509Certificate2 certificate) 
     { 
      // Check that we have been passed a certificate 
      if (certificate == null) 
       throw new ArgumentNullException("certificate"); 

      // Only accept self-issued certificates 
      if (certificate.Subject != certificate.Issuer) 
       throw new SecurityTokenException("Certificate is not self-issued"); 
     } 
    } 

现在，在您的WCF服务配置文件中使用自定义证书验证程序如下所示：

<behaviors> 
     <serviceBehaviors> 
     <behavior name="CalculatorServiceBehavior"> 
      <serviceDebug includeExceptionDetailInFaults="true"/> 
      <serviceCredentials> 
      <!-- 
      The serviceCredentials behavior allows one to specify authentication constraints on client certificates. 
      --> 
      <clientCertificate> 
       <!-- 
       Setting the certificateValidationMode to Custom means that if the custom X509CertificateValidator 
       does NOT throw an exception, then the provided certificate will be trusted without performing any 
       validation beyond that performed by the custom validator. The security implications of this 
       setting should be carefully considered before using Custom in production code. 
       --> 
       <authentication certificateValidationMode="Custom" customCertificateValidatorType="X509CertificateValidator.CustomX509CertificateValidator, service"/> 
      </clientCertificate> 
      <!-- 
      The serviceCredentials behavior allows one to define a service certificate. 
      A service certificate is used by a client to authenticate the service and provide message protection. 
      This configuration references the "localhost" certificate installed during the setup instructions. 
      --> 
      <serviceCertificate findValue="localhost" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName"/> 
      </serviceCredentials> 
     </behavior> 
     </serviceBehaviors> 
    </behaviors>