使用SSL的WCF服務

Question

我知道SSL證書用於應用程序的安全目的，因此數據傳輸應採用加密形式。據我所知，我們必須在我們的應用程序的主機服務器中安裝SSL證書。

這些天我在WCF服務工作。客戶希望我們使用SSL證書製作WCF服務。

我想知道的是在SSL證書的代碼級別中需要做什麼。我將在IIS中託管我的服務。

使用SSL證書配置WCF服務的步驟是什麼？

我知道一點知識總是危險:(

請詳細

在此先感謝

Answer 1

爲了配置2路SSL服務下面的步驟是：。

1. 創建一個網站，其中包含https綁定映射
2. 當https綁定映射該網站要求提供服務器SSL證書，以便保護您的傳輸通道。
3. 在希望部署服務的位置創建一個虛擬目錄。
4. 現在，構建的WCF服務需要具有指定該服務使用https的配置，並且客戶端使用證書進行了身份驗證。
5. 將您的虛擬目錄的SSL設置選項設置爲「接受」，其中指出客戶端可能通過證書。如果您將其設置爲需要，則客戶端需要才能通過證書。

注意：使用證書時，您需要確定哪些證書需要安裝在哪個證書存儲區中。你可能有一些例外的自簽名證書，但他們可以在客戶端通過使用下面的代碼可以繞過：

ServicePointManager.ServerCertificateValidationCallback = (sender, cert, chain, error) => true; 

如何實現自定義的證書驗證和使用它的一些代碼：

public class CustomX509CertificateValidator : System.IdentityModel.Selectors.X509CertificateValidator 
    { 
     // This Validation function accepts any X.509 Certificate that is self-issued. As anyone can construct such 
     // a certificate this custom validator is less secure than the default behavior provided by the 
     // ChainTrust X509CertificateValidationMode. The security implications of this should be carefully 
     // considered before using this validation logic in production code. 
     public override void Validate(X509Certificate2 certificate) 
     { 
      // Check that we have been passed a certificate 
      if (certificate == null) 
       throw new ArgumentNullException("certificate"); 

      // Only accept self-issued certificates 
      if (certificate.Subject != certificate.Issuer) 
       throw new SecurityTokenException("Certificate is not self-issued"); 
     } 
    } 

現在，在您的WCF服務配置文件中使用自定義證書驗證程序如下所示：

<behaviors> 
     <serviceBehaviors> 
     <behavior name="CalculatorServiceBehavior"> 
      <serviceDebug includeExceptionDetailInFaults="true"/> 
      <serviceCredentials> 
      <!-- 
      The serviceCredentials behavior allows one to specify authentication constraints on client certificates. 
      --> 
      <clientCertificate> 
       <!-- 
       Setting the certificateValidationMode to Custom means that if the custom X509CertificateValidator 
       does NOT throw an exception, then the provided certificate will be trusted without performing any 
       validation beyond that performed by the custom validator. The security implications of this 
       setting should be carefully considered before using Custom in production code. 
       --> 
       <authentication certificateValidationMode="Custom" customCertificateValidatorType="X509CertificateValidator.CustomX509CertificateValidator, service"/> 
      </clientCertificate> 
      <!-- 
      The serviceCredentials behavior allows one to define a service certificate. 
      A service certificate is used by a client to authenticate the service and provide message protection. 
      This configuration references the "localhost" certificate installed during the setup instructions. 
      --> 
      <serviceCertificate findValue="localhost" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName"/> 
      </serviceCredentials> 
     </behavior> 
     </serviceBehaviors> 
    </behaviors>