Question

我没有使用IIS，甚至没有安装在这台计算机上。我的控制台托管WCF REST服务中也没有任何app.config个文件或web.config个文件。但我想尝试在主机控制台应用程序上运行HTTPS：

class Program
{
    static void Main(string[] args)
    {
        string baseAddress = "http://" + Environment.MachineName + ":8000/Service";
        ServiceHost host = new ServiceHost(typeof(Service), new Uri(baseAddress));
        //WebHttpBinding binding = new WebHttpBinding();
        //binding.Security.Mode = WebHttpSecurityMode.Transport;
        host.AddServiceEndpoint(typeof(IService), new WebHttpBinding(), "").Behaviors.Add(new WebHttpBehavior());
        host.Open();

        Console.WriteLine("Host opened");
        Console.ReadLine();

有没有办法让我的服务在HTTPS中运行？

Answer 1

创建并安装根权限和HTTPS证书

以管理员身份打开命令提示符：

创建文件夹C:\Certs并导航到它。

#Root Authority
makecert.exe -r -pe -n "CN=My Root Authority" -ss CA -sr LocalMachine -a sha1 -sky signature -cy authority -sv CA.pvk CA.cer

#Certificate
makecert.exe -pe -n "CN=localhost" -a sha1 -sky exchange -eku 1.3.6.1.5.5.7.3.1 -ic CA.cer -iv CA.pvk -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12 -sv server.pvk server.cer

#key
pvk2pfx.exe -pvk server.pvk -spc server.cer -pfx server.pfx

** makecert和pvk2pfx的默认位置是C：\ Program Files（x86）\ Microsoft SDKs \ Windows \ v7.0A \ bin

安装证书

从命令行：

certmgr.exe -add CA.cer -r LocalMachine -s CertificateAuthority

certmgr.exe -add server.pfx -r LocalMachine -s My -all

来自MMC：

转到命令提示符并键入MMC打开MMC。这将打开空白MMC控制台。单击“添加/删除管理单元”。添加证书并选择“计算机帐户/本地计算机”。

导航至中级证书颁发机构/证书。右键单击并选择导入。导航到您创建CA.cer文件的文件夹，然后单击以导入。

导航到“个人/证书”，然后右键单击“导入”。找到您的server.pfx文件（您需要从可用扩展名列表中选择PFX）并导入此文件。完成后，双击打开证书并在“详细信息”下记下其指纹。将其粘贴到Notepad并在开头删除额外的?并删除空格。

要获取服务器指纹证书，您可以在PowerShell中运行：
```
$getThumb = Get-ChildItem -path cert:\LocalMachine\TrustedPeople | where { $_.Subject -match "CN=localhost" }
$getThumb.thumbprint
```

使用netsh

注册和映射WCF端口

映射到WCF端口

netsh http add sslcert ipport=0.0.0.0:8000 certhash=73269e9b554f58d75e77880f5ff72b50c8d724ee appid={e2eaacd9-92e6-43cc-b51c-7a7887149607}

appid - any GUID
certhas - this is the thumb print from the step 2

设置主机

设置为HTTPS并启用传输安全性：

string baseAddress = "https://" + Environment.MachineName + ":8000/Service";
var binding = new WebHttpBinding();
binding.Security.Mode = WebHttpSecurityMode.Transport;

详细参考资料

How to: Create and Install Temporary Certificates in WCF for Transport Security During Development（MSDN）
Configuring HTTP and HTTPS（MSDN）
How to: Configure a Port with an SSL Certificate（MSDN）

如果你遇到添加sslcert的问题：

Stack Overflow问题 Self-hosting using SSL and WCF - can't bind certificate to port
Stack Overflow问题 Using netsh, bind an SSL certificate to a port number is failing
Stack Overflow问题 Certificate on WCF service that does not use IIS

Answer 2

在VS.NET 2010中创建一个新的控制台应用程序项目。现在添加对dll的引用

 a.  System.ServiceModel
 b.  System.ServiceModel.Web
 c.  System.Runtime.Serialization

Program.cs Main方法具有以下代码

public class Program
    {
        public static void Main(string[] args)
        {
            Uri baseAddress = new Uri("https://"+Environment.MachineName+":54321/hello");
            using (ServiceHost host = new ServiceHost(typeof(HelloWorldService), baseAddress))
            {                
                WebHttpBinding web = new WebHttpBinding();
                web.Security.Mode = WebHttpSecurityMode.Transport;                
                host.AddServiceEndpoint(typeof(IHelloWorldService), web, "").Behaviors.Add(new WebHttpBehavior());                                
                host.Credentials.ServiceCertificate.Certificate = (X509Certificate2)GetX509Certificate();                               
                host.Open();
                Console.WriteLine("The service is ready at {0}", baseAddress);
                Console.WriteLine("Press <Enter> to stop the service.");
                Console.ReadLine();                
                host.Close();
            }
        }

        private static X509Certificate GetX509Certificate()
        {
            X509Store store = new X509Store(StoreName.My, StoreLocation.LocalMachine);
            store.Open(OpenFlags.OpenExistingOnly);
            X509Certificate certificate = null;
            X509Certificate2Collection cers = store.Certificates.Find(X509FindType.FindBySubjectName, "localhost", false);            
            if (cers.Count > 0)
            {
                certificate = cers[0];
            }
            store.Close();
            return certificate;
        }
    }

[ServiceContract]
    public interface IHelloWorldService
    {
        [WebGet(UriTemplate="SayHello/{name}")]
        string SayHello(string name);
    }

    public class HelloWorldService : IHelloWorldService
    {
        public string SayHello(string name)
        {
            return string.Format("Hello, {0}", name);
        }
    }

现在我们通过创建以下命令的批处理文件（取自MSDN）并从VS.NET命令提示符执行来创建证书：

echo off
setlocal

call :setscriptvariables %1
IF NOT DEFINED SUPPORTED_MODE call :displayusage
IF DEFINED SUPPORTED_MODE call :cleancerts
IF DEFINED SETUP_SERVICE call :setupservice
IF DEFINED SETUP_CLIENT call :setupclient
GOTO end

:cleancerts
REM cleans up certs from previous runs.    
certmgr.exe -del -r CurrentUser -s My -c -n %CLIENT_NAME%
certmgr.exe -del -r CurrentUser -s TrustedPeople -c -n localhost
certmgr.exe -del -r LocalMachine -s My -c -n localhost
certmgr.exe -del -r LocalMachine -s TrustedPeople -c -n %CLIENT_NAME%
certmgr.exe -put -r LocalMachine -s My -c -n %COMPUTER_NAME% computer.cer
IF %ERRORLEVEL% EQU 0 (
   DEL computer.cer       
   pause
   certmgr.exe -del -r LocalMachine -s My -c -n %COMPUTER_NAME%
)

:cleanupcompleted   

GOTO :EOF

:setupclient
makecert.exe -sr CurrentUser -ss MY -a sha1 -n CN=%CLIENT_NAME% -sky exchange -pe

IF DEFINED EXPORT_CLIENT (        
    certmgr.exe -put -r CurrentUser -s My -c -n %CLIENT_NAME% client.cer
) ELSE (        
    certmgr.exe -add -r CurrentUser -s My -c -n %CLIENT_NAME% -r LocalMachine -s TrustedPeople
)
GOTO :EOF

:setupservice
makecert.exe -sr LocalMachine -ss MY -a sha1 -n CN=%SERVER_NAME% -sky exchange -pe

IF DEFINED EXPORT_SERVICE (       
    certmgr.exe -put -r LocalMachine -s My -c -n %SERVER_NAME% service.cer
) ELSE (        
    certmgr.exe -add -r LocalMachine -s My -c -n %SERVER_NAME% -r CurrentUser -s TrustedPeople
)
GOTO :EOF

:setscriptvariables
REM Parses the input to determine if we are setting this up for a single machine, client, or server
REM sets the appropriate name variables
call :setcomputername
IF [%1]==[] CALL :singlemachine
IF [%1]==[service] CALL :service
IF [%1]==[client] CALL :client

set CLIENT_NAME=client.com

GOTO :EOF

:singlemachine    
SET SUPPORTED_MODE=1
SET SETUP_CLIENT=1
SET SETUP_SERVICE=1
SET SERVER_NAME=localhost
GOTO :EOF

:service    
SET SUPPORTED_MODE=1
SET SETUP_SERVICE=1
SET EXPORT_SERVICE=1
SET SERVER_NAME=%COMPUTER_NAME%
GOTO :EOF

:client   
SET SUPPORTED_MODE=1
SET SETUP_CLIENT=1
SET EXPORT_CLIENT=1
GOTO :EOF

:setcomputername
REM Puts the Fully Qualified Name of the Computer into a variable named COMPUTER_NAME
for /F "delims=" %%i in ('cscript /nologo GetComputerName.vbs') do set COMPUTER_NAME=%%i
GOTO :EOF

:displayusage
ECHO Correct usage:
ECHO     Single Machine - Setup.bat
ECHO     Client Machine - Setup.bat client
ECHO     Service Machine - Setup.bat service
:end

现在打开Microsoft管理控制台并选择文件 - ＆gt;添加/删除管理单元以添加证书 - 当前用户和证书 - 本地计算机存储

导航到证书 - 本地计算机个人存储，以查找已创建和安装的名为localhost（自签名）的服务器证书。

现在打开您的IIS，右键单击默认网站，添加HTTPS绑定，并使用您在控制台应用程序中定义的端口号（对于我的54321），并选择证书为“localhost”（在上述步骤中创建的证书）并单击“确定”和“关闭”

enter image description here

现在启动您的控制台应用程序以使您的服务正常运行，现在打开fiddler并执行GET请求，如下所示：

GET https://rajeshwin7:54321/hello/sayhello/rajesh HTTP/1.1
User-Agent: Fiddler
Host: rajeshwin7:54321

现在你回复如下的回复：

HTTP/1.1 200 OK
Content-Length: 90
Content-Type: application/xml; charset=utf-8
Server: Microsoft-HTTPAPI/2.0
Date: Fri, 04 May 2012 14:51:25 GMT

<string xmlns="http://schemas.microsoft.com/2003/10/Serialization/">Hello, rajesh</string>

当没有IIS时，打开命令提示符并在命令提示符下输入以下内容，使用winvista及以上操作系统中的netsh工具和winxp中的httpcfg为ssl证书执行http端口映射。

C:\> netsh http add sslcert ipport=0.0.0.0:54321 certhash=6797aea29440de9389bc636e15a35b741d8c22a3 appid={2e80948d-9ae6-42c9-ad33-294929333965}

certhash - 上面创建的证书的指纹ID。可以通过打开Microsoft管理控制台 - 在本地计算机上为计算机帐户的证书存储添加/删除管理单元，然后导航到个人存储以查找证书（假设已按上面给出的安装）然后再打开指纹ID来获取指纹ID双击证书并导航到详细信息选项卡，找到指纹ID作为其中一个属性（只需通过删除空格复制它以在上面的netsh命令中使用）

appid - 是与您的应用程序相关联的guid，可以在项目属性文件夹的assembly.cs文件中找到，如下所示：

enter image description here

现在要清理证书，使用以下命令创建一个bathc文件，并使用Vs.NET命令提示符执行它：

echo off
setlocal
set CLIENT_NAME=client.com
call :setcomputername
call :cleancerts
DEL client.cer > NUL 2>&1
DEL service.cer > NUL 2>&1
GOTO end

:cleancerts
REM cleans up certs from previous runs.
certmgr.exe -del -r CurrentUser -s My -c -n %CLIENT_NAME%
certmgr.exe -del -r CurrentUser -s TrustedPeople -c -n localhost

certmgr.exe -del -r LocalMachine -s My -c -n localhost
certmgr.exe -del -r LocalMachine -s TrustedPeople -c -n %CLIENT_NAME%
certmgr.exe -put -r LocalMachine -s My -c -n %COMPUTER_NAME% computer.cer
IF %ERRORLEVEL% EQU 0 (
   DEL computer.cer
   pause
   certmgr.exe -del -r LocalMachine -s My -c -n %COMPUTER_NAME%
)

:cleanupcompleted
GOTO :EOF

:setcomputername
REM Puts the Fully Qualified Name of the Computer into a variable named COMPUTER_NAME
for /F "delims=" %%i in ('cscript /nologo GetComputerName.vbs') do set COMPUTER_NAME=%%i
GOTO :EOF

:end

您可以使用netsh命令删除ssl证书映射到端口，如下所示：

c:\> netsh http delete sslcert ipport:0.0.0.0:54321

来自控制台应用程序的HTTPS？

2 个答案: