Question

我有一种情况，我需要签署一个带有X509证书的soap请求供java web服务使用。通过WCF的魔力，我们能够正确地形成信封，并且所有看起来都比标准的http好。但是，一旦我们转向HTTPS（客户端要求），我们就会开始收到错误“无法建立具有权限的SSL / TLS安全通道的信任关系”..我们已尝试调整某些设置并将目标域更改为其他已知HTTPS站点，我们仍然收到相同的错误。以下是我们的客户配置，非常感谢！

<?xml version="1.0"?>
<configuration>
  <system.serviceModel>
    <bindings>
      <customBinding>
        <binding
          name="myCustomBinding"
          closeTimeout="00:01:00"
          openTimeout="00:01:00"
          receiveTimeout="00:10:00"
          sendTimeout="00:01:00">
          <textMessageEncoding
                  messageVersion="Soap11" />
          <security
            allowInsecureTransport="true"
            authenticationMode="MutualCertificate"
            requireDerivedKeys="false"
            keyEntropyMode="ClientEntropy"
            includeTimestamp="false"
            securityHeaderLayout="Lax"
            messageProtectionOrder="SignBeforeEncrypt"
            messageSecurityVersion="WSSecurity10WSTrust13WSSecureConversation13WSSecurityPolicy12BasicSecurityProfile10">
            <secureConversationBootstrap />
          </security>
          <httpsTransport />
        </binding>
      </customBinding>
    </bindings>
    <behaviors>
      <endpointBehaviors>
        <behavior name="wsHttpCertificateBehavior">
          <clientCredentials>
            <clientCertificate
              findValue="MyCertName"
              storeLocation="LocalMachine"
              x509FindType="FindByIssuerName"/>
            <serviceCertificate>
              <authentication
                revocationMode="NoCheck"
                trustedStoreLocation="LocalMachine" />
            </serviceCertificate>
          </clientCredentials>
        </behavior>
      </endpointBehaviors>
    </behaviors>
    <client>
      <endpoint
        address="https://www.SomeUrl.com"
        binding="customBinding"
        bindingConfiguration="myCustomBinding"
        behaviorConfiguration="wsHttpCertificateBehavior"
        contract="ServiceReference1.ServiceTest"
        name="untk48_dfSoap">
        <identity>
          <certificateReference findValue="MyCertName" storeLocation="LocalMachine" x509FindType="FindByIssuerName"/>
        </identity>
      </endpoint>
    </client>
  </system.serviceModel>
  <startup>
    <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.0"/>
  </startup>
</configuration>

Answer 1

您的证书友好名称是否与https的域名相匹配？

我过去必须做的是让HTTPS WCF正确验证

例如

友好名称box1.mycompany.au.net

请求的域名https://box1.mycompany.au.net

Answer 2

在客户端上安装证书，您将不会遇到此问题。安装时，请确保将其安装到中级证书颁发机构和受信任的根证书颁发机构。

为我工作。

通过HTTPS进行WCF customBinding

2 个答案: