Question

经过一周（！）的搜索，我希望有人能够告诉我我做错了什么。

我继续收到以下错误消息：

X.509证书CN = localhost链构建失败。使用的证书具有无法验证的信任链。替换证书或更改certificateValidationMode。

从头开始。这是我的code / config服务器端：

ServiceHost svcHost = new ServiceHost(typeof(TestService));          

// Enable metadata publishing.
ServiceMetadataBehavior smb = svcHost.Description.Behaviors.Find<ServiceMetadataBehavior>();
if (smb == null)
    smb = new ServiceMetadataBehavior();
smb.HttpGetEnabled = true;
smb.MetadataExporter.PolicyVersion = PolicyVersion.Policy15;
svcHost.Description.Behaviors.Add(smb);

ServiceDebugBehavior sdb = svcHost.Description.Behaviors.Find<ServiceDebugBehavior>();
if (sdb == null) { sdb = new ServiceDebugBehavior(); svcHost.Description.Behaviors.Add(sdb); }
sdb.IncludeExceptionDetailInFaults = true;

// Meta data servicepoint
svcHost.AddServiceEndpoint(ServiceMetadataBehavior.MexContractName, MetadataExchangeBindings.CreateMexHttpBinding(), "mex");

// Credentials          
CustomUserNamePasswordValidator clientAuthenticationValidator = new TCustomUserNamePasswordValidator();
svcHost.Credentials.UserNameAuthentication.UserNamePasswordValidationMode = UserNamePasswordValidationMode.Custom;
svcHost.Credentials.UserNameAuthentication.CustomUserNamePasswordValidator = (UserNamePasswordValidator) clientAuthenticationValidator;

// Certificate
svcHost.Credentials.ServiceCertificate.Certificate = new X509Certificate2("TestServer.pfx", "password");        
svcHost.Credentials.IssuedTokenAuthentication.CertificateValidationMode = X509CertificateValidationMode.ChainTrust;
svcHost.Credentials.IssuedTokenAuthentication.RevocationMode = X509RevocationMode.None;
svcHost.Credentials.IssuedTokenAuthentication.TrustedStoreLocation = StoreLocation.LocalMachine;

// Binding
NetTcpBinding netTcpBinding = new NetTcpBinding();
netTcpBinding.Security.Mode = SecurityMode.Message;            
netTcpBinding.Security.Transport.ProtectionLevel = System.Net.Security.ProtectionLevel.EncryptAndSign;
netTcpBinding.Security.Message.ClientCredentialType = MessageCredentialType.UserName;
netTcpBinding.ReliableSession.Enabled = true;
svcHost.AddServiceEndpoint(typeof(ITestService), netTcpBinding, "");

svcHost.Open();

使用以下app.config文件：

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
    <system.serviceModel>
        <services>
            <service name="TestService">
                <host>
                    <baseAddresses>
                        <add baseAddress="http://localhost:8080/" />
                        <add baseAddress="net.tcp://localhost:9595" />
                    </baseAddresses>
                </host>
            </service>
        </services>      
    </system.serviceModel>
</configuration>

我用以获取证书的以下命令：
根CA：

makecert.exe -n“CN = TestCA”-r -pe -a sha512 -len 4096 -cy authority -sr LocalMachine -ss Root -sv TestCA.pvk TestCA.cer pvk2pfx.exe -pvk TestCA.pvk -spc TestCA.cer -pfx TestCA.pfx -po aaaaa

服务

makecert.exe -n“CN = localhost”-iv TestCA.pvk -ic TestCA.cer -pe -a sha512 -len 4096 -b 12/14/2014 -e 01/01/2020 -sky exchange -eku 1.3.6.1.5.5.7.3.1 -sv TestServer.pvk TestServer.cer pvk2pfx.exe -pvk TestServer.pvk -spc TestServer.cer -pfx TestServer.pfx -po aaaaa

我在受信任的根CA中导入TestCA.cer，如代码所示，pfx文件用作servicecertificate。

据我所知，我不必为客户端提供证书，因为它使用用户名凭证来验证自身，其中servicecertificate用于ssl。如上所述，只要我启动客户端并调用函数，我就会得到上述异常。

我已经尝试使用netsh将TestServer证书附加到9595端口。我在同一台计算机上运行客户端和服务。

我真的希望有人可以提供帮助。

Answer 1

问题很可能是由客户端“不信任”的自签名证书引起的。为了适应这种情况，您有以下几种选择：

将自签名证书导入客户端计算机 “值得信赖的人”商店。
按照MSDN指南Create and Install Temporary Certificates in WCF for Message Security During Development
更新客户端软件以绕过定义here的证书验证检查。

Trustchain错误NetTcpBinding与消息（用户名）安全性

1 个答案: