Question

我有自托管的WCF服务和数千个客户端安装。新服务器证书具有不同的DNS名称（* .mydomain.com而不是mydomain.com），这就是DNS身份停止工作的原因。有没有办法通过仅更改服务器端代码/ confg来取消证书验证？

客户端

   var binding = new NetTcpBinding
    {
        Security =
        {
            Mode = SecurityMode.Transport,
            Transport = {ClientCredentialType = TcpClientCredentialType.None}
        }
    };

    _proxyClientHost = new ChannelFactory<IMyClientApp>(binding, 
                                                        new EndpointAddress(new Uri("myservice.mydomain.com"),
                                                        EndpointIdentity.CreateDnsIdentity("*.mydomain.com")));

服务器

_serviceHost = new ServiceHost(typeof(MyClientApp));
_serviceHost.Credentials.ServiceCertificate.SetCertificate(StoreLocation.LocalMachine, StoreName.My, X509FindType.FindByThumbprint, "Certificate ThmubPrint Value …");
_serviceHost.Open();

服务器配置：

服务部分：

<service behaviorConfiguration="serviceBehavior" 
                     name="MyService ">
                <endpoint 
                                binding="netTcpBinding" 
                                bindingConfiguration="netTcpSettings" 
                                name="netTcpEP" 
                                contract="MyContract" />
                <host>
                                <baseAddresses>
                                                <add baseAddress="net.tcp://mycomuter:333" />
                                </baseAddresses>
                </host>
</service>

行为：

<behavior name="serviceBehavior">
                <serviceDebug includeExceptionDetailInFaults="True" httpHelpPageEnabled="false" />
                <serviceThrottling maxConcurrentCalls="32" maxConcurrentSessions="30" maxConcurrentInstances="2147483647" />
</behavior>

结合：

<binding name="netTcpSettings" closeTimeout="00:10:00" openTimeout="00:10:00" receiveTimeout="00:10:00" sendTimeout="00:10:00">
                <reliableSession ordered="true" inactivityTimeout="00:10:00" enabled="false" />
                <security>
                                <transport clientCredentialType="None">
                                                <extendedProtectionPolicy policyEnforcement="Never"  />
                                </transport>
                                <message clientCredentialType="Windows" algorithmSuite="TripleDesSha256" />
                </security>
</binding>

Answer 1

您不能只在服务器上停用证书验证。因为客户端检查证书是否有效。很抱歉告诉你。

如果要关闭验证，则需要为客户端键入一些代码...如果需要，您可以询问如何在客户端上停用/配置验证器。这是一个简单的方法。

如何在服务器上禁用DNS身份检查

1 个答案: