如何在服务器上禁用DNS身份检查

时间:2015-05-07 13:17:15

标签: c# wcf ssl dns certificate

我有自托管的WCF服务和数千个客户端安装。 新服务器证书具有不同的DNS名称(* .mydomain.com而不是mydomain.com),这就是DNS身份停止工作的原因。有没有办法通过仅更改服务器端代码/ confg来取消证书验证?

客户端

   var binding = new NetTcpBinding
    {
        Security =
        {
            Mode = SecurityMode.Transport,
            Transport = {ClientCredentialType = TcpClientCredentialType.None}
        }
    };

    _proxyClientHost = new ChannelFactory<IMyClientApp>(binding, 
                                                        new EndpointAddress(new Uri("myservice.mydomain.com"),
                                                        EndpointIdentity.CreateDnsIdentity("*.mydomain.com")));

服务器

_serviceHost = new ServiceHost(typeof(MyClientApp));
_serviceHost.Credentials.ServiceCertificate.SetCertificate(StoreLocation.LocalMachine, StoreName.My, X509FindType.FindByThumbprint, "Certificate ThmubPrint Value …");
_serviceHost.Open();

服务器配置:

服务部分:

<service behaviorConfiguration="serviceBehavior" 
                     name="MyService ">
                <endpoint 
                                binding="netTcpBinding" 
                                bindingConfiguration="netTcpSettings" 
                                name="netTcpEP" 
                                contract="MyContract" />
                <host>
                                <baseAddresses>
                                                <add baseAddress="net.tcp://mycomuter:333" />
                                </baseAddresses>
                </host>
</service>

行为:

<behavior name="serviceBehavior">
                <serviceDebug includeExceptionDetailInFaults="True" httpHelpPageEnabled="false" />
                <serviceThrottling maxConcurrentCalls="32" maxConcurrentSessions="30" maxConcurrentInstances="2147483647" />
</behavior>

结合:

<binding name="netTcpSettings" closeTimeout="00:10:00" openTimeout="00:10:00" receiveTimeout="00:10:00" sendTimeout="00:10:00">
                <reliableSession ordered="true" inactivityTimeout="00:10:00" enabled="false" />
                <security>
                                <transport clientCredentialType="None">
                                                <extendedProtectionPolicy policyEnforcement="Never"  />
                                </transport>
                                <message clientCredentialType="Windows" algorithmSuite="TripleDesSha256" />
                </security>
</binding>

1 个答案:

答案 0 :(得分:0)

您不能只在服务器上停用证书验证。因为客户端检查证书是否有效。很抱歉告诉你。

如果要关闭验证,则需要为客户端键入一些代码...如果需要,您可以询问如何在客户端上停用/配置验证器。这是一个简单的方法。