CODEWITHSUNDEEP
wcf.net-corewcf-security
Ronald Mokens
Ronald Mokens

Reputation: 101

Configuration for ClientCredentials ServiceCertificate authentication not applied or used

I am building a .NET Core 3.1 application where I am trying to call a WCF Service over HTTPS and temporarily disabling SSL authentication for the server certificate.

There is a clearly documented way to achieve this. Namely, by setting the ServiceCertificate.SslCertificateAuthentication property on the ChannelFactory class.

Below is code for setting up het Binding, endpoint and ClientCredentials.

var endpointAddress = new EndpointAddress("https://*.com");
var binding = new BasicHttpsBinding();

binding.Security.Mode = BasicHttpsSecurityMode.Transport;
binding.Security.Transport = new HttpTransportSecurity()
{
  ClientCredentialType = HttpClientCredentialType.None
};

var factory = new ChannelFactory<IService>(binding, endpointAddress);
factory.Credentials.ServiceCertificate.SslCertificateAuthentication = new X509ServiceCertificateAuthentication()
{
  CertificateValidationMode = X509CertificateValidationMode.None,
  RevocationMode = X509RevocationMode.NoCheck
};

factory.Credentials.ServiceCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.None;
factory.Credentials.ServiceCertificate.Authentication.RevocationMode = X509RevocationMode.NoCheck;

var client = factory.CreateChannel();
client.Call();

However, when I run this code I receive the exception chain:

I would expect the WCF client to have skipped SSL authentication.

I also tried to use a custom certificate validator, by extending the X509CertificateValidator and configuring this in the following way:

factory.Credentials.ServiceCertificate.SslCertificateAuthentication = new X509ServiceCertificateAuthentication()
{
  CertificateValidationMode = X509CertificateValidationMode.Custom,
  CustomCertificateValidator = new CustomCertificateValidator();
};

factory.Credentials.ServiceCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.Custom;
factory.Credentials.ServiceCertificate.Authentication.CustomCertificateValidator = new CustomCertificateValidator();

As you might expect as this point, I receive the same exceptions as before. Even worse though, my CustomCertificate.Validate(..) method was not being called at all.

WCF seems to provide an API which allows for quite a bit of control but no matter what I try, my policies/configurations do not seem to by honoured in any way.

What might be going on here?

Upvotes: 1

Views: 3550

Answers (1)

Abraham Qian
Abraham Qian

Reputation: 7522

The below code will work when requiring the SSL authentication in a DotCore project.

Uri uri = new Uri("https://vabqia969vm:21011");
            BasicHttpsBinding binding = new BasicHttpsBinding();
            binding.Security.Mode = BasicHttpsSecurityMode.Transport;
            binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.None;
            ChannelFactory<IService> factory = new ChannelFactory<IService>(binding, new EndpointAddress(uri));

            factory.Credentials.ServiceCertificate.SslCertificateAuthentication = new System.ServiceModel.Security.X509ServiceCertificateAuthentication()
            {
                CertificateValidationMode = System.ServiceModel.Security.X509CertificateValidationMode.None,
                RevocationMode = System.Security.Cryptography.X509Certificates.X509RevocationMode.NoCheck
            };

            //these two lines will not work.
            //factory.Credentials.ServiceCertificate.Authentication.CertificateValidationMode = System.ServiceModel.Security.X509CertificateValidationMode.None;
            //factory.Credentials.ServiceCertificate.Authentication.RevocationMode = System.Security.Cryptography.X509Certificates.X509RevocationMode.NoCheck;

            var client = factory.CreateChannel();
            var result = client.TestAsync();
            Console.WriteLine(result.Result);

On my side, it works perfectly. I think there is something wrong with the server-side. As you know, we should ensure that the binding type between the client-side and the server-side is consistent. What are the details on the server-side?

Upvotes: 2

Related Questions