Change to self signed certificate results in communication problem? - wcf

Question

I have a C# client that connects to diffrent services like Elastic Search, IdentityService but also a WCF service. All of them are using a certificate to encrypt communication which have been working great. The problem is that I have to revert to a self-signed certificate and the WCF sevice do not like it at all.
When trying to connect to the service I get “This could be due to the fact that the server certificate is not configured properly with HTTP.SYS in the HTTPS case”? I changed the
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
to
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12 | SecurityProtocolType.Ssl3;
But that did help. I did get a bit further but not much.
The certificate is generated with this command :
openssl req -x509 -newkey rsa:4096 -sha256 -utf8 -days 365 -nodes -config ./config/tiny_openssl.conf -keyout ./certificates/private.key -out ./certificates/certificate.crt
# ./config/tiny_openssl.conf
[CA_default]
copy_extensions = copy
[req]
default_bits = 4096
prompt = no
default_md = sha256
distinguished_name = req_distinguished_name
x509_extensions = v3_ca
[req_distinguished_name]
C = NO
ST = no
L = no
O = no
OU = myservice
emailAddress = myservice#no.com
CN = myservice Services Titan
[v3_ca]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment
subjectAltName = #alternate_names
[alternate_names]
DNS.1 = 192.168.130.29
DNS.2 = *.192.168.130.29
DNS.3 = app.192.168.130.29
DNS.4 = myservice
DNS.5 = myservice.local
DNS.6 = TITAN.myservice.local
# ...
Why do I get these problems? Is there a way to generate a selfsigned certificate that would be granted by WCF just like the "real" one?
Edit : I have added the private key to the selfsigned certificate with openSSL.

Answer 1

I didn’t know which web server you use to host the WCF service and how to bind the particular certificate to a port. But In a Windows OS, I have to add an Https site binding when I use IIS to host the WCF service with transport security.
https://learn.microsoft.com/en-us/dotnet/framework/wcf/feature-details/how-to-configure-an-iis-hosted-wcf-service-with-ssl
In a console application, I usually bind a certificate to the particular port by the below command.
netsh http add sslcert ipport=0.0.0.0:8000
certhash=0000000000003ed9cd0c315bbb6dc1c08da5e6
appid={00112233-4455-6677-8899-AABBCCDDEEFF}
https://learn.microsoft.com/en-us/dotnet/framework/wcf/feature-details/how-to-configure-a-port-with-an-ssl-certificate
https://learn.microsoft.com/en-us/windows/win32/http/add-sslcert
Or the same error will occur when the client-side try to connect the service over HTTPS protocol.
“This could be due to the fact that the server certificate is not
configured properly with HTTP.SYS…”
Both Powershell and IIS have a tool to generate a certificate. It works for me.
https://learn.microsoft.com/en-us/powershell/module/pkiclient/new-selfsignedcertificate?view=win10-ps
Feel free to let me know if there is anything I can help with.