What are the configuration changes required to use SSL in a WCF .svc file.Did a lot of googling over the same and have tried all possible ways by configuring endpoints and service behaviors but it ends up giving endpoint not found error or 404 error .Kindly suggest if i am missing out on any thing .Attached alongwith is the web.config file.Thanx in advance
If all you need is the encryption, then HTTP Transport Security will be your solution.
Note that you will also need a SSL certificate provided by a trusted authority, such as VeriSign.
Related
I am trying to workout how to configure a CXF consumer to use https, but use basic authentication.
I presume we need to attach our certificate using the httpj:engine-factory but whenever I try and do that the server generated the follwing error:
javax.net.ssl.SSLHandshakeException: null cert chain
EDIT: I believe what is happening is that the server is requesting a client certificate, but the client does not send one. For "One Directional" SLL, I don't think the server should be asking for a certificate from the client.
How do I prevent the server from requesting a client certificate?
Any assistance greatly appreciated.
You need to install certificate in your JVM trust store. Please go through below link:
How to solve javax.net.ssl.SSLHandshakeException Error?
It turned out to be quite simple. In the httpj:engine-factory, there is a setting for client authentication.
<sec:clientAuthentication want="false" required="false"/>
This controls whether the server requests a certificate from the client. I had copied this from samples with Bi-Directional SSL and these values were set to true.
We have a wcf service hosted in IIS. We like to restrict the client callers to known clients so we implemented a custom X509CertificateValidator. The service is configured with WSHttpBinding binding and IIS set to SSL and require client certificate. Everything is working as expected.
However, we found that we have other aspx pages hosted within the same site that should not require client certificate. It breaks our usage pattern.
I read that turning the IIS setting from Required Client Certificate to Accept Client certificate does not work. I tried this out, while still passing in the client cert from client and it seems to invoke my custom validator. However, using wcf proxy library, I'm unable to call it without a client cert to verify not passing one in.
If "accept client certificate" is not an option, what is the best alternative? Adding some type of message inspector?
Thanks very much in advance.
I think there's a gap in my mental model of WCF authentication, hoping someone can help me fill it in.
So, I'm creating a WCF service and would like to have clients authenticate using certificates, and message-level security. I'd like the service to validate these using chain trust so that I don't need each client cert installed on the service. For now, I'm not interested in having the service authenticate to the client.
Here's my understanding of what's needed to do this:
The client needs a certificate signed by a CA that's trusted on the service side.
The service needs a CRL installed for that CA.
The service config should have message security turned on, specify clientCredentialType="Certificate", and chain trust for client certificate validation.
The client config should have message security turned on, specify clientCredentialType="Certificate", and an endpoint behavior that tells how to find the client certificate in the store.
The client makes a request to the service, sending its certificate. The service sees that the client's cert is signed by its trusted CA and lets the request through.
Now, all of the walkthroughs of this process I've found also include a step of creating a certificate for the service. None of them explain what this is for, which is throwing me. Why is a service certificate needed if I just want to authenticate the clients?
You are right. In theory no server certificate is required, in practice wcf enforce you to use one. The good news is that you should use a dummy certificate for the server and also set ProtectionLevel to SignOnly. I suggest to read this article which talks on a similar scenario and mostly relevant.
Can anyone explain to me when a certifate is require using WCF and authentication. From my understanding although i could be way off :-)
basichttp doesn't require a certificate to do authentication is hosted in IIS and using SSL otherwise a certificate is required
All other bindings like netTcpBindings etc require the use of certficate - is this true?
Or does it depend on what type of authentication i am using?
I would really appreciate any info or maybe a table telling me when a certifcate is needed.
I have a number of scenerios i am investigating like hosting in IIS or hosting in WIndows Service..
And i just can't seem to find the info i need
THanks in advance
There are two scenarios where you need a certificate:
A server side certificated that is used for SSL. For basichttpbinding, if you are sending a username and password over the network you should use SSL.
A client side certificate if you are authenticating clients using certificates.
Other bindings may use machine keys and certificates in the operating system, but you do not need to install a certificate for them to work.
I am hosting a secured WCF service (transport level security) which needs to authenticate users with third party client certificates. To accept those client certificates, I have binded my IIS7 with third party Server Certificate. Theoretically speaking this should work perfectly. But it is not, It continues to give error as
The HTTP request was forbidden with client authentication scheme 'Anonymous'.
Does anyone having idea on how to make it possible in this case?
Check out the WCF Security Guidance on Codeplex - they have tons of How-To's and extensive coverage and step-by-step explanations for all things WCF security related.
The one How-To most interesting to you would probably be:
How To – Use Certificate Authentication and Message Security in WCF