Self-hosted WCF Service with SSL on XP SP3 - wcf

Question

I've seen about 1000 posts on StackOverflow, blogs, and other sites, but none have been able to shed light on the problem I'm having.
Setup:
WCF self-hosted service (NOT IIS) using .NET Framework 3.5 (sorry, can't upgrade), WebHttpBinding
A single endpoint using WebGet in the interface
NO .config files -- everything is being created programmatically
The service is bound to a custom port and NOT sharing a port with any other service or website
Deployment targets:
XP SP3, 2003, Vista, 7, 8, 2008
Problem: On Vista, 7, 8, 2008 I have no problems. I'm getting the service up and running on HTTP as well as HTTPS with a self-signed certificate bound to localhost as well as the machine name on a custom port.
BUT on XP, I can only get things working on HTTP, so I know the service itself is working properly. On HTTPS, I'm not able to make a connection because of an SSL failure.
If I hit the URL directly in a browser, I see an SSL exception.
In IE, it gives a warning that the certificate is not trusted. When I allow the exception, it gets to the service and executes. If I add https://localhost to trusted sites, I no longer see the warning and can hit the URL without issue.
When I hit the same URL in Chrome, I get an Error 107 ERR_SSL_PROTOCOL_ERROR and I cannot bypass it.
In Firefox, I get a ssl_error_rx_record_too_long error and it also cannot be bypassed.
I've gone through several permutations of certificates and methods of assigning them to the service (httpcfg, etc.), all with the same results (or worse). So, instead of going back and forth trying to figure out what I've done and picking apart my existing settings, I have 2 questions:
Is it even possible to create a trusted certificate on XP for localhost WITHOUT IIS and...
What's the best way to bind it to a self-hosted WCF service with everything being done programmatically? I repeat this because other attempts to get assistance on these issues invariably leads to folks telling me what to put in a config file.
Things to keep in mind: I already have this all working fine on Windows versions > XP/2003 under SSL with self-signed certificates, so I know the fundamentals are somewhat sound. I just can't seem to get the certificate set up under XP for localhost.

Answer 1

My answer is based on an assumption that if you were making WCF call from client code, you will get "Could not establish trust relationship for the SSL/TLS secure...." exception.
If that's true, I would recommend that you implement custom ICertificatePolicy and use it while making the WCF call. Here's a sample implementation.
using System.Net;
using System.Net.Security;
using System.Security.Cryptography.X509Certificates;
namespace Foo.bar
{
public class MyCertificatePolicy : ICertificatePolicy
{
public bool CheckValidationResult(ServicePoint srvPoint, X509Certificate certificate, WebRequest request, int certificateProblem)
{
//Due an Invalid Certificate used in the site, we must return true to all invalid SSL Request. Alternately, write the logic to validate the server certificate
return true;
}
public static bool RemoteCertificateValidationCallback(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
//Due an Invalid Certificate used in the site, we must return true to all invalid SSL Request
return true;
}
}
}

Answer 2

In my case i do it like this:
ServiceHost host = new ServiceHost(typeof(MyRequests), baseAddresses);
Then setup my metadata:
ServiceMetadataBehavior smb = new ServiceMetadataBehavior();
smb.HttpsGetEnabled = true;
smb.MetadataExporter.PolicyVersion = PolicyVersion.Policy15;
host.Description.Behaviors.Add(smb);
For Windows authentication and message secutiry i create and setup my ws binding:
WSHttpBinding b = new WSHttpBinding(SecurityMode.Message);
b.Security.Message.ClientCredentialType = MessageCredentialType.Windows;
b.MaxReceivedMessageSize = Int32.MaxValue;
// auth setup
X509ClientCertificateAuthentication myAuthProperties =
host.Credentials.ClientCertificate.Authentication;
myAuthProperties.IncludeWindowsGroups = true;
// add endpoint
ServiceEndpoint endpnt = host.AddServiceEndpoint(typeof(IMyRequests), b, "MyService");
//GO!
host.Open();
I hope this will be helpful.