无法为具有权限 wcf C# wcf rest 服务的 ssl/tls 建立安全通道

Question

如您所见，我创建了一个从我的 rest wcf 服务获取数据的客户端应用程序：

 Uri reqUri = new Uri("https://localhost/paymentservice.svc/listpayment");



            WebRequest req = WebRequest.Create(reqUri);

            req.PreAuthenticate = true;

            NetworkCredential credential = new NetworkCredential("test", "test123");

            req.Credentials = credential;

            WebResponse resp = req.GetResponse();


            DataContractSerializer data = new DataContractSerializer(typeof(string));
            var res = data.ReadObject(resp.GetResponseStream());

            Console.WriteLine(res);

            Console.ReadLine();

我在 iis 中创建了一个证书，你可以这样做：

然后上传我发布的文件就可以了。 但是当我打电话给我的客户时，我收到了这个错误：

An unhandled exception of type 'System.Net.WebException' occurred in System.dll

Additional information: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel

这是我的服务 webconfig

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <configSections>
    <!-- For more information on Entity Framework configuration, visit http://go.microsoft.com/fwlink/?LinkID=237468 -->
    <section name="entityFramework" type="System.Data.Entity.Internal.ConfigFile.EntityFrameworkSection, EntityFramework, Version=6.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" requirePermission="false" />
  </configSections>
  <appSettings>
    <add key="aspnet:UseTaskFriendlySynchronizationContext" value="true" />
  </appSettings>
  <system.web>
    <compilation debug="true" targetFramework="4.5.2" />
    <httpRuntime targetFramework="4.5.2" />
    <httpModules>
      <add name="ApplicationInsightsWebTracking" type="Microsoft.ApplicationInsights.Web.ApplicationInsightsHttpModule, Microsoft.AI.Web" />
    </httpModules>
    <authentication mode="None" />
  </system.web>
  <system.serviceModel>
    <bindings>
      <basicHttpBinding>
        <binding name="secureHttpBinding">
          <security mode="Message">
            <message clientCredentialType="UserName" />
          </security>
        </binding>
      </basicHttpBinding>
    </bindings>
    <services>
      <service name="Payment.Application.ServiceImplement.PaymentService" behaviorConfiguration="customBehaviour">
        <endpoint address=""
                  binding="webHttpBinding"
                  contract="Payment.Domain.Service.IPaymentService"
                  behaviorConfiguration="web"/>

      </service>
      <service name="Payment.Infrustructure.RepositoryImplement.PaymentRepository" behaviorConfiguration="customBehaviour" >
        <endpoint address=""
                  binding="webHttpBinding"
                  contract="Payment.Domain.Repository.IPaymentRepository"
                  behaviorConfiguration="web"/>
      </service>

    </services>

    <behaviors>
      <serviceBehaviors>
        <behavior  name="customBehaviour">
          <serviceCredentials>
            <userNameAuthentication userNamePasswordValidationMode="Custom"
                                    customUserNamePasswordValidatorType="Payment.Service.UserAuthentication,Payment.Service"/>
          </serviceCredentials>

          <!-- To avoid disclosing metadata information, set the values below to false before deployment -->
          <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true" />
          <!-- To receive exception details in faults for debugging purposes, set the value below to true.  Set to false before deployment to avoid disclosing exception information -->
          <serviceDebug includeExceptionDetailInFaults="false" />
        </behavior>
      </serviceBehaviors>
      <endpointBehaviors>

        <behavior name="web">
          <webHttp/>

        </behavior>
      </endpointBehaviors>
    </behaviors>
    <protocolMapping>
      <add binding="basicHttpsBinding" scheme="https" />
    </protocolMapping>
    <serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
  </system.serviceModel>

  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <add name="Access-Control-Allow-Methods" value="GET, POST,PUT,DELETE" />
      </customHeaders>
    </httpProtocol>
    <modules runAllManagedModulesForAllRequests="true">
      <remove name="ApplicationInsightsWebTracking" />
      <add name="ApplicationInsightsWebTracking" type="Microsoft.ApplicationInsights.Web.ApplicationInsightsHttpModule, Microsoft.AI.Web" preCondition="managedHandler" />
    </modules>
    <!--
        To browse web app root directory during debugging, set the value below to true.
        Set to false before deployment to avoid disclosing web app folder information.
      -->
    <directoryBrowse enabled="true" />
    <validation validateIntegratedModeConfiguration="false" />
  </system.webServer>
  <entityFramework>
    <defaultConnectionFactory type="System.Data.Entity.Infrastructure.SqlConnectionFactory, EntityFramework" />
    <providers>
      <provider invariantName="System.Data.SqlClient" type="System.Data.Entity.SqlServer.SqlProviderServices, EntityFramework.SqlServer" />
    </providers>
  </entityFramework>
  <connectionStrings>
    <add name="DefaultConnection" connectionString="Data Source=.;initial catalog=SymfaDB;user id= sa ;password=12345;" providerName="System.Data.SqlClient" />
    <!--<add name="DefaultConnection" connectionString="Data Source=92.50.12.222,1433;initial catalog=ParkingDB;user id= sa ;password=123qweQWE@;" providerName="System.Data.SqlClient" />-->
  </connectionStrings>
</configuration>

当我在 Visual Studio 中运行项目并调用此 URL http://localhost:4428/PaymentService.svc/listpayment 时，我得到了您所看到的数据：

但是当我将发布文件上传到 iis 并调用此 url https://localhost/PaymentService.svc/listpayment 时，您可以看到我收到此错误：

当我打电话给https://localhost/PaymentService.svc 时，您可以看到我的服务可用。

Answer 1

您需要将证书安装为可信来源。

1. 以管理员权限打开命令提示符，键入“mmc”并按 Enter，这将打开 Microsoft 管理控制台。
2. 从菜单转到文件 > 添加/删除管理单元，选择证书并单击添加
3. 选择计算机帐户并单击下一步，选择本地计算机并单击完成。
4. 转到证书（本地计算机）> 个人 > 证书
5. 从菜单转到操作 > 所有任务 > 导入
6. 在证书导入向导中单击下一步，提供证书文件的路径，输入密码（如果有），然后单击下一步、下一步和完成。
7. 现在您将返回 Microsoft 管理控制台，单击受信任的根证书颁发机构，选择证书、操作 > 所有任务 > 导入并按照步骤 6 操作。

URL 中使用的主机名也应与证书上的名称匹配。确保您使用的 URL 与证书“颁发给”字段上的 URL 相同。

Answer 2

要消除此错误，请使用与“颁发给”证书部分完全相同的机器名称。例如，如果您打开您的证书，那么您会看到颁发给财产，这应该是您的机器名称。如果您的机器是域的一部分，则机器名称将类似于 .. 等，因此如果您在浏览器中打开它，您的机器将完全限定名称，那么您将不会收到该错误。 所以我只是按域调用我的服务，例如https://union-pc58.union.com/Service1.svc

点击这个链接

http://www.c-sharpcorner.com/UploadFile/vendettamit/create-secure-wcf-rest-api-with-custom-basic-authentication/