使用 WCF 客户端使用非 WCF 服务并传递客户端证书答案

【问题标题】：Use WCF Client to consume Non-WCF Service and pass Client Certificate使用 WCF 客户端使用非 WCF 服务并传递客户端证书
【发布时间】：2012-07-23 23:12:10
【问题描述】：

我有一个使用 WCF 客户端调用 Java Web 服务的 ASP.NET 应用程序。在需要证书之前，通信一直有效。我更新了配置，但我在调用时收到错误。有没有人有很好的配置示例？证书存储在证书存储中。

不需要客户端证书时的配置：

<system.serviceModel>
    <bindings>
            <basicHttpBinding>
                <binding name="DocManagementSOAP" closeTimeout="00:01:00" openTimeout="00:01:00"
                    receiveTimeout="00:10:00" sendTimeout="00:01:00" allowCookies="false"
                    bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
                    maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
                    messageEncoding="Mtom" textEncoding="utf-8" transferMode="Buffered"
                    useDefaultWebProxy="true">
                    <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
                        maxBytesPerRead="4096" maxNameTableCharCount="16384" />
                    <security mode="Transport">
                        <transport clientCredentialType="None" proxyCredentialType="None" realm="" />
                        <message clientCredentialType="UserName" algorithmSuite="Default" />
                    </security>
                </binding>
            </basicHttpBinding>
        </bindings>
        <client>
            <endpoint address="https://acme.com/services/docmanagement_V3" 
                      binding="basicHttpBinding"
                      bindingConfiguration="DocManagementSOAP"
                      contract="FileNetDmsServiceReference.docManagement" 
                      name="DocManagementSOAP" />
        </client>
    </system.serviceModel>

我正在尝试设置以通过客户端证书失败的配置：

 <system.serviceModel>
        <bindings>
            <basicHttpBinding>
                <binding name="DocManagementSOAP" 
                         closeTimeout="00:01:00" 
                         openTimeout="00:01:00"
                         receiveTimeout="00:10:00" 
                         sendTimeout="00:01:00" 
                         allowCookies="false"
                         bypassProxyOnLocal="false" 
                         hostNameComparisonMode="StrongWildcard"
                         maxBufferSize="65536" 
                         maxBufferPoolSize="524288" 
                         maxReceivedMessageSize="65536"
                         messageEncoding="Mtom" 
                         textEncoding="utf-8" 
                         transferMode="Buffered"
                         useDefaultWebProxy="true">
                    <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384" maxBytesPerRead="4096" maxNameTableCharCount="16384" />
                    <security mode="Transport">
                        <transport clientCredentialType="Certificate" proxyCredentialType="None" realm=""/>
                        <message clientCredentialType="Certificate" algorithmSuite="Default"/>
                    </security>
                </binding>
            </basicHttpBinding>
        </bindings>
        <client>
            <endpoint address="https://acme.com/services/docmanagement_V3"
                      binding="basicHttpBinding"
                      bindingConfiguration="DocManagementSOAP"
                      behaviorConfiguration="CertificateBehavior"
                      contract="ServiceReference.docManagement"
                      name="DocManagementSOAP">
                <identity>
                    <dns value="cert.acme.com" />
                </identity>
            </endpoint>     
        </client>
        <behaviors>
            <endpointBehaviors>
                <behavior name="CertificateBehavior">
                    <clientCredentials>
                        <clientCertificate x509FindType="FindBySubjectName" findValue="cert.acme.com" storeLocation="LocalMachine"/>
                        <serviceCertificate>
                            <authentication certificateValidationMode="PeerOrChainTrust"
                                            revocationMode="NoCheck"
                                            trustedStoreLocation="LocalMachine" />
                        </serviceCertificate>
                    </clientCredentials>
                </behavior>
            </endpointBehaviors>
        </behaviors>
    </system.serviceModel>

【问题讨论】：

标签： asp.net wcf x509certificate

【解决方案1】：

在与微软技术支持合作后，这个配置终于成功了：

<system.serviceModel>
        <bindings>
            <basicHttpBinding>
                <binding name="DocManagementSOAP" 
                         messageEncoding="Mtom" 
                         textEncoding="utf-8">
                    <security mode="Transport">
                        <transport clientCredentialType="Certificate" proxyCredentialType="None" realm="" />
                    </security>
                </binding>
            </basicHttpBinding>
        </bindings>
        <client>
            <endpoint address="https://acme.com/services/docmanagement_V3"
                      binding="basicHttpBinding"
                      behaviorConfiguration="cert"
                      bindingConfiguration="DocManagementSOAP"
                      contract="docManagement"
                      name="DocManagementSOAP" />
        </client>
        <behaviors>
            <endpointBehaviors>
                <behavior name="cert">
                    <clientCredentials>
                        <clientCertificate findValue="cert.acme.com"
                                           storeLocation="LocalMachine"
                                           storeName="My"
                                           x509FindType="FindBySubjectName"/>
                    </clientCredentials>
                </behavior>
            </endpointBehaviors>
        </behaviors>
    </system.serviceModel>

注意：如果您的服务不支持 MTOM，请移除或更改 messageEncoding 属性。

【讨论】：