WCF wsHttpBinding 证书安全协商异常

Question

所以在梳理了MSDN，无数文章甚至SO之后-我奋斗了几天仍然一无所获。

所以我有这个：客户端需要使用 WCF 服务，我只是不断遇到 SecurityNegotiationException

Secure channel cannot be opened because security negotiation with the remote endpoint has failed. This may be due to absent or incorrectly specified EndpointIdentity in the EndpointAddress used to create the channel. Please verify the EndpointIdentity specified or implied by the EndpointAddress correctly identifies the remote endpoint.

我在网上看到了这个错误，似乎没有人知道我的确切情况（至少有一个可行的答案）。

我的设置是本地的，不是由 IIS（暂时）托管，而是通过 Visual Studios 2010 托管。我的 GenericIntegration（WCF 服务）使用由证书验证的 wsHttpBinding（消息模式）（我有一个非常自定义的 username/password 身份验证 + 授权 class 通过设计作为参数传递）并且没有退出安全措施。

主机配置

<system.serviceModel>
<bindings>
  <wsHttpBinding>
    <binding name="wsHttpEndpintBinding">
      <security mode ="Message">
        <message clientCredentialType="Certificate" establishSecurityContext="false" negotiateServiceCredential="false"/>
      </security>
    </binding>
  </wsHttpBinding>
</bindings>
<services>
  <service behaviorConfiguration="wsHttpBehaviour" name="GenericIntegration.GenericService">
    <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange"/>
    <endpoint address="" binding="wsHttpBinding" bindingConfiguration="wsHttpEndpintBinding" 
      name="wsHttpEndpoint" contract="GenericIntegration.GenInterface" />
    <host>
      <baseAddresses>
        <!--<add baseAddress="http://localhost:59082/GenericService.svc" />-->
      </baseAddresses>
    </host>
  </service>
</services>
<behaviors>
  <serviceBehaviors>
    <behavior name="wsHttpBehaviour">
      <serviceMetadata httpGetEnabled="true" />
      <serviceDebug includeExceptionDetailInFaults="true" />
      <serviceCredentials>
        <clientCertificate>
          <certificate findValue="GenIntegrationClient" storeName="My" storeLocation="LocalMachine" x509FindType="FindBySubjectName" />
          <authentication certificateValidationMode="PeerTrust" />
        </clientCertificate>

        <serviceCertificate findValue="GenIntegrationClient" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" />
      </serviceCredentials>
    </behavior>
    <behavior name="metadataBehavior">
      <serviceMetadata httpGetEnabled="true" />
      <serviceDebug includeExceptionDetailInFaults="true" />
    </behavior>
  </serviceBehaviors>
</behaviors>    

<serviceHostingEnvironment multipleSiteBindingsEnabled="true" />

和客户端的配置

<system.serviceModel>
    <behaviors>
        <endpointBehaviors>
            <behavior name="endpointBehaviour">
                <clientCredentials>
                    <clientCertificate findValue="GenIntegrationClient" storeLocation="LocalMachine" storeName="My"
                        x509FindType="FindBySubjectName" />
                  <serviceCertificate>
                    <authentication certificateValidationMode="PeerTrust" revocationMode="NoCheck"/>
                  </serviceCertificate>
                </clientCredentials>
            </behavior>
        </endpointBehaviors>
    </behaviors>
    <bindings>
        <wsHttpBinding>
            <binding name="wsHttpEndpoint" maxBufferPoolSize="20000000" maxReceivedMessageSize="20000000">
                <security mode="Message">
                    <message clientCredentialType="Certificate" />
                </security>
            </binding>
        </wsHttpBinding>
    </bindings>
    <client>
        <endpoint address="http://localhost:59082/GenericService.svc"
            binding="wsHttpBinding" bindingConfiguration="wsHttpEndpoint" behaviorConfiguration="endpointBehaviour"
            contract="GenService.GenInterface" name="wsHttpEndpoint">
            <identity>
                <certificate encodedValue="AwAAAAEAAAAUAAAAKdyUELIKMtdh2MFsYQ09ja+vyeEgAAAAAQAAACICAAAwggIeMIIBi6ADAgECAhCFBfF1EXQZhkPKaBpQCl84MAkGBSsOAwIdBQAwJDEiMCAGA1UEAxMZNE1PU1RHZW5JbnRlZ3JhdGlvblNlcnZlcjAeFw0xNjA3MjgxNDQ5MjVaFw0zOTEyMzEyMzU5NTlaMCQxIjAgBgNVBAMTGTRNT1NUR2VuSW50ZWdyYXRpb25DbGllbnQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAIwsIlz5nZ3HxeYofTpYKr6RcfQMe/jZxPuHcljT+8pBOZ6KmYcyxeRTO074yP6yF8b1IqFskII+qqmCT8nDsb8xdo5Ee0oqL1LKR+xeTgg2ZXXoocxqR1AdxWFVdlMxMSjKIEGE+MnSDdB6vgXahhpUbAS7cdrNoAFKNIz+vrt1AgMBAAGjWTBXMFUGA1UdAQROMEyAEB4cu6OjBqQHct6przmowGyhJjAkMSIwIAYDVQQDExk0TU9TVEdlbkludGVncmF0aW9uU2VydmVyghD75YH5y52zsU5wcmZLJzPiMAkGBSsOAwIdBQADgYEA2BinUmEfgZKcb1qFD1T5ajc2OWHGLjDLpDi8Y7amM4P3rFGvelx7NmCNUH88iGS9LcbDsmY59HcZwUavtPOr4LMRDhl+5YuGht1fIYEk8QSDIhjevijgDOIVBBAeNIA8tva1faMNtYnFXsj0VxMvlrZ4exeKFVFjv2sib5YNFxY=" />
            </identity>
        </endpoint>
    </client>
</system.serviceModel>

现在关于证书（是的，这仅用于测试）：GenIntegrationServer.cer 已创建为带有私钥的自签名 CA 根证书，用于签署客户端证书。 GenIntegrationServer 和 GenIntegrationClient 证书都是使用 makecert 生成的。客户端证书链接到私钥并正确安装在个人存储中。

我对证书、私钥和安全通信仍然很陌生 - 我根本无法推理我在哪里犯了错误。我没有找到太多关于以这种方式专门使用证书的帖子。

有人可以在我脱发或为此入睡之前提供帮助吗？

更新

根据要求，我添加了日志记录。但他们透露的最多的是：

<s:Body>
    <s:Fault>
        <s:Code>
            <s:Value>s:Sender</s:Value>
            <s:Subcode>
                <s:Value>a:InvalidSecurity</s:Value>
            </s:Subcode>
       </s:Code>
       <s:Reason>
           <s:Text xml:lang="en-ZA">An error occurred when verifying security for the message.</s:Text>
       </s:Reason>
    </s:Fault>
</s:Body>

遗憾的是，我仍然不明白为什么安全验证失败。有什么想法吗？

Answer 1

原来我需要将证书添加到不同的商店。

除了已经在个人商店中设置了证书（如配置所示）之外，我还必须在客户端上安装服务器证书，反之亦然。我还必须确保客户端包含客户端证书的个人密钥，并且与服务器相同。

这听起来不太完整，但我会 post 一篇关于我如何做到这一点的完整文章。

WCF wsHttpBinding 证书安全协商异常

WCF wsHttpBinding Certificate Security Negotiation Exception

c#

wcf

ca

wshttpbinding

x509certificate