R – SSL Error with WCF Service using Transport Security & Cert. Authentication

netsslwcfwcf-security

I don't know if this is a question more suited for Serverfault.com, really depends on the answer, but I have followed this tutorial in .NET C# to setup a WCF service under 'wsHttpBinding' (Transport Security & Certificate Authentication), I have created a test development certificate using the methods described here and I have also configured my HTTPS 443 port in Bindings for IIS.

Everything has been working pretty good each step, however I am receiving an error in the the Example "Hello World" service I created (again, all followed via the MSDN tutorial link I first stated) when hitting https://vd1/WcfWsHttpBindingTest/Service.svc (VD1 being my local computer name):

HTTP Error 403.7 - Forbidden
The page you are attempting to access requires your browser to have a Secure Sockets Layer (SSL) client certificate that the Web server recognizes.

I have followed both tutorials as stated to install my server certificate and the client certificate and it has been configured in IIS; Also if I negate the 'https' and just use 'http' I receive a 403.4 Forbidden stating I am trying to access a page which has been secured with SSL, so I'm pretty sure that side of it is working.

Any ideas folks?
I haven't deviated from the tutorials, I am running IIS 7.0 and Vista Business.

It would even help if somebody could start me from a clean slate by giving me better tutorial links for configuring a service with wsHttpBinding.

** If anyone had seen my initial post, you will notice I closed my answer as it has evolved to the problem above **

Best Answer

Thanks for your help Tanner.

After two hours of scratching my head and tinkering, with help from a colleague we narrowed it down to one step which was not done correctly. The Certificate was being added to "Local User" not "Local Computer".

Thanks again.

Related Solutions

C# – Could not establish trust relationship for SSL/TLS secure channel — SOAP

The following snippets will fix the case where there is something wrong with the SSL certificate on the server you are calling. For example, it may be self-signed or the host name between the certificate and the server may not match.

This is dangerous if you are calling a server outside of your direct control, since you can no longer be as sure that you are talking to the server you think you're connected to. However, if you are dealing with internal servers and getting a "correct" certificate is not practical, use the following to tell the web service to ignore the certificate problems and bravely soldier on.

The first two use lambda expressions, the third uses regular code. The first accepts any certificate. The last two at least check that the host name in the certificate is the one you expect.
... hope you find it helpful

//Trust all certificates
System.Net.ServicePointManager.ServerCertificateValidationCallback =
    ((sender, certificate, chain, sslPolicyErrors) => true);

// trust sender
System.Net.ServicePointManager.ServerCertificateValidationCallback
                = ((sender, cert, chain, errors) => cert.Subject.Contains("YourServerName"));

// validate cert by calling a function
ServicePointManager.ServerCertificateValidationCallback += new RemoteCertificateValidationCallback(ValidateRemoteCertificate);

// callback used to validate the certificate in an SSL conversation
private static bool ValidateRemoteCertificate(object sender, X509Certificate cert, X509Chain chain, SslPolicyErrors policyErrors)
{
    bool result = cert.Subject.Contains("YourServerName");
    return result;
}

R – How To: WCF with Transport Security+Server Cert Auth. WITHOUT Client Cert

You don't need a client certificate, it's simply ssl. If you're using IIS to host the service, this is a no brainer, just install the cert. Message level security get's a little bit more tricky but you should be okay on the ssl cert.

If you use basicHttpBinding you won't need to shutoff authentication, by default WSHttpBinding turns on message level authentication, which you can shut off in the web config by setting Authentication mode (I believe) to none. Go with basic if you just need ssl. If you want ssl and perhaps Windows Authentication, then go with WSHttpBinding.

Related Topic