WCF error “The X.509 certificate chain building failed” despite trusted root CA

certificatewcf

I'm getting the error mentioned in this question:

The X.509 certificate CN=Farm chain building failed. The certificate that was used has a trust chain that cannot be verified. Replace the certificate or change the certificateValidationMode. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust.

What I don't understand why I'm getting this error as the certificate I use for my request to the WCF service is added as shown below:

client.ClientCredentials.Peer.PeerAuthentication.CertificateValidationMode =     
    X509CertificateValidationMode.ChainTrust;        
client.ClientCredentials.ClientCertificate.SetCertificate(
    StoreLocation.CurrentUser,
    StoreName.My,
    X509FindType.FindBySerialNumber,
    "MyCertificatesSerialNumber" );

The certificate itself is a self-signed certificate in the store shown above. When I click on it to show the certification path, no errors are shown (the root certificate is also a self-signed certificate). The root certificate was manually imported into the trusted root certification authorities.

From the error message I would have expected that there was an error in the certification chain with one of my certificates, but there isn't. Any ideas?

Update

I'm using Internet Explorer 9 as my browser to access the webservice. Programmatically I'm using a C# console application.

Best Answer

I had exactly the same problem - my own trusted root CA which signed another certificate. No errors were shown in the certificate store.

It turned out that having a trusted root CA and a certificate is not sufficient! You also need a certificate revocation list! Take a look at this MSDN Link.

So simply create such a .crl and add it also to the trusted root certificate authorities and everything works fine!

makecert -crl -n "CN=CARoot" -r -sv CARoot.pvk CARoot.crl

or simply turn of the revocation list check:

...RevocationMode = X509RevocationMode.NoCheck;
Related Topic