WCF - SSL Service | 易学教程

问题

I have a service that uses SSL. When I try to browse to the service I get the following error:

The SSL settings for the service 'SslRequireCert' does not match those of the IIS 'None'.

My config is as follows:

<security mode="Transport">
        <transport clientCredentialType="Certificate" />
      </security>

I am using IIS Express and I have "Enable SSL" checked (verified in WebMatrix).

Any ideas what else I need to do?

回答1:

Ok. It looks like I needed to update the applicationhost.config file (in IIS Express). I added a location for my site and set sslFlags="Ssl, SslAcceptCert, SslRequireCert". This allowed me to enable SSL authentication. Then when I tried to access the service with a client I got a message that there was an error establishing a trust relationship. This was because I did not have the server's certificate in my trusted people folder (or it might have been the client, I'm not sure as the service and client is on my local PC). After doing that, the service will work, however we do not want to have to give our certificate to the client, so I ended up using the TransportWithMessageCredential security mode.

回答2:

Modify your behaviour to include SSL as below;

<behaviors>
  <serviceBehaviors>
    <behavior name="MyService">
      <serviceMetadata httpGetEnabled="True" httpsGetEnabled="True" />
      <serviceDebug includeExceptionDetailInFaults="False" />
    </behavior>
  </serviceBehaviors>
</behaviors>

and remove

<security mode="Transport">
        <transport clientCredentialType="Certificate" />
      </security>

This is implying that you will be using certificate authentication

回答3:

This has absolutely nothing to do with the absence of the mex line, unless it's configured incorrectly in which case removing it will have an effect but IIS still might give the same error.

Make sure IIS has SSL Settings of 'Require SSL' and 'Accept' (easier) or 'Require' user certificates - then RESTART IIS. Although IIS says changes are applied - im my experience they are not always - or at least not done immediately.

来源：https://stackoverflow.com/questions/6514067/wcf-ssl-service

标签

wcf

wcf-security