WCF 服务接受任何旧证书答案

【问题标题】：WCF Service Accepts Any Old CertificateWCF 服务接受任何旧证书
【发布时间】：2012-09-24 06:38:05
【问题描述】：

我正在尝试将此 WCF 服务设置为仅在客户端提供“Test 01”证书时接受请求。问题是它似乎接受来自同一机构的任何证书，例如“Test 04”。

如何拒绝所有未使用“Test 01”证书发送的请求？

  <basicHttpBinding>
    <binding
      name="TestSecureBinding"
      maxReceivedMessageSize="5242880">
      <security mode="Transport">
        <transport
          clientCredentialType="Certificate"></transport>
      </security>
    </binding>
  </basicHttpBinding>

    <behavior name="TestCertificateBehavior">
      <serviceCredentials>
        <clientCertificate>
          <certificate
            storeLocation="LocalMachine"
            x509FindType="FindBySubjectName"
            findValue="Test 01"/>
          <authentication
            certificateValidationMode="PeerTrust"
            trustedStoreLocation="LocalMachine"
            revocationMode="NoCheck"/>
        </clientCertificate>
      </serviceCredentials>
    </behavior>
  <service
    name="IService"
    behaviorConfiguration="TestCertificateBehavior">
    <endpoint
      name="MyHttps"
      address="https://localhost:443"
      contract="IService"
      binding="basicHttpBinding"
      bindingConfiguration="TestSecureBinding">
    </endpoint>
    <host>
      <baseAddresses>
        <add baseAddress="https://localhost:443"/>
      </baseAddresses>
    </host>
  </service>

【问题讨论】：

您必须编写自定义证书验证器：[查看此问题][1] [1]：stackoverflow.com/questions/1559915/…

标签： wcf wcf-security

【解决方案1】：

没有办法在普通的 WCF 配置中进行配置 - 你必须自己动手。

public class CertificateValidator : X509CertificateValidator
{
    private string _expectedSubjectName;

    public CertificateValidator(string expectedSubjectName)
    {
        _expectedSubjectName = expectedSubjectName;
    }

    public override void Validate(System.Security.Cryptography.X509Certificates.X509Certificate2 certificate)
    {
        if (certificate == null)
        {
            throw new ArgumentNullException("certificate");
        }

        if (certificate.SubjectName.Name != _expectedSubjectName)
        {
            throw new SecurityTokenValidationException("Invalid certificate");
        }
    }
}

然后将其附加到服务主机：

serviceHost.Credentials.ClientCertificate.Authentication.CertificateValidationMode = 
                X509CertificateValidationMode.Custom;
serviceHost.Credentials.ClientCertificate.Authentication.CustomCertificateValidator =
                new CertificateValidator(expectedCertificateName);

取自：Creating a service that employs a custom certificate validator。

【讨论】：