c# - 如何使用 WCF 服务暂时停止证书错误

Question

我正在测试我创建的 WCF Web 服务的早期版本。在客户端，当我使用 VS 来“添加服务引用”时一切正常。

但是当我尝试使用该服务时出现错误，

Could not establish trust relationship for the SSL/TLS secure
channel with authority **

其中星星代表服务器的 IP 地址。

无论如何，服务器上都有一个安全证书，但它只是为了测试而自行生成的，所以我暂时不担心证书错误。

在客户端，已经为我生成了一个 app.config，

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
    <system.serviceModel>
        <bindings>
            <wsHttpBinding>
                <binding name="BindingName" closeTimeout="00:01:00"
                    openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
                    bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard"
                    maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
                    messageEncoding="Text" textEncoding="utf-8" useDefaultWebProxy="true"
                    allowCookies="false">
                    <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
                        maxBytesPerRead="4096" maxNameTableCharCount="16384" />
                    <reliableSession ordered="true" inactivityTimeout="00:10:00"
                        enabled="false" />
                    <security mode="Transport">
                        <transport clientCredentialType="Windows" proxyCredentialType="None"
                            realm="" />
                        <message clientCredentialType="Windows" negotiateServiceCredential="true" />
                    </security>
                </binding>
            </wsHttpBinding>
        </bindings>
        <client>
            <endpoint address="***************"
                binding="wsHttpBinding" bindingConfiguration="BindingName"
                contract="***************" name="BindingName">
                <identity>
                    <servicePrincipalName value="***************" />
                </identity>
            </endpoint>
        </client>
    </system.serviceModel>
</configuration>

那么我需要更改哪些设置才能暂时忽略证书错误？

Answer 1

在客户端初始化 WCF 服务之前设置 CertificatePolicy。方法如下(只需调用一次 SetCertificatePolicy() 方法)

 /// <summary>
    /// Sets the cert policy.
    /// </summary>
    private static void SetCertificatePolicy()
    {
        ServicePointManager.ServerCertificateValidationCallback += ValidateRemoteCertificate;
    }

    /// <summary>
    /// Certificate validation callback 
    /// </summary>
    private static bool ValidateRemoteCertificate(object sender, X509Certificate cert, X509Chain chain, SslPolicyErrors error)
    {
        if (error == SslPolicyErrors.None)
        {
           return true;   // already determined to be valid
        }

        switch (cert.GetCertHashString())
        {
           // thumbprints/hashes of allowed certificates (uppercase)
           case "066CF9CAD814DE2097D368F22D3A7D398B87C4D6":
           case "5B82C96685E3A20079B8CE7AFA32554D55DB9611":

              Debug.WriteLine("Trusting X509Certificate '" + cert.Subject + "'");
              return true;

           default:
              return false;
        }
    }