c# - 使用没有 certificateValidationMode 的证书时出现 WCF SecurityNegotiationException

Question

我使用 Pluralsight Selfcert 创建证书。当我在 wcf 服务中使用它时，它会出现 SecurityNegotiation 异常。我搜索它并找到了解决方案。我将 certificateValidationMode="None"放在 Web.config 的 clientCertificate 中，但问题没有解决。但是如果我把这个命令放在客户端 app.config 问题解决。但我不想更改我的客户端配置。为什么此命令在服务器端不起作用？还有其他办法吗？

The X.509 certificate CN=QtasCert chain building failed. The certificate that was used has a trust chain that cannot be verified. Replace the certificate or change the certificateValidationMode. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.

<services>
  <service name="ArchiveBoundedContext.WcfService.WcfServices.ArchiveWcfService">
    <endpoint address="" binding="netTcpBinding" bindingConfiguration="QTasBinding" name="QTasEndpoint" contract="ArchiveBoundedContext.WcfService.WcfServices.IArchiveWcfService" />
    <endpoint address="mex" binding="mexTcpBinding" name="QTasMex" contract="IMetadataExchange" />
    <host>
      <baseAddresses>
        <add baseAddress="net.tcp://localhost:808/WcfServices/" />
      </baseAddresses>
    </host>
  </service>
</services>
<behaviors>
  <serviceBehaviors>
    <behavior>
      <serviceSecurityAudit auditLogLocation="Application" serviceAuthorizationAuditLevel="SuccessOrFailure" messageAuthenticationAuditLevel="SuccessOrFailure" suppressAuditFailure="true" />
      <serviceCredentials>
        <userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="ArchiveBoundedContext.WcfService.ServiceAuthenticator, ArchiveBoundedContext.WcfService" />
        <serviceCertificate findValue="QtasCert" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" />
        <clientCertificate>
          <authentication certificateValidationMode="None" revocationMode="NoCheck" />
        </clientCertificate>
      </serviceCredentials>
      <serviceAuthorization principalPermissionMode="UseAspNetRoles" />
      <serviceMetadata httpGetEnabled="false" />
      <serviceDebug includeExceptionDetailInFaults="true" />
    </behavior>
  </serviceBehaviors>

Answer 1

我在客户端安装了证书，问题解决了。

class Program
{
    static void Main(string[] args)
    {
        Console.WriteLine(@"Certificate Installer v1.0");

        var certificate = new X509Certificate2(Certificates.QTasCert, "*****");
        var rootStore = new X509Store(StoreName.Root, StoreLocation.LocalMachine);
        rootStore.Open(OpenFlags.ReadWrite);
        rootStore.Add(certificate);
        rootStore.Close();

        var myStore = new X509Store(StoreName.My, StoreLocation.LocalMachine);
        myStore.Open(OpenFlags.ReadWrite);
        myStore.Add(certificate);
        myStore.Close();

        Console.WriteLine(@"Certificate Installed Successfuly");
        Console.ReadKey();
    }
}