makecert -n "CN=MyRootCA" -r -sv RootCA.pvk RootCA.cer
2) 然后需要请求/生成客户端和服务器证书。这两种类型的证书都可以作为本地计算机证书安装,并且都需要使用相同的根权限进行签名。您可以从Microsoft证书服务器的web界面请求客户端证书,例如。
http://mycertserver/certsrv
makecert -pe -n "CN=MyCert" -ss my -sky exchange -sk MyCert
-iv MyRootCA.pvk -ic MyRootCA.cer -sr localmachine MyCert.cer
为了使服务器信任客户端证书,您需要在服务器的受信任根证书颁发机构存储中安装开发根证书(使用mmc证书管理单元来完成此操作)。客户端还应该以相同的方式安装根证书,以便它们信任自己的证书。
3) 将您的WCF服务配置为要求使用证书进行客户端身份验证(例如,通过web.config)。
<services>
<service
name="TestService"
behaviorConfiguration="wsHttpCertificateBehavior">
<endpoint name="TestEndPoint"
address=""
binding="wsHttpBinding"
bindingConfiguration="wsHttpEndpointBinding"
contract="TestService.IMyContract">
<identity>
<dns value=""/>
</identity>
</endpoint>
<endpoint address="mex" binding="mexHttpsBinding" contract="IMetadataExchange"/>
</service>
</services>
<bindings>
<wsHttpBinding>
<binding name="wsHttpEndpointBinding">
<security mode="Message">
<message clientCredentialType="Certificate"/>
</security>
</binding>
</wsHttpBinding>
</bindings>
<behaviors>
<behavior name="wsHttpCertificateBehavior">
<serviceMetadata httpGetEnabled="false" httpsGetEnabled="true"/>
<serviceCredentials>
<clientCertificate>
<authentication
certificateValidationMode="PeerOrChainTrust"
revocationMode="NoCheck"/>
</clientCertificate>
<serverCertificate findValue="CN=MyCert"/>
</serviceCredentials>
</behavior>
</behaviors>
<client>
<endpoint name="wsHttpBinding"
address="https://localhost/TestService/TestService.svc"
binding="wsHttpBinding"
bindingConfiguration="wsHttpBinding"
behaviorConfiguration="wsHttpCertificateBehavior"
contract="TestService.IMyContract">
<identity>
<dns value="MyCert"/>
</identity>
</endpoint>
</client>
<bindings>
<wsHttpBinding>
<binding name="wsHttpBinding">
<security mode="Message">
<message clientCredentialType="Certificate"/>
</security>
</binding>
</wsHttpBinding>
</bindings>
<behaviors>
<endpointBehaviors>
<behavior name="wsHttpCertificateBehavior">
<clientCredentials>
<clientCertificate findValue="MyCert" storeLocation="LocalMachine"/>
<serviceCertificate>
<authentication
certificateValidationMode="PeerOrChainTrust"
revocationMode="NoCheck"
trustedStoreLocation="LocalMachine"/>
</serviceCertificate>
</clientCredentials>
</behavior>
</endpointBehaviors>
</behaviors>
