Reply to thread

Message

<blockquote data-quote="Ryan" data-source="post: 4325334">I am writing a client WCF webservice and have run into difficulty trying toconfigure separate certificates for SSL and return message signaturevalidation.I've included the web.config settings below for the website I am using fortesting the WCF client.&nbsp; The &quot;clientCertificate&quot; thumbprint links to myprivate cert in my certificate store.&nbsp; The &quot;defaultCertificate&quot; is the SSLcert thumbprint for the broker server, this certificate DNS matches the DNSof the webservice URL I am hitting &quot;fake.url.com&quot; in my example (i'vereplaced the actual url for security).In this configuration I can trace the request and response and I do receivea full and complete response with correct data however I receive thefollowing error from WCF:&quot;The incoming message was signed with a token which was different from whatused to encrypt the body.&nbsp; This was not expected.&quot;If I replace the &quot;defaultCertificate&quot; thumbprint with the public cert usedto sign the response I get the following error because this certificate's DNSdoes not match the broker server URL I am hitting.&nbsp; The certificate used tosign the response has a non-URL name, for example &quot;signing-cert&quot;.&nbsp; The errorI get is:&quot;Identity check failed for outgoing message. The expected DNS identity ofthe remote endpoint was 'fake.url.com' but the remote endpoint provided DNSclaim 'signing-cert'. If this is a legitimate remote endpoint, you can fixthe problem by explicitly specifying DNS identity 'signing-cert' as theIdentity property of EndpointAddress when creating channel proxy.&quot;I tried adding an identity property for the dns however it then returns thefollowing error:&quot;The HTTPS channel factory does not support explicit specification of anidentity in the EndpointAddress unless the authentication scheme is NTLM orNegotiate.Parameter name: remoteAddress&quot;I seem to have run into a road-block here.&nbsp; I expect it should be a simplematter to specify the certificate WCF should use to validate the SSL channel,and to specify a separate certificate to validate the response messagesignature.&nbsp; I seems that all examples I come across expect the samecertificate to be used for SSL channel as well as response signing.I apreciate any advice/tips you may have...I've fairly new to WCF...Justcan't seem to find the right settings to get thins working 100%.&lt;bindings&gt;&lt;customBinding&gt;&lt;binding name=&quot;AccountManagementSoapBindingImplSoapBinding&quot;&gt;&lt;textMessageEncoding messageVersion=&quot;Soap11&quot; writeEncoding=&quot;utf-8&quot; /&gt;&lt;security allowSerializedSigningTokenOnReply=&quot;true&quot;defaultAlgorithmSuite=&quot;Default&quot; authenticationMode=&quot;MutualCertificate&quot;requireDerivedKeys=&quot;false&quot; includeTimestamp=&quot;true&quot;messageProtectionOrder=&quot;EncryptBeforeSign&quot;messageSecurityVersion=&quot;WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10&quot;requireSecurityContextCancellation=&quot;false&quot;requireSignatureConfirmation=&quot;false&quot;&gt;&lt;/security&gt;&lt;httpsTransport authenticationScheme=&quot;Anonymous&quot; /&gt;&lt;/binding&gt;&lt;/customBinding&gt;&lt;/bindings&gt;&lt;client&gt;&lt;endpoint binding=&quot;customBinding&quot; behaviorConfiguration=&quot;behavior&quot;address=&quot;<a href="https://fake.url.com:444/services/core/AccountManagementService/v1">https://fake.url.com:444/services/core/AccountManagementService/v1</a>&quot;bindingConfiguration=&quot;AccountManagementSoapBindingImplSoapBinding&quot;contract=&quot;AccountManagementSoapBindingImpl&quot;name=&quot;AccountManagementSoapBindingImpl&quot;/&gt;&lt;/client&gt;&lt;behaviors&gt;&lt;endpointBehaviors&gt;&lt;behavior name=&quot;behavior&quot;&gt;&lt;clientCredentials&gt;&lt;clientCertificatefindValue=&quot;5467657d78665c7855765a675c6765c76567d864&quot;x509FindType=&quot;FindByThumbprint&quot; storeLocation=&quot;LocalMachine&quot; storeName=&quot;My&quot;/&gt;&lt;serviceCertificate&gt;&lt;defaultCertificatefindValue=&quot;432342b43d3c233a8764324b3c23432d32342a32&quot;x509FindType=&quot;FindByThumbprint&quot; storeLocation=&quot;LocalMachine&quot; storeName=&quot;My&quot;/&gt;&lt;authentication certificateValidationMode=&quot;PeerOrChainTrust&quot;trustedStoreLocation=&quot;LocalMachine&quot; revocationMode=&quot;NoCheck&quot;/&gt;&lt;/serviceCertificate&gt;&lt;/clientCredentials&gt;&lt;/behavior&gt;&lt;/endpointBehaviors&gt;&lt;/behaviors&gt;</blockquote>

[QUOTE="Ryan, post: 4325334"] I am writing a client WCF webservice and have run into difficulty trying to configure separate certificates for SSL and return message signature validation. I've included the web.config settings below for the website I am using for testing the WCF client. The "clientCertificate" thumbprint links to my private cert in my certificate store. The "defaultCertificate" is the SSL cert thumbprint for the broker server, this certificate DNS matches the DNS of the webservice URL I am hitting "fake.url.com" in my example (i've replaced the actual url for security). In this configuration I can trace the request and response and I do receive a full and complete response with correct data however I receive the following error from WCF: "The incoming message was signed with a token which was different from what used to encrypt the body. This was not expected." If I replace the "defaultCertificate" thumbprint with the public cert used to sign the response I get the following error because this certificate's DNS does not match the broker server URL I am hitting. The certificate used to sign the response has a non-URL name, for example "signing-cert". The error I get is: "Identity check failed for outgoing message. The expected DNS identity of the remote endpoint was 'fake.url.com' but the remote endpoint provided DNS claim 'signing-cert'. If this is a legitimate remote endpoint, you can fix the problem by explicitly specifying DNS identity 'signing-cert' as the Identity property of EndpointAddress when creating channel proxy." I tried adding an identity property for the dns however it then returns the following error: "The HTTPS channel factory does not support explicit specification of an identity in the EndpointAddress unless the authentication scheme is NTLM or Negotiate. Parameter name: remoteAddress" I seem to have run into a road-block here. I expect it should be a simple matter to specify the certificate WCF should use to validate the SSL channel, and to specify a separate certificate to validate the response message signature. I seems that all examples I come across expect the same certificate to be used for SSL channel as well as response signing. I apreciate any advice/tips you may have...I've fairly new to WCF...Just can't seem to find the right settings to get thins working 100%. <bindings> <customBinding> <binding name="AccountManagementSoapBindingImplSoapBinding"> <textMessageEncoding messageVersion="Soap11" writeEncoding="utf-8" /> <security allowSerializedSigningTokenOnReply="true" defaultAlgorithmSuite="Default" authenticationMode="MutualCertificate" requireDerivedKeys="false" includeTimestamp="true" messageProtectionOrder="EncryptBeforeSign" messageSecurityVersion="WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10" requireSecurityContextCancellation="false" requireSignatureConfirmation="false"> </security> <httpsTransport authenticationScheme="Anonymous" /> </binding> </customBinding> </bindings> <client> <endpoint binding="customBinding" behaviorConfiguration="behavior" address="[URL]https://fake.url.com:444/services/core/AccountManagementService/v1[/URL]" bindingConfiguration="AccountManagementSoapBindingImplSoapBinding" contract="AccountManagementSoapBindingImpl" name="AccountManagementSoapBindingImpl"/> </client> <behaviors> <endpointBehaviors> <behavior name="behavior"> <clientCredentials> <clientCertificate findValue="5467657d78665c7855765a675c6765c76567d864" x509FindType="FindByThumbprint" storeLocation="LocalMachine" storeName="My"/> <serviceCertificate> <defaultCertificate findValue="432342b43d3c233a8764324b3c23432d32342a32" x509FindType="FindByThumbprint" storeLocation="LocalMachine" storeName="My"/> <authentication certificateValidationMode="PeerOrChainTrust" trustedStoreLocation="LocalMachine" revocationMode="NoCheck"/> </serviceCertificate> </clientCredentials> </behavior> </endpointBehaviors> </behaviors> [/QUOTE]

Verification