WCF上的X.509证书？

Question

问题：

我正在一台机器上开发这个程序。

服务工作在开发服务器罚款，但是当我尝试在IIS托管服务它给了我一个错误：

使用下面的搜索条件找不到X.509证书：STORENAME“我'，StoreLocation'CurrentUser'，FindType'FindBySubjectName'，FindValue'WCFServer'。

那么无论如何我能解决这个问题吗？ 我从

http://www.codeproject.com/KB/WCF/9StepsWCF.aspx

证书创建

makecert.exe -sr CurrentUser -ss My -a sha1 -n CN=WCfServer -sky exchange -pe 
makecert.exe -sr CurrentUser -ss My -a sha1 -n CN=WcfClient -sky exchange -pe 

证书尝试这种代码存在于个人和可信的人在MMC文件夹

服务具有接受头号功能，返回字符串并正常工作

这是我的服务web.config：

<system.serviceModel> 
    <bindings> 
     <wsHttpBinding> 
     <binding name="wsHttpEndpointBinding"> 
      <security> 
      <message clientCredentialType="Certificate" /> 
      </security> 
     </binding> 
     </wsHttpBinding> 
    </bindings> 
    <services> 
     <service name="WCFServiceCertificate.Service1" behaviorConfiguration="WCFServiceCertificate.Service1Behavior"> 
     <!-- Service Endpoints --> 
     <endpoint address="" binding="wsHttpBinding" bindingConfiguration="wsHttpEndpointBinding" contract="WCFServiceCertificate.IService1"> 
      <!-- 
       Upon deployment, the following identity element should be removed or replaced to reflect the 
       identity under which the deployed service runs. If removed, WCF will infer an appropriate identity 
       automatically. 
      --> 
      <!--<identity> 
      <dns value="localhost"/> 
      </identity>--> 
     </endpoint> 
     <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange"/> 
     </service> 
    </services> 
    <behaviors> 
     <serviceBehaviors> 
     <behavior name="WCFServiceCertificate.Service1Behavior"> 
      <!-- To avoid disclosing metadata information, set the value below to false and remove the metadata endpoint above before deployment --> 
      <serviceMetadata httpGetEnabled="true"/> 
      <!-- To receive exception details in faults for debugging purposes, set the value below to true. Set to false before deployment to avoid disclosing exception information --> 
      <serviceDebug includeExceptionDetailInFaults="false"/> 
      <serviceCredentials> 
      <clientCertificate> 
       <authentication certificateValidationMode="PeerTrust"/> 
      </clientCertificate> 
      <serviceCertificate findValue="WcfServer" 
           storeLocation="CurrentUser" 
           storeName="My" 
           x509FindType="FindBySubjectName" /> 
      </serviceCredentials> 
     </behavior> 
     </serviceBehaviors> 
    </behaviors> 
    </system.serviceModel> 

这是我的客户端配置

<system.serviceModel> 
       <bindings> 
    <wsHttpBinding> 
    <binding name="WSHttpBinding_IService1" closeTimeout="00:01:00" 
    openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00" 
    bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard" 
    maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Text" 
    textEncoding="utf-8" useDefaultWebProxy="true" allowCookies="false"> 
    <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384" 
     maxBytesPerRead="4096" maxNameTableCharCount="16384" /> 
    <reliableSession ordered="true" inactivityTimeout="00:10:00" 
     enabled="false" /> 
    <security mode="Message"> 
     <transport clientCredentialType="Windows" proxyCredentialType="None" 
     realm="" /> 
     <message clientCredentialType="Certificate" negotiateServiceCredential="true" 
     algorithmSuite="Default" establishSecurityContext="true" /> 
    </security> 
    </binding> 
    </wsHttpBinding> 
    </bindings> 
       <client> 
    <endpoint address="http://localhost:1387/Service1.svc" behaviorConfiguration="CustomBehavior" 
    binding="wsHttpBinding" bindingConfiguration="WSHttpBinding_IService1" 
    contract="ServiceReference1.IService1" name="WSHttpBinding_IService1"> 
    <identity> 
    <certificate encodedValue="AwAAAAEAAAAUAAAA9YoGKvsMLFkeO1WjaCLReQuz1ysgAAAAAQAAALUBAAAwggGxMIIBX6ADAgECAhDDvb3bnmzhsERpNTWEBYQXMAkGBSsOAwIdBQAwFjEUMBIGA1UEAxMLUm9vdCBBZ2VuY3kwHhcNMTEwMzA0MDcwNzU3WhcNMzkxMjMxMjM1OTU5WjAUMRIwEAYDVQQDEwlXY2ZTZXJ2ZXIwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAM9e4DwCDYJ4l6myt1QadHzXoqCH2wa1aUjiab1aK/7d/1LZ00KfPJw8kKB358serjEi9SMg0UeyGtl0+byJ8PqShfv4MUTHZcPaWy99vHaYHwH7T9hVwY5RANBWyFy6nf1rXDh/cB2qm0Q/xN5xElOtheFqUoL8Ua6fcP33BAWPAgMBAAGjSzBJMEcGA1UdAQRAMD6AEBLkCS0GHR1PAI1hIdwWZGOhGDAWMRQwEgYDVQQDEwtSb290IEFnZW5jeYIQBjdsAKoAZIoRz7jUqlw19DAJBgUrDgMCHQUAA0EAKlaHJQNdC9VgPuHlVuniQJd+fHoVOU62nl374iXYdQus5KDgKz9RHWAtjhpToBB4sOXOnwTkJfcyJWBf6J14Mw==" /> 
    </identity> 
    </endpoint> 
    </client> 
       <behaviors> 
         <endpointBehaviors> 
           <behavior name="CustomBehavior"> 
             <clientCredentials> 
               <clientCertificate findValue="WcfClient" 
           x509FindType="FindBySubjectName" 
           storeLocation="CurrentUser" 
           storeName="My"/> 
               <serviceCertificate> 
                 <authentication certificateValidationMode="PeerTrust"/> 
               </serviceCertificate> 
             </clientCredentials> 
           </behavior> 
         </endpointBehaviors> 
       </behaviors> 
     </system.serviceModel> 

，并简单地调用使用该

Service1Client obj = new Service1Client(); 
      Response.Write(obj.GetData(12)); 

现在，当我运行一切正常，没有问题，在客户端的服务。

正如你可以在服务器上运行开发服务器。

但是当我试图东道国，在IIS它给了我一个错误，

不能使用下面的搜索条件找到的X.509证书的服务： STORENAME“我”，StoreLocation“CurrentUser”， FindType 'FindBySubjectName'，FindValue'WCFServer'。

那么无论如何我能解决这个问题吗？

Answer 1

由于x0n提到，Cassini将作为您当前的用户运行，但IIS将作为IUSR运行。从这个导入证书，具有私钥，到LOCALMACHINE \个人（LOCALMACHINE \我的），并改变你的服务配置：

 <serviceCertificate findValue="WcfServer" 
          storeLocation="CurrentUser" 
          storeName="My" 
          x509FindType="FindBySubjectName" /> 

要这样：

 <serviceCertificate findValue="WcfServer" 
          storeLocation="LocalMachine" 
          storeName="My" 
          x509FindType="FindBySubjectName" /> 

Answer 2

很明显，在配置的位置找不到证书。确保您使用哪个用户来运行该服务。也许该服务正在本地系统帐户或本地服务帐户或IIS用户上运行，并且您将该证书作为其他用户来安装？在MMC中添加一个管理单元以查看服务帐户或您用于该服务的其他帐户（不是当前用户）中的证书。

Answer 3

将证书安装到计算机商店的“我的”中，以便它可供所有用户使用。您已将它安装在当前用户的“我的”中。开发服务器以当前用户身份运行，所以这就是它的工作原理。

Answer 4

你也许必须建立dns值，意思是证书的名称，在客户端> endopoint> indentity（如下面的代码所述）

<client> 
     <endpoint address="http://localhost/FrontPMWebServiceSetup111/FpmService.svc" 
      binding="wsHttpBinding" bindingConfiguration="WSHttpBinding_IService" 
      contract="FPMServiceReference.IService" name="WSHttpBinding_IService"> 
      <identity> 
      <dns value="WCfServer" /> 
      </identity> 
     </endpoint> 
     </client>