Cryptic WCF error messages (part 4 of N)

@YaronNaveh

Today's exception can happen when X.509 certificates negotiation is used. One case when it is used is when you use wsHttpBinding with:

negotiateSerciveCredential="True"
messageClientCredentialType=[anything but "Windows"]

But there are other cases as well.

You may get the following exception at the client:

"SOAP security negotiation with 'http://localhost:13037/WCFService54/Service.svc' for target 'http://localhost:13037/WCFService54/Service.svc' failed. See inner exception for more details."

The inner exception shows:

{"The X.509 certificate CN=WSE2QuickStartServer chain building failed. The certificate that was used has a trust chain that cannot be verified. Replace the certificate or change the certificateValidationMode. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.\r\n"}

The reason for that is that the certificate the server uses is not trusted on the client machine. We can see this by double-clicking on the certificate in the file system or in the windows certificate store:



You have 2 ways to solve this:

1. Make sure the service certificate is trusted on the client machine. For example install its issuer certificate in the trusted root store.

OR:

2. This is just for testing and should not go to production. You can disable the server authentication by the client: On the client side create a new endpoint behaviour with a "clientCredentials" behaviour element and set its serviceCertificate/authentication/certificateValidationMode to "None".

The app.config may look like this now:

<behaviors>
<endpointBehaviors>
<behavior name="NewBehavior">
<clientCredentials>
<serviceCertificate>
<authentication certificateValidationMode="None" />
</serviceCertificate>
</clientCredentials>
</behavior>
</endpointBehaviors>
</behaviors>


A picture may be better here:




Don't forget to link that behaviour to the endpoint:

<endpoint ... behaviorConfiguration="NewBehavior"... />




Note that after you solve this error you may see a related cryptic WCF error message.

@YaronNaveh

What's next? get this blog rss updates or register for mail updates!