Wcf with 256 bit Ssl

@YaronNaveh

Recently I had to call a Java web service from Wcf. The service was secured with a 256-bit ssl certificate. Every request I made was rejected with a 401 Unauthorized response.

I then used this site to check what encryption strength my machine supports:

It seemed my pc is configured to only allow 128 bit connection.

Luckily I have found this link which explains how to configure windows to use 256-bit Ssl (Vista only). It seems the problem is in the windows defaults and not in Wcf. This changed the result in IE:

and also the Wcf client worked. The strange is that the setting that needs to be changed should only affect the order of the supported algorithms. So if the server requires a 256-bit OR a 128-bit key, the default setting would suggest 128 first. But if the server only allows 256-bit I would expect this to work since this is a supported configuration, just not the first in order. Either way the fix made it work.

@YaronNaveh

What's next? get this blog rss updates or register for mail updates!

Programatically install SSL for WCF self hosting

@YaronNaveh

When we use SSL with IIS deployed services we can configure SSL in the IIS console. But what to do when we self host our service?

Here's one way to do it (vista / windows 7 / windows 2008 server only).

Run this command line:

netsh http add sslcert ipport=0.0.0.0:8732 certhash=4f35f9386692f45b6cc35b7e786c9f06625b9567 appid={00112233-4455-6677-8899-AABBCCDDEEFF}

Where:

ipport - The port on which you want to install SSL. The zeros stand for the local machine and 8732 is the port.

appid - any unique GUID should do it here.

certhash - The thumbprint of our certificate. See below how to get it.

How to get the certificate hash / thumbrpint?

1. Run mmc and add the certificates snap-in.
2. Double click your certificate and see its thumbprint (hash):



3. Convert the base64 representation to Hex - this is the value you need.

From code...

Now in many cases you will want to do the installation dynamically at run time. This is as easy as:

using System.Diagnostics;

...

void RunCommandLine(string filePath, string arguments)
{
     var p = new Process();
     p.StartInfo = new ProcessStartInfo(filePath, arguments);
     p.StartInfo.UseShellExecute = false;
     p.Start();
     p.WaitForExit(10000);
}

...

RunCommandLine(
   "netsh",
   "http add sslcert ipport=0.0.0.0:8732   certhash=4f35f9386692f45b6cc35b7e786c9f06625b9567 appid={00112233-4455-  6677-8899-AABBCCDDEEFF}");

@YaronNaveh

What's next? get this blog rss updates or register for mail updates!

Cryptic WCF error messages (part 7 of N)

@YaronNaveh

Yet another post in the ongoing series.

This one happens when you use 2-way ssl (e.g. client authenticates with an X.509 certificate in the HTTP level). You may get this error message:

The HTTP request was forbidden with client authentication scheme 'Anonymous'.

This simply means the client certificate failed validation on the server. So check you use the correct certificate and that it is valid on the server.

@YaronNaveh

What's next? get this blog rss updates or register for mail updates!

WCF Gotcha: Disabling SSL Validation

@YaronNaveh

When you use SSL with WCF or .Net 2.0 web services you might get this exception:

SecurityNegotiationException:

Could not establish trust relationship for the SSL/TLS secure channel with authority 'localhost'.

This means that the X.509 certificate that the server presented is not valid according to your client's trust chain. the trust chain is the list of certificate issuers that you trust. In many cases this means you should not trust this web service. In some cases you decide to trust it anyway, due to the fact that you know the author or are still in early testing stages. You have two options:

Option 1 - Make the certificate valid
You would need to have the server certificate or its issuer's certificate in the trusted certificates store of your client. This can be done using WinHttpCertCfg.exe or using the "mmc" console.

Option 2 - Configure WCF/.Net 2.0 to not validate the certificate
With WCF, a common gotcha is to try and achieve that by setting:

<serviceCertificate>
<authentication certificateValidationMode="None" />
</serviceCertificate>

However this will not work with transport level security (SSL) but only with message level security. The correct way to do it is the same one as with .Net 2.0 web services. Just add this code before calling the service:

using System.Net;
using System.Net.Security;
using System.Security.Cryptography.X509Certificates;
...
ServicePointManager.ServerCertificateValidationCallback = new RemoteCertificateValidationCallback(OnValidationCallback);
...
public static bool OnValidationCallback(object sender, X509Certificate cert, X509Chain chain, SslPolicyErrors errors)
{
return true;
}

@YaronNaveh

What's next? get this blog rss updates or register for mail updates!