WCF - basicHttpBinding configuration (exception: Identity check failed for outgoing message. The expected DNS identity of the remote endpoint ...)

ITMemberAHE 6 Reputation points
2021-09-28T08:35:28.49+00:00

I'm trying to make a soap client in VisualStudio. First thing I've done was generating proxy class with delivered WSDL file (using Add Service Reference option in VisualStudio).
It was generated with wrong binding configuration - message security should be:
DefaultAsymmetricSignatureAlgorithm - "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"
DefaultCanonicalizationAlgorithm - "http://www.w3.org/2001/10/xml-exc-c14n#" and
DefaultDigestAlgorithm - "http://www.w3.org/2001/04/xmlenc#sha256",

while it is:
DefaultAsymmetricSignatureAlgorithm "http://www.w3.org/2000/09/xmldsig#rsa-sha1"
DefaultCanonicalizationAlgorithm "http://www.w3.org/2001/10/xml-exc-c14n#" and
DefaultDigestAlgorithm "http://www.w3.org/2000/09/xmldsig#sha1".

I changed basicHttpBinding settings in App.conf by adding: 

<security mode="Message">
            <message algorithmSuite="Basic256Sha256" clientCredentialType="Certificate"/>
</security>

and binding settings changed properly, I also set certificates: 

var cert = new X509Certificate2(AppDomain.CurrentDomain.BaseDirectory + "//cert.p12", "Pass");
client.ChannelFactory.Credentials.ClientCertificate.Certificate = cert;
client.ClientCredentials.ClientCertificate.Certificate = cert;

Unfortunately I got exception: The service certificate is not provided for target 'http://.../service'. Specify a service certificate in ClientCredentials.

But I don't think I have a service certificate at all (service belongs to another company). I tried using the same certificate for ClientCertificate and ServiceCertificate.

client.ClientCredentials.ServiceCertificate.DefaultCertificate = cert;

But I got error: The certificate that was used has a trust chain that cannot be verified. Replace the certificate or change the certificateValidationMode.

Changing mode to None gives excepion Security not found.

I added <authentication certificateValidationMode="PeerOrChainTrust" revocationMode="NoCheck"/> in serviceBehaviors/behavior/serviceCredentials/clientCertificate, and it doesn't work.

I also tried adding <authentication certificateValidationMode="PeerOrChainTrust" revocationMode="NoCheck"/> in endpointBehaviors/behavior/clientCredentials/serviceCertificate,

but I got another error: "Identity check failed for outgoing message. The expected DNS identity of the remote endpoint was 'nameA' but the remote endpoint provided DNS claim 'nameB'. If this is a legitimate remote endpoint, you can fix the problem by explicitly specifying DNS identity 'nameB' as the Identity property of EndpointAddress when creating channel proxy. ”

And I'm not sure if I go right way anymore. I don't know what to do :(

In general, sending request using SoupUI works fine, but I can't make right configuration in my client service to send any request.

.NET
.NET
Microsoft Technologies based on the .NET software framework.
3,368 questions
C#
C#
An object-oriented and type-safe programming language that has its roots in the C family of languages and includes support for component-oriented programming.
10,235 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Jiayao Wu-MSFT 186 Reputation points Microsoft Vendor
    2021-09-29T03:08:56.51+00:00

    Hi @ITMemberAHE ,
    If you change the certificate, you need to update your identity/certificate node like this: 

    <identity>  
    <certificate encodedValue="..." />  
</identity>

    It is probably still pointing to your client's identity store and certificate.

    ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

    If the response is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    Best regards,
    Jiayao Wu