<certificate> of <clientCertificate> Element

Article
07/03/2007

Specifies an X.509 certificate used to sign and encrypt messages.

<system.serviceModel>

<serviceCredentials> Element

                                    
                                    <certificate findValue = "String" 
                                
                                    
                                    storeLocation = "CurrentUser/LocalMachine"
                                
                                    
                                    storeName="AddressBook/AuthRoot/CertificateAuthority/Disallowed/My/Root/TrustedPeople/TrustedPublisher"
                                
                                    
                                    X509FindType="FindByThumbPrint/FindBySubjectName/FindBySubjectDistinguishedName/FindByIssuerName/FindByIssuerDistinguishedName/FindBySerialNumber/FindByTimeValid/FindByTimeNotYetValid/FindByTemplateName/FindByApplicationPolicy/FindByCertificatePolicy/FindByExtension/FindByKeyUsage/FindBySubjectKeyIdentifier"
                                
                                    
                                    />

Attributes and Elements

The following sections describe attributes, child elements, and parent elements

Attributes

Attribute	Description
findValue	A string that contains the value to search for in the X.509 certificate store. The type contained in the attribute must satisfy the requirements of the specified X509FindType. The default is an empty string.
storeLocation	Specifies the location of the X.509 certificate store that the client uses to validate the server’s certificate against. Valid values include the following: LocalMachine: the certificate store assigned to the local machine. CurrentUser: the certificate store assigned to the current user. The default is LocalMachine.
storeName	Specifies the name of the X.509 certificate store to open. Valid values include the following: AddressBook: Certificate store for other users. AuthRoot: Certificate store for third-party certificate authorities (CAs). CertificateAuthority: Certificate store for intermediate certificate authorities (CAs). Disallowed: Certificate store for revoked certificates. My: Certificate store for personal certificates. Root: Certificate store for trusted root certificate authorities (CAs). TrustedPeople: Certificate store for directly trusted people and resources. TrustedPublisher: Certificate store for directly trusted publishers. The default is My.
X509FindType	Defines the type of X.509 search to be executed. Valid values include the following: FindByThumbPrint FindBySubjectName FindBySubjectDistinguishedName FindByIssuerName FindByIssuerDistinguishedName FindBySerialNumber FindByTimeValid FindByTimeNotYetValid FindByTemplateName FindByApplicationPolicy FindByCertificatePolicy FindByExtension FindByKeyUsage FindBySubjectKeyIdentifier The type contained in the findValue attribute must satisfy the requirements of the specified X509FindType. The default value is FindBySubjectDistinguishedName.

Child Elements

None.

Parent Elements

Element	Description
<clientCertificate> of <serviceCredentials>

Remarks

The <certificate> element is used when the service must have the client's certificate in advance to communicate securely with the client. This occurs when using the duplex communication pattern. In the more typical request/response pattern, the client includes its certificate in the request, which the service uses to encrypt and sign its response back to the client. In the duplex communication pattern, however, the service does not have a request from the client and therefore it needs the client's certificate in advance to secure the message to the client. Therefore you must obtain the client's certificate in an out-of-band negotiation, and specify the certificate using this element. For more information about duplex services, see How to: Create a Duplex Contract.

Example

The following code specifies how to find an appropriate X.509 certificate and a custom validation type in the <authentication> element.

<serviceBehaviors>
 <behavior name="myServiceBehavior">
  <clientCertificate>
   <certificate 
         findValue="www.cohowinery.com" 
         storeLocation="CurrentUser" 
         storeName="TrustedPeople"
         x509FindType="FindByIssuerName" />
   <authentication customCertificateValidatorType="MyTypes.Coho"
    certificateValidationMode="Custom" 
    revocationMode="Offline"
    includeWindowsGroups="false" 
    mapClientCertificateToWindowsAccount="true" />
  </clientCertificate>
 </behavior>
</serviceBehaviors>

Insert content here.

Share via