WCF Transport Security w/Anonymous Client Problem

I've created a WCF service that I want to use transprot security with anonymous client access. The WCF service web.config lokks as follows:

Code Snippet

<system.serviceModel>

<services>

<servicename="EDS.Calm.Web.Service.LogMessageService"

behaviorConfiguration="LogMessageServiceBehavior">

<endpointaddress=""

binding="wsHttpBinding"

bindingConfiguration="LogMessageServiceBinding"

contract="Web.Service.ILogMessageService" />

</< FONT>service>

</< FONT>services>

<bindings>

<wsHttpBinding>

<bindingname="LogMessageServiceBinding">

<securitymode="Transport">

<transportclientCredentialType="None"/>

</< FONT>security>

</< FONT>binding>

</< FONT>wsHttpBinding>

</< FONT>bindings>

<behaviors>

<serviceBehaviors>

<behaviorname="LogMessageServiceBehavior">

<serviceDebugincludeExceptionDetailInFaults="False" />

</< FONT>behavior>

</< FONT>serviceBehaviors>

</< FONT>behaviors>

</< FONT>system.serviceModel>

I created a test certificate using makecert.exe, following the WS Transport Security example on MSDN. The makecert.exe execution I used was as follows:

Code Snippet

makecert.exe -sr LocalMachine -ss My -n CN=LogMessageService-HTTPS-Server -sky exchange -sk LogMessageService-HTTPS-Key

I added the certificate to my local IIS, using the Web Server Certificate Wizard. I was then able to successfully access the service in a browser by using the HTTPS address:https://localhost/CalmWsLocal/LogMessageService.svc

The problem I'm encountering is when I attempt to Add Service Reference within Visual Studio 2005, I get the following error:

Code Snippet

HTTP GET Error

URI:https://localhost/CalmWsLocal/LogMessageService.svc

There was an error downloading

'https://localhost/CalmWsLocal/LogMessageService.svc'.

The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.

The remote certificate is invalid according to the validation procedure.

The MSDN WS Transport Security example works without fail, however, there is no Add Service Reference task as a part of the example.
I am relatively new to WCF and certificates, so it may a simple overlook on my part.
Any suggestions?
[7813 byte] By [TerryBarger] at [2008-1-10]
# 1

hi

It does not have to do with ssl or certificats

the thing is that "add service reference" connects to your service using https (in your case) get

you have to enable that it your behavior:

<serviceMetadata httpsGetEnabled = true>

manu cohen-yashar

manukahn at 2007-10-3 > top of Msdn Tech,Visual Studio Orcas,Windows Communication Foundation (Indigo)...
# 2

Thanks for the response. I added the behaviour as you suggested, but I'm still getting the same error.

Any other ideas?

TerryBarger at 2007-10-3 > top of Msdn Tech,Visual Studio Orcas,Windows Communication Foundation (Indigo)...
# 3

Try to browse to the service using IE. If this works you should be able to add reference.

Anyway you can allways use a channel factory or svcutil tool

msnu

manukahn at 2007-10-3 > top of Msdn Tech,Visual Studio Orcas,Windows Communication Foundation (Indigo)...
# 4

Both the service and the WSDL display without any problems in IE.

Using svcutil.exe gives me the same error messages that I encountered using Add Service Reference from Visual Studio.

TerryBarger at 2007-10-3 > top of Msdn Tech,Visual Studio Orcas,Windows Communication Foundation (Indigo)...
# 5

The thing is that your service listen on https but Visual Studio and SvcUtil call it (to get the WSDL and create the proxy) on http !

so change the address to / (disable transport security) create the proxy and then change the address and the security mode manualy to transport security and https. The proxy is the same anyway

manu cohen-yashar

manukahn at 2007-10-3 > top of Msdn Tech,Visual Studio Orcas,Windows Communication Foundation (Indigo)...
# 6

I tried your suggestion; disabled transport security, created my proxy, verified that the WCF service worked, then manually enabled transport security and https. I'm now getting the following error when I call tne WCF service:

"The HTTPS channel factory does not support explicit specification of an identity in the EndpointAddress unless the authentication scheme is NTLM or Negotiate.\r\nParameter name: remoteAddress"

Not sure where to go from here...

TerryBarger at 2007-10-3 > top of Msdn Tech,Visual Studio Orcas,Windows Communication Foundation (Indigo)...
# 7

Problem with your initial setup is that the certificate is failing validation. Look at the issuer of the cert you are using and make sure that the issuer cert is in the trusted root store.

srilathainavolu at 2007-10-3 > top of Msdn Tech,Visual Studio Orcas,Windows Communication Foundation (Indigo)...

Visual Studio Orcas

Site Classified