Client certificate is required. No certificate was found in the request

Question

I’m trying to setup a security transport using certificates over a SSL service.

The service is installed over IIS, I have configured it using a “MyLaptop” certificate (stored on local machine/Personal) validated by a self-signed certificate (“My Root CA” certificate – stored on local machine Trusted Root Certification Authorities). Everything seems to be OK with the service; I can access it using the Internet Explorer.

On the server side the web.config looks like

<behaviors>
      <serviceBehaviors>
        <behavior name="EchoServiceBehavior">
          <serviceCredentials>
            <clientCertificate>
              <authentication certificateValidationMode="PeerTrust" revocationMode="NoCheck" />
            </clientCertificate>                
          </serviceCredentials>
          <serviceMetadata httpsGetEnabled="true" />
        </behavior>
      </serviceBehaviors>
    </behaviors>    
    <bindings>
      <wsHttpBinding>
        <binding name="MutualSslBinding">
          <security mode="Transport">
            <transport clientCredentialType="Certificate" />
          </security>
        </binding>
      </wsHttpBinding>
    </bindings>
    <services>
      <service behaviorConfiguration="EchoServiceBehavior" name="HttpsBindingDemo.EchoService">
        <endpoint address="" binding="wsHttpBinding" bindingConfiguration="MutualSslBinding"
          contract="HttpsBindingDemo.IEchoService">
          <identity>
            <dns value="MyLaptop" />
          </identity>
        </endpoint>
        <host>
          <baseAddresses>
            <add baseAddress="https://MyLaptop:12643/EchoService/" />
          </baseAddresses>
        </host>
      </service>

On the client side I have installed a new certificate “MyClient” (stored on CurrentUser/Personal) validated by the same “My Root CA” certificate.

On the client side the app.config looks like

<behaviors>
      <endpointBehaviors>
        <behavior name="EchoClientBehavior">
          <clientCredentials>
            <clientCertificate findValue="MyClient" storeLocation="CurrentUser" storeName="My" x509FindType="FindBySubjectName" />
          </clientCredentials>
        </behavior>
      </endpointBehaviors>
    </behaviors>
    <bindings>
      <wsHttpBinding>
        <binding name="WSHttpBinding_IEchoService">
          <security mode="Transport">
            <transport clientCredentialType="Certificate" />
          </security>
        </binding>
      </wsHttpBinding>
    </bindings>
    <client>
      <endpoint address="https://MyLaptop:12643/EchoService/EchoService.svc" behaviorConfiguration="EchoClientBehavior"
        binding="wsHttpBinding" bindingConfiguration="WSHttpBinding_IEchoService"
        contract="SecuredServices.IEchoService" name="WSHttpBinding_IEchoService">
        <identity>
          <dns value="MyLaptop" />
        </identity>
      </endpoint>
    </client>

Every time when trying to execute the operations of the EchoService.svc I’m receiving the error below: “The HTTP request was forbidden with client authentication scheme 'Anonymous'.” Enabling the service’s log I found that first exception message is in fact “Client certificate is required. No certificate was found in the request. This might be because the client certificate could not be successfully validated by the operating system or IIS. For information on how to bypass those validations and use a custom X509CertificateValidator in WCF please see http://go.microsoft.com/fwlink/?LinkId=208540.”.

Could you please help me to understand how to correctly configure the service to avoid the described errors? Thank you!

Aaron Havens Aaron Havens · Accepted Answer · 2013-12-02T21:37:24

It looks like you are most likely missing the serviceCertificate tag inside of your serviceCredentials tag in your service behavior. Try adding this and it should resolve the issue. Each time I use certificates with a WCF service I always have to specify in the config what certificate the service should be using.

http://msdn.microsoft.com/en-us/library/ms731340%28v=vs.110%29.aspx

Client certificate is required. No certificate was found in the request

2 Answers