3
votes

I'm trying to use a service publicated by another company. The specifications about the auth and communication are:

  • SOAP
  • HTTPS with mutual SSL auth (2-way SSL)
    • Use a public certificate that they send us (I'm using as ServiceCertificate)
    • Use a private certificate that they created to us (I'm using as ClientCertificate)
  • WS-Security with UsernameToken

Here's the code I've come with until now:

WSHttpBinding binding = new WSHttpBinding(SecurityMode.Transport);
binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.Certificate;
binding.SendTimeout = binding.CloseTimeout = binding.ReceiveTimeout = binding.OpenTimeout = new TimeSpan(0, 15, 0); // 15 minutes

Uri uri = new Uri(input.ServiceAddress);
EndpointAddress endpointAddress = new EndpointAddress(uri);

// Client creation
using (Client client = new Client(binding, endpointAddress))
{
    client.ClientCredentials.ClientCertificate.Certificate = input.PrivateCertificate;
    client.ClientCredentials.ServiceCertificate.DefaultCertificate = input.PublicCertificate;

    client.Open();

    // Service call
    ResponseType response = client.ServiceCall(params);
}

I'm getting this error when the service is being called:

An error occurred while making the HTTP request to service. This could be due to the fact that the server certificate is not configured properly with HTTP.SYS in the HTTPS case. This could also be caused by a mismatch of the security binding between the client and the server.

Things that I already tried:

  • Adding this line of code: "System.Net.ServicePointManager.SecurityProtocol = System.Net.SecurityProtocolType.Ssl3;"
  • Register the public certificate in the port with netsh
    • Using this command: "netsh http add sslcert ipport=0.0.0.0:443 certhash=Certificate thumbprint appid={Application GUID}"
    • Based on another problem we had in another project

I don't know how to solve this problem and I'm getting clueless about it! Already searched a lot and everything I try don't do it!

1
While I can't tell you whats wrong, I can tell you what may go wrong with the SSL3 & netsh bits: they could have turned SSL3 off after the recent poodle attack. You should checkout what protocols & ciphers are they offering in SSL handshake (i'm assuming your browser is trusting SSL certificate at least) and then see if you have those ciphers enabled. Netsh bit is irrelevant as that bit is server side and youre client would ignore that bit entirely unless you're running the server locally. You can use ssllabs.com to test what's coming from server side & whats on client side. - Maverik
ran out of word limit: when i said recent poodle attack, I mean as in news, not as in specifically your third party. - Maverik
@Maverik, thanks! I have a manual explaining the requirements for authentication and connection. What I know I've wrote on the question, but I'll try to ask them a little more. Sadly, ssllabs got an unexpected error when checking the domain name, but the server certificate (the public one I said) was there, with one to make it trusted it (VeriSign). - Iúri dos Anjos
I just noticed you also have UsernameToken in your requirements. Is it possible that WCF is actually chocking on the fact that you're not sending it through as per your sample code? Your code is looking very much like one I'm working with except I get a saml token from STS while yours appears to be generated clientside? The requirements indicate they're probably expecting a Holder of Key token and wcf is very cryptic and misleading in these situations. you may want to check out WIF which has built-in UsernameToken as well as a way to send proper requests as per your requirements above. - Maverik
@Maverik: Yes, its a generated clientside bases on their wsdl. The UsernameToken is on the "params" that I wrote on code as a parameter. The pattern is shown on this link. The "ssllabs" now are returning successfully the evaluation of their domain, but no success yet. I've got another error while trying some other things: "Could not establish secure channel for SSL/TLS with authority 'service'." - Iúri dos Anjos

1 Answers

0
votes

Hapenned that our infra-structure had some network problems. As soon as we've get the security layer off of my machine, the service work out.

I guess the certificates (maybe the keys) were not passing through the network and I was getting that error ('cause it was not authenticating).