How to fix “the server certificate is not configured properly with HTTP.SYS” on Windows 7?

4
votes

I'm building a wcf client which consumes a service from a brazilian government institution. This connection uses Soap 1.2 and it needs to be signed with a digital certificate.

The code used for this example is a Console Application using .Net 4.6.1. The main application is a WPF application (I'm not using IIS). This code works without a problem on Windows 10 but when I try to run it on Windows 7 it gives me the following error:

System.ServiceModel.CommunicationException: An error occurred while making the HTTP request to https://nfce-homologacao.svrs.rs.gov.br/ws/NfeStatusServico/NfeStatusServico2.asmx. This could be due to the fact that the server certificate is not configured properly with HTTP.SYS in the HTTPS case. This could also be caused by a mismatch of the security binding between the client and the server. ---> System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send. ---> System.IO.IOException: Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host. ---> System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host.

This is the client call code:

XmlNode node = null;

var parametro = new TConsStatServ();
parametro.cUF = NFeAPI.XMLSchemas.NfeStatusServico2.Envio.TCodUfIBGE.Item53;
parametro.tpAmb = NFeAPI.XMLSchemas.NfeStatusServico2.Envio.TAmb.Item2;
parametro.versao = "3.10";
parametro.xServ = TConsStatServXServ.STATUS;

var certificate = GetCertificateByName("Certificate Name", false);

string nFeNamespaceName = "http://www.portalfiscal.inf.br/nfe";
string parametroXML = XmlUtil.Serialize(parametro, nFeNamespaceName);

XmlDocument doc = new XmlDocument();
XmlReader reader = XmlReader.Create(new StringReader(parametroXML));
reader.MoveToContent();

node = doc.ReadNode(reader);

nfeCabecMsg soapHeader = new nfeCabecMsg();
soapHeader.cUF = parametro.cUF.ToString().Replace("Item", "");
soapHeader.versaoDados = "3.10";

var soapClient = new NfeStatusServico2SoapClient("NfeStatusServico2Soap");
soapClient.ClientCredentials.ClientCertificate.Certificate = certificate;

XmlNode result = soapClient.nfeStatusServicoNF2(ref soapHeader, node);

Here is my App.config:

<system.serviceModel>
    <bindings>
        <basicHttpBinding>
            <binding name="NfeStatusServico2Soap">
              <security mode="Transport">
                <transport clientCredentialType="Certificate"/>
              </security>
            </binding>
            <binding name="NfeStatusServico2Soap1" />
        </basicHttpBinding>
    </bindings>
    <client>
        <endpoint address="https://nfce-homologacao.svrs.rs.gov.br/ws/NfeStatusServico/NfeStatusServico2.asmx"
            binding="basicHttpBinding" bindingConfiguration="NfeStatusServico2Soap"
            contract="NfeStatusServico2.NfeStatusServico2Soap" name="NfeStatusServico2Soap" />
    </client>
</system.serviceModel>

The GetCertificateByName is helper method I've created to return the X509Certificate2 need by the service.

I've already tried disabling Windows 7 firewall and I went to Programs and Features -> Turn Windows features on or off and enabled the .net 3 framework node for wcf calls.

I have also tried to use a WebReference with a .NET 2.0 application and it gave the same error. I upgraded the code to use wcf in .net 4.6.1 in hope for it to work.

I tried to use fiddler to track the problem and it returns the code 200 but not much help with that.

It's been 5 days and I can't manage to get around this issue. I'm about to drop Windows 7 support on my application because of that.

3
c#.netweb-serviceswcfsoap
It will be better to enable logs and trace in your wcf client code and check the soap request passed and exact response/error message being received from the wcf service. – Hameed Syed
I'll try that. By enabling logs, do you mean writing the code using tracelogs of .net framework or is there any tool I can use out of the box? – user6490459
YOu have specific tracer and loger wizard for WCF.Check out this csharp-video-tutorials.blogspot.in/2013/11/…. – Hameed Syed
Thank you for pointing that. I'll give it a try for learning purposes. For this problem, a windows update fixed the problem. – user6490459

3 Answers

9
votes

In my case, the problem was that my project was still using .Net Framework 4.0, which does not support TLS 1.1 or 1.2, and the service I was connecting to had turned off support for TLS 1.0 as of Jan 1, 2018. Once I upgraded the project to .Net Framework 4.5 and forced TLS 1.2, everything worked fine.

System.Net.ServicePointManager.SecurityProtocol = System.Net.SecurityProtocolType.Tls12;
3
votes

In my case activating Windows Update and letting it install all the important updates fixed the problem.

After some research on the HTTP.SYS I've found a Microsoft website saying that HTTP.SYS had some "known issues" and I thought it could've been fixed in some update. For my luck it was the case.

0
votes

Download IIS Crypto and set suggested changes. While calling set tls 1.2

System.Net.ServicePointManager.SecurityProtocol = System.Net.SecurityProtocolType.Tls12;