WCF certificate security with Mono

Question

I'm trying to migrate an existing application to Mono (v2.10.2).

Therefore I created a test WCF service with BasicHttpBinding and message security. The client works perfectly with .NET, but when running with Mono it fails.

The client factory is instantiated as follows:

//var certificate = CertificateUtil.GetCertificate(StoreLocation.LocalMachine, 
//    StoreName.My, X509FindType.FindBySubjectDistinguishedName, CertName, true);
var certificate = new X509Certificate2("certificate.pfx", "password");

var binding = new BasicHttpBinding();
binding.Security.Mode = BasicHttpSecurityMode.Message;
binding.Security.Message.ClientCredentialType = BasicHttpMessageCredentialType.Certificate;

var epa = new EndpointAddress(
    new Uri("http://localhost:53076/Service1.svc"),
    new X509CertificateEndpointIdentity(certificate));

var factory = new ChannelFactory<IService1>(binding, epa);
factory.Credentials.ServiceCertificate.DefaultCertificate = certificate;
factory.Credentials.ServiceCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.None;
factory.Credentials.ServiceCertificate.Authentication.RevocationMode = X509RevocationMode.NoCheck;
factory.Credentials.ClientCertificate.Certificate = certificate;

var client = factory.CreateChannel();

In Mono the application fails within CreateChannel throwing the exception:

System.InvalidOperationException: The binding does not support any of the channel types that the contract 'IService1' allows.

I debugged into the Mono source code and found out that the problem is that AsymmetricSecurityBindingElement.InitiatorTokenParameter == null.

I'm new to Mono, maybe you could point me to a documentation/tutorial which covers this topic.

UPDATE:

With the aid of konrad.kruczynski the certificate object has a private key now. The exception is still the same. So this is not a certificate store issue.

Maybe somebody could point me a better way to reading certificates than searching them in the certificates store. Reading them from a pfx file would be perfekt for my purpose. — Michael Stoll
I would consider this a bug then. Worth adding to bugzilla, they get fixed quick sometimes. — konrad.kruczynski
Message security is not officially supported. So I won't get help from the mono mailing list. — Michael Stoll
I have the exact same need, so I'm quite interested in your success here. — JCCyC

konrad.kruczynski konrad.kruczynski · Accepted Answer · 2011-07-22T14:59:24

Yes, certificates created on Windows usually does not contain private key. They can be found in some kind of cache. You should be able to create certificate with private key using this instruction. X509Certificate2 should consume the file without problems. You can also try procedure described here. In case of any problems just write.

It is also worth adding, that certificates created such way on Linux works perfectly on Windows too.

Update:

I'm not sure whether I understood your comment correctly. You can load PFX certificate using code like that:

var myCert = new X509Certificate2("filename.pfx", "password");

Given certficate contained key, it worked for me.

WCF certificate security with Mono

1 Answers