WCF HTTPS SSL Self Hosted Cert. How to work?

Question

I'm struggling to convert a silverlight application from HTTP to HTTPS using WCF and a self-signed certificate registered in IIS.

The calls I made on the Visual Studio 2010 command line:

makecert -sv SignRoot.pvk -cy authority -r signroot.cer -a sha1 -n "CN=Dev Certification Authority" -ss my -sr localmachine makecert -iv SignRoot.pvk -ic signroot.cer -cy end -pe -n CN="localhost" -eku 1.3.6.1.5.5.7.3.1 -ss my -sr localmachine -sky exchange -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12 

I have it as an endpoint (this is a call that is still not HTTP in Fiddler)

 <!-- Address that the Silverlight clients will connect to --> <!-- as specified in their web.config --> <add key="gatewayListeningHttpURI" value="http://localhost:10201/" /> 

Current server configuration:

 <!-- set up binding for duplex service --> <bindings> <customBinding> <binding name="customDuplexBinding"> <pollingDuplex duplexMode="MultipleMessagesPerPoll" maxOutputDelay="00:00:01" serverPollTimeout="00:01:00" inactivityTimeout="02:00:00" maxPendingMessagesPerSession="2147483647" maxPendingSessions="2147483647" /> <binaryMessageEncoding> <readerQuotas maxDepth="2147483647" maxStringContentLength="2147483647" maxArrayLength="2147483647" maxBytesPerRead="2147483647" maxNameTableCharCount="2147483647" /> </binaryMessageEncoding> <httpTransport maxBufferSize="2147483647" maxReceivedMessageSize="2147483647" transferMode="StreamedResponse" /> </binding> </customBinding> </bindings> <behaviors> <endpointBehaviors> <!-- For Policy Service --> <behavior name="webHttpEndpointBehavior"> <webHttp /> </behavior> </endpointBehaviors> <serviceBehaviors> <behavior name="sb"> <!-- To avoid disclosing metadata information, set the value below to false and remove the metadata endpoint above before deployment --> <serviceMetadata httpGetEnabled="true"/> <!-- To receive exception details in faults for debugging purposes, set the value below to true. Set to false before deployment to avoid disclosing exception information --> <serviceDebug includeExceptionDetailInFaults="true"/> <!-- This will solve a bug that happens if too many items are sent at once from the gateway to the client --> <dataContractSerializer maxItemsInObjectGraph="2147483647"/> <serviceThrottling maxConcurrentCalls="200" maxConcurrentSessions="200" maxConcurrentInstances="200" /> </behavior> </serviceBehaviors> </behaviors> <services> <service name="ME.Streets.WebGateway.DuplexService.DuplexService" behaviorConfiguration="sb"> <endpoint address="basic" binding="customBinding" bindingConfiguration="customDuplexBinding" contract="ME.Streets.WebGateway.DuplexService.Interface.IDuplexServiceContract"> </endpoint> <endpoint address="" binding="webHttpBinding" behaviorConfiguration="webHttpEndpointBehavior" contract="ME.Streets.WebGateway.DuplexService.Interface.IPolicyRetriever"/> <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange"/> </service> </services> 

Current client configuration:

 private DuplexServiceContractClient CreateDuplexServiceClient(EndpointAddress endPoint) { PollingDuplexBindingElement pollingDuplexBindingElement = new PollingDuplexBindingElement(); pollingDuplexBindingElement.DuplexMode = PollingDuplexMode.MultipleMessagesPerPoll; #if DEBUG pollingDuplexBindingElement.ClientPollTimeout = TimeSpan.FromMinutes(15); pollingDuplexBindingElement.InactivityTimeout = TimeSpan.FromMinutes(14); #else pollingDuplexBindingElement.ClientPollTimeout = TimeSpan.FromMinutes(60); pollingDuplexBindingElement.InactivityTimeout = TimeSpan.FromMinutes(60); #endif HttpsTransportBindingElement httpsTransportBindingElement = new HttpsTransportBindingElement(); httpsTransportBindingElement.MaxBufferSize = int.MaxValue; httpsTransportBindingElement.MaxReceivedMessageSize = int.MaxValue; httpsTransportBindingElement.TransferMode = TransferMode.StreamedResponse; CustomBinding binding = new CustomBinding( pollingDuplexBindingElement, new BinaryMessageEncodingBindingElement(), httpsTransportBindingElement); var dscc = new DuplexServiceContractClient(binding, endPoint); dscc.InnerChannel.OperationTimeout = TimeSpan.FromMinutes(5); #if DEBUG dscc.InnerChannel.OperationTimeout = TimeSpan.FromMinutes(15); #endif return dscc; } 

I deployed the silverlight application in IIS and added the HTTPS protocol to it so that I can reach it by adding HTTPS in front of the web address.

The problem remains when I log in to https (https: // localhost / FleetNew), I still get the error "Display MIxed Content"

When I look in fidler, this is a localhost call: 10201 - this is an insecure HTTP call.

My netsh http show sslcert command brings me this:

 IP:port : 0.0.0.0:10201 Certificate Hash : 0fb891e03c857d1c50b63163e5a0b999ed757ea1 Application ID : {3d5900ae-111a-45be-96b3-d9e4606ca793} Certificate Store Name : (null) Verify Client Certificate Revocation : Enabled Verify Revocation Using Cached Client Certificate Only : Disabled Usage Check : Enabled Revocation Freshness Time : 0 URL Retrieval Timeout : 0 Ctl Identifier : (null) Ctl Store Name : (null) DS Mapper Usage : Disabled Negotiate Client Certificate : Disabled IP:port : 0.0.0.0:443 Certificate Hash : 0fb891e03c857d1c50b63163e5a0b999ed757ea1 Application ID : {4dc3e181-e14b-4a21-b022-59fc669b0914} Certificate Store Name : MY Verify Client Certificate Revocation : Enabled Verify Revocation Using Cached Client Certificate Only : Disabled Usage Check : Enabled Revocation Freshness Time : 0 URL Retrieval Timeout : 0 Ctl Identifier : (null) Ctl Store Name : (null) DS Mapper Usage : Disabled Negotiate Client Certificate : Disabled 

Please help me set this up correctly so that the locahost: 20102 call works on ssl and HTTPS

Answer 1

Well, from what I can say, you are missing a few HTTPS metadata endpoint parameters and behavior configurations needed to host WCF self-service using SSL. The main steps to perform the necessary actions:

• Create a self-signed certificate (for testing purposes) with the matching common domain name of your final URL (it is best to use the name of your computer)
• Use netsh.exe to associate a port with your SSL certificate using its fingerprint.
• Configure the WCF.config file to get the necessary SSL settings.

This is a fairly lengthy process, so instead of trying to document every step here, I have a blog post detailing what you need to get a self-service WCF service using SSL. This should help you see a working solution that can then be applied to your project:

Applying and Using SSL Certificate with WCF Self-Service