WCF Certificate Chain Trust Authentication: "The caller has not been authenticated by the service."

Question

I want to use certificate-based encryption and verification when communicating using the WCF service. Therefore, I created test certificates "TempCA" as my root CA and "SignedByCA" as a client certificate signed by this CA.

When I put the client certificate in "Local computer \ Trusted people" and use certificateValidationMode="PeerTrust" , the service recognizes the client and everything works as expected. But with checking the trust chain ( certificateValidationMode="ChainTrust" ), I ran into the error "The caller was not authenticated by the service."

Relevant server-side configuration:

 <behaviors> <serviceBehaviors> <behavior name="customServiceBehavior"> [...] <serviceCredentials> <clientCertificate> <authentication certificateValidationMode="ChainTrust" trustedStoreLocation="LocalMachine" mapClientCertificateToWindowsAccount="false" /> </clientCertificate> <serviceCertificate findValue="TempCA" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" /> </serviceCredentials> </behavior> </serviceBehaviors> </behaviors> <bindings> <wsHttpBinding> <binding name="soapBindingConfiguration"> <security mode="Message"> <message clientCredentialType="Certificate" /> </security> </binding> </wsHttpBinding> </bindings> 

Relevant client configuration (rest is automatically created using the "Add service link"):

 <endpointBehaviors> <behavior name="customClientBehavior"> <clientCredentials> <clientCertificate findValue="SignedByCA" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" /> </clientCredentials> </behavior> </endpointBehaviors> 

Both client and server certificates are stored with their private key in "Local Computer \ Personal" (because I am testing on the same computer), and "TempCA" (my root certificate) is also located in "Local Computer \ Trusted" Root Certification Authorities ".

What am I missing here? Any working examples?

Answer 1

I finally figured out what the problem is. Review revocation has been disabled. My test CA obviously does not have an associated CRL, so in this case, WCF seems to block every client because it cannot be verified.

 <clientCertificate> <authentication certificateValidationMode="ChainTrust" revocationMode="NoCheck" ←←←←←←←←←←←←←←←←←←←←←←←←←←←←←←← [...] /> </clientCertificate> 

Answer 2

It seems that what you are doing should work based on this MSDN article on using certificates with WCF. You can remove a certificate from personal storage by using the trusted root certificate method.

If this does not work, then it is possible that deploying the root certificate also requires applying Group Policy to your machine. Have a look at the “If you don’t use the Microsoft Enterprise Certified Certificate Authority Certification Authority and want only computer groups” section of this TechNet article. It says that computers cannot automatically trust the root certificate if the group policy is not applied. It seems that the two articles contradict each other to a friend, so I'm not sure what will work.