title: WCF Service for Java Client Using Service Certificate and Self Signed Client Certificate Supplied by Client Developer
body: <p>I am developing a WCF service based on a vendor's implementation to receive data from them. I have a working version of this service using one way SSL with the client using our server certificate. Because of a recent change to their implementation, I now need to authenticate their client with a certificate instead of username and password.</p>
  
  <p>They develop in Java and I have no control over the client or the way they generate the certificate. They do not support the WSHttpBinding so I have to use the BasicHttpBinding. Their certificate is self-signed and will unfortunately be that way in production. I tried using Transport for the security and according to our server admin had their certificate installed appropriately on our server (I do not have access to our IIS server). I believe IIS was having an issue with the certificate because it is self-signed so I moved away from that implementation.</p>
  
  <p>After a lot of research I determined that it would probably only work if I validated their certificate in the service itself by getting it from the <code>OperationContext.Current.ServiceSecurityContext.AuthorizationContext.ClaimSets[0]</code>. This is my first WCF service so I believe I have it set up correctly but am getting the following error when testing from my WCF test client: <code>The private key is not present in the X.509 certificate</code>. When I have the vendor test from their client they are getting <code>An error occurred when verifying security for the message.</code></p>
  
  <p>Do I have something configured incorrectly? Is this implementation supported?</p>
  
  <p>Service Web.Config:</p>
  
  <pre><code>&lt;?xml version="1.0"?&gt;
      &lt;configuration&gt;
          &lt;system.serviceModel&gt;
                   &lt;behaviors&gt;
                  &lt;serviceBehaviors&gt;
                      &lt;behavior name="FileReceiverServiceBehavior"&gt;
                          &lt;useRequestHeadersForMetadataAddress/&gt;
                          &lt;serviceMetadata httpsGetEnabled="true"/&gt;
                      &lt;/behavior&gt;
                  &lt;/serviceBehaviors&gt;
              &lt;/behaviors&gt;
              &lt;bindings&gt;
                  &lt;basicHttpBinding&gt;
                      &lt;binding name="FileReceiverServiceBinding"&gt;
                          &lt;security mode="TransportWithMessageCredential"&gt;
                              &lt;message clientCredentialType="Certificate"/&gt;
                          &lt;/security&gt;
                          &lt;readerQuotas maxStringContentLength="2147483647"/&gt;
                      &lt;/binding&gt;
                  &lt;/basicHttpBinding&gt;
              &lt;/bindings&gt;
              &lt;services&gt;
                  &lt;service behaviorConfiguration="FileReceiverServiceBehavior" name="FileReceiverService.FileReceiverService"&gt;
                      &lt;endpoint address="" binding="basicHttpBinding" bindingConfiguration="FileReceiverServiceBinding" contract="FileReceiverServiceSoap" bindingNamespace="http://www.openuri.org/" /&gt;
                      &lt;endpoint address="mex" binding="mexHttpsBinding" contract="IMetadataExchange"/&gt;
                  &lt;/service&gt;
              &lt;/services&gt;
          &lt;/system.serviceModel&gt;
      &lt;/configuration&gt;
  </code></pre>
  
  <p>My WCF Test Client Config:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="utf-8" ?&gt;
  &lt;configuration&gt;
    &lt;system.serviceModel&gt;
      &lt;behaviors&gt;
        &lt;endpointBehaviors&gt;
          &lt;behavior name="test"&gt;
            &lt;clientCredentials&gt;
              &lt;clientCertificate findValue="Users"
                                 x509FindType="FindBySubjectName"
                                 storeLocation="LocalMachine"
                                 storeName="My"/&gt;
            &lt;/clientCredentials&gt;
          &lt;/behavior&gt;
        &lt;/endpointBehaviors&gt;
      &lt;/behaviors&gt;
      &lt;bindings&gt;
        &lt;basicHttpBinding&gt;
          &lt;binding name="BasicHttpBinding_FileReceiverServiceSoap" closeTimeout="00:01:00"
            openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
            allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
            maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
            messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
            useDefaultWebProxy="true"&gt;
            &lt;readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
              maxBytesPerRead="4096" maxNameTableCharCount="16384" /&gt;
            &lt;security mode="TransportWithMessageCredential"&gt;
              &lt;transport clientCredentialType="None" proxyCredentialType="None"
                realm="" /&gt;
              &lt;message clientCredentialType="Certificate" algorithmSuite="Default" /&gt;
            &lt;/security&gt;
          &lt;/binding&gt;
        &lt;/basicHttpBinding&gt;
      &lt;/bindings&gt;
      &lt;client&gt;
        &lt;endpoint address="https://mydomain.com/vendor/FileReceiverService.svc"
          binding="basicHttpBinding" bindingConfiguration="BasicHttpBinding_FileReceiverServiceSoap"
          contract="ServiceReference1.FileReceiverServiceSoap" name="BasicHttpBinding_FileReceiverServiceSoap" behaviorConfiguration="test" /&gt;
      &lt;/client&gt;
    &lt;/system.serviceModel&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <h2><strong>Update:</strong></h2>
  
  <p>The vendor sent me the correct certificate. It is a valid certificate issued by a commercial CA. When I view the certificate locally I can see the chain to the trusted root and the status shows 'OK'.</p>
  
  <p>If I use <code>security mode="Transport"</code> and <code>transport clientCredentialType="Certificate"</code> I get: The HTTP request was forbidden with client authentication scheme 'Anonymous'</p>
  
  <p>If I use <code>security mode="TransportWithMessageCredential"</code> and <code>message clientCredentialType="Certificate"</code> I get: The private key is not present in the X.509 certificate. </p>
  
  <p>I think I may need to use strictly Transport so that it is interoperable with the Java client so I am focusing on the "The HTTP request was forbidden with client authentication scheme 'Anonymous'" error. Is that an issue with IIS settings or is it just not able to correctly validate the certificate when it gets to the server? The certificate is in Trusted People and I tried no client <code>certificateValidationMode</code> but also <code>PeerTrust</code>, <code>ChainTrust</code> and <code>PeerOrChainTrust</code>. Any help would be greatly appreciated.</p>
  
  <h2><strong>Update2:</strong></h2>
  
  <p>I am focusing on getting this to work with the following change to my original server configuration and matching change to my test client:</p>
  
  <pre><code>&lt;security mode="Transport"&gt;
    &lt;transport clientCredentialType="Certificate"/&gt;
  </code></pre>
  
  <p>I still get: <em>The HTTP request was forbidden with client authentication scheme 'Anonymous'</em>. I found an explanation <a href="http://blog.coditate.com/2009/04/confusing-errors-using-wcf-transport.html" rel="nofollow">here</a> that basically confirms that the client certificate could not be validated by the server. How do I have our server administrators configure this application in IIS and install the certificate so that this works correctly?</p>