一、生成证书
使用管理员登录,执行下面的命令 导入证书
makecert -r -pe -n "CN=127.0.0.1" -sr LocalMachine -ss My -sky exchange
提示成功后表明证书已生成。
如果没有这个makercert.exe,从WIN7机器中拷贝一个到服务器(比如win2008)也可以。
理论上,这个exe可以存放在任意地方
证书生成之后,怎么看?可以这样:
运行 mmc
命令
添加证书管理单元
二、证书在WCF上的应用
证书与WCF,这两坨都是我所讨厌的。现在它们混成一伙,狼狈为奸了。尤其是WCF,垃圾。垃圾中的战斗圾。搞出来就是为了恶心人。
1、在应用WCF的项目的web.config加入以下类似代码。比如这是一个文件服务器项目。
<system.serviceModel>
<bindings>
<wsHttpBinding>
<binding name="wsHttpEndpointBinding" maxReceivedMessageSize="2147483647" maxBufferPoolSize="2147483647">
<security>
<message clientCredentialType="UserName" />
</security>
<readerQuotas maxArrayLength="2147483647" maxStringContentLength="2147483647" maxBytesPerRead=" 2147483647" maxDepth="2147483647" maxNameTableCharCount="2147483647" />
</binding>
</wsHttpBinding>
</bindings>
<services>
<service name="SHIT.FileServer.FileProService" behaviorConfiguration="SHIT.FileServer.FileProServiceBehavior">
<endpoint address="" binding="wsHttpBinding" name="username" contract="SHIT.FileServer.IFileProService" bindingConfiguration="wsHttpEndpointBinding">
</endpoint>
<endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />
</service>
</services>
<behaviors>
<serviceBehaviors>
<behavior name="SHIT.FileServer.FileProServiceBehavior">
<serviceMetadata httpGetEnabled="true" />
<serviceDebug includeExceptionDetailInFaults="true" />
<serviceCredentials>
<issuedTokenAuthentication allowUntrustedRsaIssuers="true"></issuedTokenAuthentication>
<serviceCertificate findValue="127.0.0.1" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" />
<userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="SHIT.Core.WCF.LtNamePasswordValidator,SHIT.Core" />
</serviceCredentials>
</behavior>
</serviceBehaviors>
</behaviors>
</system.serviceModel>
谁能看懂这一大坨是个什么鬼。不过里面有一个”127.0.0.1”与上面生成证书的中命令参数相关。
makecert -r -pe -n "CN=127.0.0.1" -sr LocalMachine -ss My -sky exchange
2、在客户端,凭用户名和密码来访问这个WCF服务:
string httpIP = "127.0.0.1";
if (string.IsNullOrEmpty(httpIP)) throw new Exception("请配置文件上传服务地址参数:FileService");
EndpointAddress httpAddress = new EndpointAddress(httpIP);
_FileService = new FileProServiceClient("FileProService", httpAddress);
_FileService.ClientCredentials.ServiceCertificate.Authentication.CertificateValidationMode = System.ServiceModel.Security.X509CertificateValidationMode.None;
_FileService.ClientCredentials.UserName.UserName ="test" ;
_FileService.ClientCredentials.UserName.Password = "123456";
return _FileService;
三、如果提示“密钥集不存在(The process must have access rights for the private key)”
解决办法:
C:Documents and SettingsAll UsersApplication DataMicrosoftCryptoRSA将这个目录下的MachineKeys文件夹添加Everyone并赋予浏览权限
四、提示搜索到多个证书
如果手贱生成了多个证书,则可以删掉一些。方法可以参照 一。