I have a WCF Service that uses a X.509 certificate as client credentials. Most of these credentials do not require a password for using it, just for installing it.
But now, a client of ours has a certificate that requires a password to be entered every time it's used (ie. every time the service is running). This service calls another service n times a day, but fails if the certificate cannot be validated.
Until now we have asked our clients to order (and pay for) a new certificate every time we've had this problem, but both me and our clients are tired of going through this every time. I have not made the service myself, and don't have much any experience with WCF and services.
What I would like to know is: Is it possible to enter this password into our configuration file along with all the other information about the certificate?
Here is a part of the XML configuration for the service:
<configuration>
<system.serviceModel>
<client>
<endpoint
address="***"
binding="basicHttpBinding"
bindingConfiguration="***"
behaviorConfiguration="HTTPSEndpoint"
contract="***"
name="***" />
</client>
<bindings>
<basicHttpBinding>
<binding
name="***"
sendTimeout="00:05:00"
maxBufferSize="2147483647"
maxReceivedMessageSize="2147483647" >
<readerQuotas maxStringContentLength="2147483647" />
<security mode="Transport">
<transport clientCredentialType="Certificate" />
</security>
</binding>
</basicHttpBinding>
</bindings>
<behaviors>
<endpointBehaviors>
<behavior name ="HTTPSEndpoint">
<clientCredentials>
<clientCertificate
findValue="***"
storeLocation="LocalMachine"
storeName="My"
x509FindType="FindBySubjectName"/>
</clientCredentials>
</behavior>
</endpointBehaviors>
</behaviors>
</system.serviceModel>
</configuration>
509 certificate is that it is architected using a key pair consisting of a related public key and a private key. Applied to cryptography, the public and private key pair is used to encrypt and decrypt a message, ensuring both the identity of the sender and the security of the message itself.
The requirement to enter a password when retrieving the certificate from the certificate store on the client machine is because the certificate was imported with the "Enable strong private key protection" option checked:
This is often set as part of standard server-hardening processes. It is intended for situations where the certificate authenticates a user with a remote system while the user is in attendance.
Since the password prompt is due to the certificate import process, and is not an intrinsic property of the certificates, purchasing new certificates will not change anything.
I know of no way to programmatically pass the password to the certificate store when retrieving it. However, if you think about it, even if you were successful you'd have to secure the said password somehow. You might encrypt the password to your .config file, but now you have to store the encryption key. And so on... Somewhere there will be a loose-end that makes "strong private key protection" pointless.
Basically, your client can't have it both ways: they can't "enable strong private key protection", and expect to not have to enter a password each time the client certificate is required. Much better that they store the certificate correctly.
For an unattended client service, the most secure method for storing a client certificate is as follows:
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With