What are the steps to setup SSL to work with WCF on Azure?

Question

Please post the steps you have taken to setup SSL to work with WCF on Azure.

I have my valid certificate uploaded successfully (using cspack) and working with the rest of the site, but after adding it, my previously working WCF service stopped working. (All I get is a 404 error back to Silverlight, which is not very helpful. Up votes to whomever comes up with some better logging I could be doing too to help diagnose the problem too!)

I've tried many variations on this configuration:

<system.serviceModel>
     <!--start added for SSL--> 
    <bindings>
      <basicHttpBinding>
        <binding name="SecureBasicHttpBinding">
          <security mode="Transport">
            <transport clientCredentialType="None"  />
          </security>
        </binding>
      </basicHttpBinding>
    </bindings>
     <!--end added for SSL--> 
    <behaviors>
      <!--start added for SSL--> 
      <endpointBehaviors>
        <behavior name="DisableServiceCertificateValidation">
          <clientCredentials>
            <serviceCertificate>
              <authentication certificateValidationMode="None"
                              revocationMode="NoCheck" />
            </serviceCertificate>
          </clientCredentials>
        </behavior>
      </endpointBehaviors>
      <!--start added for SSL--> 
      <serviceBehaviors>
        <behavior name="Silverheat.Cloud_WebRole.API.DataServiceBehavior">
          <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true" />
          <serviceDebug includeExceptionDetailInFaults="true" />
          <!-- certificate checking removed --> 
        </behavior>
      </serviceBehaviors>
    </behaviors>
    <serviceHostingEnvironment aspNetCompatibilityEnabled="true" />
    <services>
      <service behaviorConfiguration="Silverheat.Cloud_WebRole.API.DataServiceBehavior"
          name="Silverheat.Cloud_WebRole.API.DataService">
        <!--<endpoint address="" binding="basicHttpBinding" contract="Silverheat.Cloud_WebRole.API.DataService" />-->
        <endpoint bindingConfiguration="SecureBasicHttpBinding"
                  behaviorConfiguration="DisableServiceCertificateValidation"
                  address="" binding="basicHttpBinding"
                  contract="Silverheat.Cloud_WebRole.API.DataService" />
        <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />
      </service>
    </services>
  </system.serviceModel>

Unfortunately, debugging this and getting more info is really hard because I cannot step through and debug with any configuration remotely like I'd use on the live server because the bindings tag has problems on debug (but not live).

Thanks for your help and interest!

Answer 1

Wow! Its alive! Its working!!

Still doesn't work in debug (security exception), but I'll live with that until the next release.

Here's the configuration that worked:

  <system.serviceModel>
    <bindings>
      <basicHttpBinding>
        <binding name="SecureBasicHttpBinding">
          <security mode="Transport">
            <transport clientCredentialType="None"  />
          </security>
        </binding>
      </basicHttpBinding>
    </bindings>
    <behaviors>
      <serviceBehaviors>
        <behavior name="Silverheat.Cloud_WebRole.API.DataServiceBehavior">
          <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true" />
          <serviceDebug includeExceptionDetailInFaults="true" />
        </behavior>
      </serviceBehaviors>
    </behaviors>
    <serviceHostingEnvironment aspNetCompatibilityEnabled="true" />
    <services>
      <service behaviorConfiguration="Silverheat.Cloud_WebRole.API.DataServiceBehavior"
          name="Silverheat.Cloud_WebRole.API.DataService">
        <endpoint bindingConfiguration="SecureBasicHttpBinding"
          address="" binding="basicHttpBinding"
          contract="Silverheat.Cloud_WebRole.API.DataService" />
        <endpoint address="mex" binding="mexHttpsBinding" contract="IMetadataExchange" />
      </service>
    </services>
  </system.serviceModel>

(I think it was "mexHttpsBinding" that made it finally work, although I don't entirely understand why it needs meta data after its already configured, back to the books I guess)

I'd still like to know how to enable some kind of logging for WCF, but I'll poke around this great site a bit more and I'm sure I'll find an answer.