WCF certificate chain, programmatically validate

Question

I am trying to use certificates programmatically and not use storage. I am creating an X509Certificate2 with a file name and password.

This works great when I manually added the root certificate to the certificate store in proxies. However, I would prefer not to do this with every deployment - I would rather access it programmatically too.

When I delete the root certificate from the certificate store, I get an exception.

Everything I read seems to say that I have to manually add the root certificate to the certificate store, or the Chain Chain will not work.

Question: Is there a software way to create a Target Chain, so I don’t need to do this manually?

The code looks like this:

  var serverCert = new X509Certificate2("FullPathToMyCertificate.cer", "Password"); Client.ClientCredentials.ServiceCertificate.DefaultCertificate = serverCert; 

The exception that occurs when trying to use the Client is:

 System.IdentityModel.Tokens.SecurityTokenValidationException The X.509 certificate CN=notrealcertname, OU=TPA, OU=BMP, OU=Projects, O=Somebody, C=US is not in the trusted people store. The X.509 certificate CN=notrealcertname, OU=TPA, OU=BMP, OU=Projects, O=Somebody, C=US chain building failed. The certificate that was used has a trust chain that cannot be verified. Replace the certificate or change the certificateValidationMode. A certificate chain could not be built to a trusted root authority. 

Answer 1

The component used checks the chain by default - when the chain cannot be checked, you get this exception. If you want to do everything, including checking the chain in the code, you need to implement a "custom check" and integrate it into the WCF node : <br / ">

 Client.ServiceCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.Custom; Client.ServiceCertificate.Authentication.CustomCertificateValidator = new MyCertificateValidator(); 

Another option is to disable the check at all ( NOT for production !!! )

 Client.ServiceCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.None; 

EDIT - after the comment:

For a valid chain check, you need to look at the X509Chain and X509Store - to see how such a chain check can be implemented, see Verify Mono Object ... basically, you use the Find method to search for the X509Certificate2Collection for the parent, etc ... validation criteria c custom verification is up to you (valid signature, but not expired ...).

Some links on MSDN:

• http://msdn.microsoft.com/en-us/library/system.servicemodel.security.x509servicecertificateauthentication.certificatevalidationmode.aspx

• http://msdn.microsoft.com/en-us/library/system.identitymodel.selectors.x509certificatevalidator.aspx

• http://msdn.microsoft.com/en-us/library/ms733806.aspx