WCF: Dual Layer Encryption (Message + Transport)
WCF: Dual Layer Encryption (Message + Transport)
What I want to do ?
I want to encrypt the Message body via server cert and client cert negotiation at Message level.
Plus I would like to send complete stuff in an SSL encrypted Transport channel, by using a SSL cert on IIS.
Step 1: Secure the body/data on Message level security
SERVER
Security:
Message Level
Behavior:
Adding Server cert for encryption
CLIENT
Request:
Sign and Encrypted
What happens if I switch to Transport layer security with credential at Message layer… ?
Step 2: Trying to add Transport security..
SERVER
Security:
Transport layer encryption and credential at Message layer
Behavior:
Server cert no longer required, because the task of encryption is migrated to Transport layer.,..
CLIENT
Request:
Nor Sign neither encrypted …..
Probably because everything is outsources to the Transport level security …
Thus WCF takes no pain in signing and encrypted the body at Message level….
What should we do… I want to make sure my request is still encrypted and singed… along with SSL encryption,.,, ?
Step 3: Exploring the custom binding without transport security .
SERVER
Security:
Behavior:
CLIENT
End Point:
The identity tag is the encoded value of server cert used for encryption …..
Request created:
Step 4: Custom Binding + Transport Security
Now we want to have the SSL channel …..
My custom binding becomes……
Security:
Case 1:
If the SSL cert and server cert are same…..
Then the identity received on client side … will be based on server cert used…..
And it will work.. because during SSL negotiation.. client end point present the same identity…
Case 2:
If the SSL cert and server cert are different…..
Now the identity received on the client side inside the WSDL will be related to Server cert… which will not match with the SSL cert identity…. .
And we get SSL negotiation exception …..
How to over- come this problem ..,. ?
Step 5: Exploring the <identity> and DNS values ….
On Client side:
Specify a default server cert on client side…
this will be same as used on server side inside service behavior attribute
Behavior:
Client End Point:
This way works if both the server cert and SSL cert are issued with same DNS or Subject Name…
msdn.microsoft.com/en-us/library/ms733130.aspx
If I use server cert (Subject name: saurabh21.fareast.corp.microsoft.com ) and ssl cert (Subject name: saurabh.fareast.corp.microsoft.com) with different subject name….
Then I get below error…..
So what we understand from this error is <identity> from client side should always be one related to server cert used inside the service behavior … not the one related to SSL cert…
Can I resolve this error ?
Yes, we can resolve this error….
Client End Point:
Behavior:
But still it asks me to specify the default server cert in the end point behavior….
Can I avoid that .. ?
Yes,… we need to negotiate the server cert…..
Step 6: Final configuration…
On Server Side:
Security:
Behavior:
On Client Side:
End Point:
Behavior:
MutualSslNegotiated make sure, that I don’t have to specify the server cert on client end point behavior…
It would be now negotiated….
New Request from client side (Sign and Encrypted)
So in this way we can achieve dual layer of encryption in WCF service by using the custom binding….
Comments
Anonymous
July 07, 2014
I have F5 in the middle to do ssl-offloading. How do I stop encryption at WCF?Anonymous
October 20, 2016
very nice...helpful....