Setting up SSL for WCF in Development

This blog post will describe how to secure your WCF services that are hosted within IIS 7.0, using Secure Sockets Layer.

Secure Sockets Layer (SSL) is a protocol primarily used for encryption of data between two parties, running at the Transport Layer.

SSL requires a certificate to be installed on the server.  Within a development environment you might want to create your own certificate.  This is how to create an SSL certificate in IIS 7.0:

1. Open IIS Manager (Start > Run > Inetmgr)
2. Select the root note within the left pane (Usually “MachineName (Domain\Username)”)
3. Select “Server Certificates” in the middle pane
4. Select “Create Self-Signed Certificate…” in the right pane (or by right clicking in the middle pane)
5. Give your certificate a friendly name, so that you can identify it later on

Now you have created a certificate, you need to bind it to your website, using the following steps:

1. Right-click your website in the left pane (“Default Web Site” by default)
2. Select “Edit Bindings”
3. Select “Add…”
4. Select “https” from the “Type:” dropdown list
5. Select the certificate you created earlier from the “SSL Certificate” dropdown list
6. Select Ok

Update your WCF endpoints to use the new HTTPS address and then browse to the WCF service in your internet browser.  The WCF service will appear to be working successfully under IIS; however when you call one of the operations you will probably see the following error message:

“The provided URI scheme ‘https’ is invalid; expected ‘http’”

This is because you have not enabled Transport layer security within the WCF configuration (or inline within code).  To enable it within the configuration you can add the following in both the client and service:

Now when you call an operation you will probably see the following error message:

“Could not establish trust relationship for the SSL/TLS secure channel with authority localhost”

This error message is because the certificate you have generated is not trusted by a certification authority.  There are two approaches to fix this:

1. Implement a RemoteCertificateValidationCallback (more details here: http://msdn.microsoft.com/en-gb/library/system.net.security.remotecertificatevalidationcallback(VS.80).aspx)
2. Trust the certificate

I prefer the second approach, to ensure I don’t leave in the validation callback code in a production environment.  It also seems much cleaner to me.. why write code when we don’t have to!?

In order to trust the certificate you have created, follow these steps:

Export certificate generated within IIS

Open the certificates snap-in within the Microsoft Management Console (see below for instructions)

1. Browse to the Personal Certificates in the left pane (Certificates (Local Computer) > Personal > Certificates)
2. Find the certificate you created earlier (there should be a friendly name column)
3. Right click the certificate and select “All Tasks > Export…”
4. Select Next
5. Select No, do not export the private key, then select Next
6. Select DER encoded binary X.509 (.CER), then select Next
7. Type (or browse) to a location that you want to save the certificate to and select Next, Finish

Import the certificate within the Third-Party Root Certification Authority

Open the certificates snap-in within the Microsoft Management Console (see below for instructions)

1. Right click the Third-Party Root Certification Authorities certificates folder (Certificates (Local Computer) > Third-Party Root Certification Authorities certificates > Certificates)
2. Select “All Tasks > Import”, then select Next
3. Browse to the certificate you exported earlier, then select Next
4. Select Next, then Finish

You should now be able to call operations on your newly secured WCF Service.

Instructions for opening the Certificates Snap-in

In order to open the certificates snap-in, follow these steps:

1. Open the Microsoft Management Console (Start > Run > MMC)
2. Browse to File > Add/Remove Snap-in
3. Select “Certificates” from the list of available snap-ins.
4. Choose the “Computer account” radio button on the dialog box
5. Select finish (then Ok)