基于HTTPS的自托管WebHttpBinding服务

Question

我有以下rest windows服务，它可以在HTTP上完美地工作

Uri[] httpBaseAddress = new Uri[] { new Uri("http://localhost:8464/SupportRemote") };

serviceHost = new ServiceHost(typeof(Service.SupportRemoteService), httpBaseAddress);
var Binding = new WebHttpBinding();
ServiceEndpoint endpoint = serviceHost.AddServiceEndpoint(typeof(Model.ISupportRemoteService), Binding, "Rest");
endpoint.Behaviors.Add(new WebHttpBehavior());

foreach (ServiceEndpoint EP in serviceHost.Description.Endpoints)
   EP.Behaviors.Add(new BehaviorAttribute());

var serviceBehavior = new ServiceMetadataBehavior();
serviceBehavior.HttpGetEnabled = true;
serviceHost.Description.Behaviors.Add(serviceBehavior);
serviceHost.Open();

现在我想用自签名证书把它移到HTTPS上，但是服务不起作用。我不知道问题出在哪里。

Uri[] httpBaseAddress = new Uri[] { new Uri("https://localhost:8464/SupportRemote") };

serviceHost = new ServiceHost(typeof(Service.SupportRemoteService), httpBaseAddress);
var Binding = new WebHttpBinding(WebHttpSecurityMode.Transport);
Binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.None;
ServiceEndpoint endpoint = serviceHost.AddServiceEndpoint(typeof(Model.ISupportRemoteService), Binding, "Rest");
endpoint.Behaviors.Add(new WebHttpBehavior());

foreach (ServiceEndpoint EP in serviceHost.Description.Endpoints)
   EP.Behaviors.Add(new BehaviorAttribute());

var serviceBehavior = new ServiceMetadataBehavior();
serviceBehavior.HttpGetEnabled = false;
serviceBehavior.HttpsGetEnabled = true;
serviceHost.Description.Behaviors.Add(serviceBehavior);
serviceHost.Credentials.ServiceCertificate.SetCertificate("CN=MyCertificate", System.Security.Cryptography.X509Certificates.StoreLocation.LocalMachine, System.Security.Cryptography.X509Certificates.StoreName.Root);
serviceHost.Open();

Answer 1

看起来您已经在服务器端设置了服务器证书，但有一件事我们必须注意。默认情况下，应用程序没有将证书绑定到端口的权限。我们可以手动将证书绑定到端口。

netsh http add sslcert ipport=0.0.0.0:8000 certhash=0000000000003ed9cd0c315bbb6dc1c08da5e6 appid={00112233-4455-6677-8899-AABBCCDDEEFF}

这是官方文档，希望对你有用。

https://docs.microsoft.com/en-us/windows/desktop/http/add-sslcert

https://docs.microsoft.com/en-us/dotnet/framework/wcf/feature-details/how-to-configure-a-port-with-an-ssl-certificate

此外，您最好使用localSystem帐户托管windows服务，以防启用应用程序占用端口时出现问题。

如果有什么我能帮上忙的，请随时告诉我。