使用配置文件中的几个搜索条件查找WCF服务证书

Question

我想知道，是否有任何方法可以使用.config文件中的几个搜索条件找到WCF服务证书？

例如，如果我想按主题名称查找证书，那么我的配置将包含以下行：

        <serviceCertificate findValue="host.domain.com"
                            storeLocation="LocalMachine"
                            storeName="My"
                            x509FindType="FindBySubjectName"/>

如果我想按主题名和按应用程序策略查找证书，我应该在配置文件中放什么？

我知道，X509Certificate2Collection类允许这个：

            return store
                .Certificates
                .Find(X509FindType.FindByApplicationPolicy, "1.3.6.1.5.5.7.3.1", false)
                .Find(X509FindType.FindBySubjectName, "host.domain.com", false)
                .Cast<X509Certificate2>()
                .SingleOrDefault();

那么.config-files呢？

Answer 1

编写自定义服务行为，您将能够从配置中提供应用程序策略和主题名称，在证书存储上执行两个连续的find。

public class ServerCertificateServiceBehavior : IServiceBehavior
{
    private X509Certificate2 certificate;

    public ServerCertificateServiceBehavior(StoreName storeName, StoreLocation storeLocation, string subjectName, string applicationPolicy)
    {
        X509Store store = new X509Store(storeName, storeLocation);
        store.Open(OpenFlags.ReadOnly | OpenFlags.OpenExistingOnly);

        certificate = store
            .Certificates
            .Find(X509FindType.FindByApplicationPolicy, applicationPolicy, false)
            .Find(X509FindType.FindBySubjectName, subjectName, false)
            .Cast<X509Certificate2>()
            .SingleOrDefault();
    }

    public void AddBindingParameters(ServiceDescription serviceDescription, ServiceHostBase serviceHostBase, Collection<ServiceEndpoint> endpoints, BindingParameterCollection bindingParameters)
    {
        serviceHostBase.Credentials.ServiceCertificate.Certificate = this.certificate;
    }

    public void ApplyDispatchBehavior(ServiceDescription serviceDescription, ServiceHostBase serviceHostBase) { }
    public void Validate(ServiceDescription serviceDescription, ServiceHostBase serviceHostBase) { }
}

ExtensionElement：

public class ServerCertificateServiceBehaviorExtensionElement : BehaviorExtensionElement
{
    [ConfigurationProperty("applicationPolicy", IsRequired = true)]
    public string ApplicationPolicy
    {
        get
        {
            return (string)base["applicationPolicy"];
        }
        set
        {
            base["applicationPolicy"] = value;
        }
    }

    [ConfigurationProperty("subjectName", IsRequired = true)]
    public string SubjectName
    {
        get
        {
            return (string)base["subjectName"];
        }
        set
        {
            base["subjectName"] = value;
        }
    }

    [ConfigurationProperty("storeLocation", DefaultValue = 2)]
    public StoreLocation StoreLocation
    {
        get
        {
            return (StoreLocation)base["storeLocation"];
        }
        set
        {
            base["storeLocation"] = value;
        }
    }

    [ConfigurationProperty("storeName", DefaultValue = 5)]
    public StoreName StoreName
    {
        get
        {
            return (StoreName)base["storeName"];
        }
        set
        {
            base["storeName"] = value;
        }
    }

    public override Type BehaviorType
    {
        get { return typeof(ServerCertificateServiceBehavior); }
    }
    protected override object CreateBehavior()
    {
        return new ServerCertificateServiceBehavior(
                this.StoreName, 
                this.StoreLocation, 
                this.SubjectName, 
                this.ApplicationPolicy);
    }
}

配置如下：

<behaviors>
  <serviceBehaviors>
    <behavior name="YourServiceBehaviorConfiguration">
      <!-- ... -->
      <serverCertificate storeLocation="LocalMachine"
                         storeName="My"
                         subjectName="host.domain.com"
                         applicationPolicy="1.3.6.1.5.5.7.3.1" />
    </behavior>
  </serviceBehaviors>
</behaviors>
<extensions>
  <behaviorExtensions>
    <add name="serverCertificate" type="Extensions.ServerCertificateServiceBehaviorExtensionElement, Extensions, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"/>
  </behaviorExtensions>
</extensions>