How do I tell WCF to skip verification of the certificate?

Question

Trying to make a web service call to an HTTPS endpoint in my Silverlight application results in this error: "Could not find a base address that matches scheme https for the endpoint with binding WSHttpBinding. Registered base address schemes are [http]"

The same problem as was posted here:

http://social.msdn.microsoft.com/Forums/en-US/wcf/thread/4c19271a-f5e6-4659-9e06-b556dbdcaf82/

So, one of the suggestions was this: "The other issue might be that the cert name and the machine name don't agree, and this is causing WCF to have fits. If this is the case, you can tell WCF to skip verification of the cert."

Well, I do get a certificate error because this is just a demo server.

Here's how I set up my client:

BasicHttpBinding binding = new BasicHttpBinding();
binding.Security.Mode = BasicHttpSecurityMode.Transport;
_ws = new AnnotationService.AnnotationClient(binding, new EndpointAddress(myAddress));

How can I tell WCF to skip the verification?

Answer 1

This does not look like an certificate validation error. It looks like a webservice configuration error. Can you post the config for your endpoint on the server?

WCF services don't support SSL by default, you need to enable transport security by creating a binding configuration and pointing your endpoint to it with the bindingConfiguration attribute.

Here is a sample binding configuration that supports SSL:

<bindings>
  <basicHttpBinding>
    <binding name="SecureTransport">
      <security mode="Transport">
        <transport clientCredentialType="None"/>
      </security>
    </binding>
  </basicHttpBinding>
</bindings>

and your endpoint config would look like this:

<endpoint address=""
   binding="basicHttpBinding"
   bindingConfiguration="SecureTransport"
   contract="MyServices.IWebService" />

Answer 2

This sample WCF configuration will disable validation of both whether the certificate is trusted and whether it is still valid on the client:

<system.serviceModel>
    <behaviors>
      <endpointBehaviors>
        <behavior name="DisableServiceCertificateValidation">
            <clientCredentials>
                <serviceCertificate>
                    <authentication certificateValidationMode="None"
                                    revocationMode="NoCheck" />
                </serviceCertificate>
            </clientCredentials>
        </behavior>
      </endpointBehaviors>
    </behaviors>
    <client>
      <endpoint address="http://localhost/MyService"
        behaviorConfiguration="DisableServiceCertificateValidation"
        binding="wsHttpBinding"
        contract="MyNamespace.IMyService"
        name="MyServiceWsHttp" />
    </client>
</system.serviceModel>

UPDATE: Custom X.509 certificate validation

Another option is to provide custom logic to validate the X.509 certificate provided by the service. In that case you will have to modifiy the configuration file according to the following:

<system.serviceModel>
    <behaviors>
      <endpointBehaviors>
        <behavior name="DisableServiceCertificateValidation">
            <clientCredentials>
                <serviceCertificate>
                    <authentication certificateValidationMode="Custom"
                                    customCertificateValidatorType="MyCertificateValidator, Client"
                                    revocationMode="NoCheck" />
                </serviceCertificate>
            </clientCredentials>
        </behavior>
      </endpointBehaviors>
    </behaviors>
    <client>
      <endpoint address="http://localhost/MyService"
        behaviorConfiguration="DisableServiceCertificateValidation"
        binding="wsHttpBinding"
        contract="MyNamespace.IMyService"
        name="MyServiceWsHttp" />
    </client>
</system.serviceModel>

Then create a class that derives from X509CertificateValidator to implement your custom validation logic.

public class MyCertificateValidator : X509CertificateValidator
{
    public override void Validate(X509Certificate2 certificate)
    {
        // Add custom validation logic
        // Throw an exception to fail validation
    }
}

As always, you can find a more detailed example up on MSDN.