WCF Message Security Using Certificates

We need a valid certificate to authenticate a client and a service. Here, valid means that the certificates should be generated by a Certificate Authority. A certificate authority can be any third party certificate authority [recommended in case of production] or we can create our own certificate authority [DEV STAGE ONLY]. Once we get the Certificate Authority, we need to create different certificates for different components.

>>makecert -pe -sv SignRoot.pvk -cy authority -r signroot.cer -a sha1 -n "CN=Dev Certification Authority" -len 2048 -ss My -sr localmachine -sky exchange

After entering the password, it gave an error to me. The reason is that I tried to execute it many times so this was already available with me. For that, we need to delete the existing key and try to create a certificate once again. Use the below mentioned two commands to delete a key.

>>DEL SignRoot.pvk

Here, I have deleted the existing subject keys. Now, try to execute the certificate creation command again.

>>makecert -pe -sv SignRoot.pvk -cy authority -r signroot.cer -a sha1 -n "CN=Dev Certification Authority" -len 2048 -ss My -sr localmachine -sky exchange

It will ask you to enter a password. Enter it and go ahead.

Here, we have created a certificate authority successfully. To verify it, launch Run>>MMC. It will launch the Window MMC as below.

Click File >> Add/Remove Snap-in. It will open the "Add Snap-in" window. Select certificate in the available snap-in list. Click Add >.

Select "Computer Account" and click "Next".

It will open the Console Root as below.

Expand certificates -Local Computer.>> Personal>> Certificates. Then, you can see the certificate which we created using the makecert command.

Double-click that certificate to see the properties. You can see that this certificate is not trusted. We need to add this certificate in “Trusted Root Certification Authority”.

To do so, copy this certificate and paste in the “Trusted Root Certification Authority” field.

Now, go to Personal>>Certificate and then double-click the certificate. You will see the result as below. Our certificate is valid. That means now our certificate authority is a trusted certificate authority.

Now, let's create certificates for our service and client. My certificate authority will issue me certificates which I will use for authentication in WCF. Here, I have one service and one client. So, I will generate two certificates in my certificate authority.

Command for Service,

>>makecert -pe -sk ServerCert -iv SignRoot.pvk -n "CN=ServerCert" -ic signroot.cer ServerCert.cer -sr localmachine -ss My -sky exchange

Command for Client,

>>makecert -pe -sk ClientCert -iv SignRoot.pvk -n "CN=ClientCert" -ic signroot.cer ClientCert.cer -sr localmachine -ss My -sky exchange

Once we have executed this, it will generate certificates in Personal>>Certificates.

Now, we are ready with certificates.

Server Certificate

Client Certificate

Export these certificates

Now, we will export these certificates so that we can import them wherever we are going to use them.

Launch MMC Console, Personal>>Certificates>>Select Certificate>> RightClick on Dev Certificate Authority>>All Task>> Export>> Next.

Click Next>> Browse File to Save>>Next>>Finish.

See the saved location for verification.

Now, we will export the Server Cert and Client Cert. But there is one additional thing. I want two different certificates of Server. One is Private key cert and another is Public key. Same for the Client Cert. So, here, I will generate 4 different certificates.I will explain at a later stage why I am creating this.

1. Server Private Key
2. Server Public Key
3. Client Private Key
4. Client Public Key