[原]证书生成、应用及常见错误处理

一、生成证书使用管理员登录，执行下面的命令 导入证书

makecert -r -pe -n "CN=127.0.0.1"  -sr LocalMachine -ss My -sky exchange

提示成功后表明证书已生成。

如果没有这个makercert.exe，从WIN7机器中拷贝一个到服务器（比如win2008)也可以。

理论上，这个exe可以存放在任意地方

证书生成之后，怎么看？可以这样：

运行 mmc 命令

添加证书管理单元

二、证书在WCF上的应用证书与WCF，这两坨都是我所讨厌的。现在它们混成一伙，狼狈为奸了。尤其是WCF，垃圾。垃圾中的战斗圾。搞出来就是为了恶心人。

1、在应用WCF的项目的web.config加入以下类似代码。比如这是一个文件服务器项目。

<system.serviceModel>
<bindings>
  <wsHttpBinding>
    <binding name="wsHttpEndpointBinding" maxReceivedMessageSize="2147483647" maxBufferPoolSize="2147483647">
      <security>
        <message clientCredentialType="UserName" />
      </security>
      <readerQuotas maxArrayLength="2147483647" maxStringContentLength="2147483647" maxBytesPerRead=" 2147483647" maxDepth="2147483647" maxNameTableCharCount="2147483647" />
    </binding>
  </wsHttpBinding>
</bindings>
<services>
  <service name="SHIT.FileServer.FileProService" behaviorConfiguration="SHIT.FileServer.FileProServiceBehavior">
    <endpoint address="" binding="wsHttpBinding" name="username" contract="SHIT.FileServer.IFileProService" bindingConfiguration="wsHttpEndpointBinding">
    </endpoint>
    <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />
  </service>
</services>
<behaviors>
  <serviceBehaviors>
    <behavior name="SHIT.FileServer.FileProServiceBehavior">
      <serviceMetadata httpGetEnabled="true" />
      <serviceDebug includeExceptionDetailInFaults="true" />
      <serviceCredentials>
        <issuedTokenAuthentication allowUntrustedRsaIssuers="true"></issuedTokenAuthentication>
        <serviceCertificate findValue="127.0.0.1" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" />
        <userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="SHIT.Core.WCF.LtNamePasswordValidator,SHIT.Core" />
      </serviceCredentials>
    </behavior>
  </serviceBehaviors>
</behaviors>
</system.serviceModel>

谁能看懂这一大坨是个什么鬼。不过里面有一个”127.0.0.1”与上面生成证书的中命令参数相关。

makecert -r -pe -n "CN=127.0.0.1"  -sr LocalMachine -ss My -sky exchange

2、在客户端，凭用户名和密码来访问这个WCF服务：

string httpIP = "127.0.0.1";
if (string.IsNullOrEmpty(httpIP)) throw new Exception("请配置文件上传服务地址参数：FileService");
EndpointAddress httpAddress = new EndpointAddress(httpIP);
_FileService = new FileProServiceClient("FileProService", httpAddress);
_FileService.ClientCredentials.ServiceCertificate.Authentication.CertificateValidationMode = System.ServiceModel.Security.X509CertificateValidationMode.None;
_FileService.ClientCredentials.UserName.UserName ="test" ;
_FileService.ClientCredentials.UserName.Password = "123456";
return _FileService;

三、如果提示“密钥集不存在（The process must have access rights for the private key）”

解决办法：

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA将这个目录下的MachineKeys文件夹添加Everyone并赋予浏览权限

四、提示搜索到多个证书如果手贱生成了多个证书，则可以删掉一些。方法可以参照 一。