Disable IdentityVerifier in SslStreamSecurityBindingElement
- Dominant language
- C#
- Stars
- 1.8k
- Forks
- 576
- Avg merge
- 6d 9h
- Merged PRs (30d)
- 2
Description
Hi,
WCF client doesn't provide a feature to disable or implement own IdentityVerifier in SslStreamSecurityBindingElement.
I have a task in which I implemented own certificate validator.
```
var authentication = clientBase.ClientCredentials.ServiceCertificate.Authentication;
authentication.CertificateValidationMode = X509CertificateValidationMode.Custom;
authentication.CustomCertificateValidator = validator;
```
There is a case when the validation passes successfully but I get an exception from IdentityVerifier.
For instance, domain name in a server certificate doesn't equal domain name of a client.
I run the client on localhost.
```
System.ServiceModel.Security.MessageSecurityException: Identity check failed for outgoing message. The expected DNS identity of the remote endpoint was '127.0.0.1' but the remote endpoint provided DNS claim 'anydomainname'. If this is a legitimate remote endpoint, you can fix the problem by explicitly specifying DNS identity 'anydomainname' as the Identity property of EndpointAddress when creating channel proxy.
at System.ServiceModel.Security.IdentityVerifier.EnsureIdentity(EndpointAddress serviceReference, AuthorizationContext authorizationContext, String errorString)
at System.ServiceModel.Security.IdentityVerifier.EnsureOutgoingIdentity(EndpointAddress serviceReference, Uri via, AuthorizationContext authorizationContext)
at System.ServiceModel.Channels.SslStreamSecurityUpgradeInitiator.ValidateRemoteCertificate(Object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
at System.Net.Security.SecureChannel.VerifyRemoteCertificate(RemoteCertificateValidationCallback remoteCertValidationCallback, SslCertificateTrust trust, ProtocolToken& alertToken, SslPolicyErrors& sslPolicyErrors, X509ChainStatusFlags& chainStatus)
at System.Net.Security.SslStream.CompleteHandshake(ProtocolToken& alertToken, SslPolicyErrors& sslPolicyErrors, X509ChainStatusFlags& chainStatus)
```
On .net472 I can implement own IndentityVerifier and pass it to SslStreamSecurityBindingElement to ignore validation.
```
var sslStreamElement = bindingElements.Find();
sslStreamElement.IdentityVerifier = customIdentityVerifier;
```
But SslStreamSecurityBindingElement doesn't have IdentityVerifier property in your library on .net6.
Is there a way disable that validation?
Contributor guide
Assessment
This issue has not been assessed yet.