2

WCF service is configured for client certificate with X509CertificateValidationMode.Custom and a custom X509CertificateValidator.

Binding is WebHttpBinding with WebHttpSecurityMode.Transport and HttpClientCredentialType.Certificate.

This setup enforces the client to provide a certificate attached to the request and its working fine with requests which has the certificate.

Now, I need to process requests which don't have a certificate attached and let them proceed based on some other conditions. but as I've noted it respond 403 before hitting my custom X509CertificateValidator.

How do I hook into WCF requests come without a certificate?

Sency
  • 2,818
  • 8
  • 42
  • 59
  • Did you try to implement `IDispatchMessageInspector` and see if you are able to capture requests without a certificate? – FaizanHussainRabbani Mar 03 '18 at 14:09
  • @FaizanRabbani yes, I have a few `IDispatchMessageInspector`s. but it doesn't hit even `AfterReceiveRequest` – Sency Mar 03 '18 at 14:34
  • @Johnny, `ServicePointManager.ServerCertificateValidationCallback` is not called for client certificate validation if I'm correct. I've tried it anyway but yes. It doesn't hit on `ServerCertificateValidationCallback` – Sency Mar 03 '18 at 14:37
  • Which `binding` are you using? Could changing of the `SecurityMode` help...to try to avoid transport-level security... – Johnny Mar 03 '18 at 15:26

0 Answers0