Question

I have a WCF Server Deployed through IIS. I want to Create a Certificate for it. I could do this by making the server a certificate server.

But then when the client connects to that server I want the client to automatically trust the certificate without having to register that the server as a “trusted authority”.

Is this possible?

All this seems a lot of work to put username password protection on a WCF Service!

Answer 1

The short answer is no the client will need to add the server cert root as a trusted authority.

The slightly longer answer is that there is a workaround for needing to implement transport security in WCF when using message based authentication – this workaround is usually used when you want to rely upon another security mechanism that the WCF server is not aware of, like an ISA server providing SSL.

Have a look at Yaron Naveh’s post. The essential idea is that you create a transport binding that pretends that it is secure.

With all that, you still need security (you don’t want to send your creds in the clear) and so will still need a trust chain for your cert. So, it may not actually help you, but hopefully it gives you some options to consider.

Edit

Sorry if my answer was misleading. The server certificate root cert must by in the client trusted store. My additional detail was giving another option for providing the security (you can use an ISA server with a trusted cert to give your SSL connection)

In a similar situation to yours (needing secure communication when pushing client applicaitons to non technical customers) I have programatically installed the needed root certs.

Here is an SO post that details how to do that: How can I install a certificate into the local machine store programmatically using c#?