Question

I’m having an odd problem relating to the service certificate for an IIS-hosted WSHttp WCF service.

This service uses message security with certificate authentication for both client and server. The service is hosted at a url similar to this:

http://services.mydomain.com/client.svc

The service’s certificate has a subject name of:

CN = services.mydomain.com
OU = Domain Control Validated
O = services.mydomain.com

And a Subject Alternative Name of:

DNS Name=services.mydomain.com
DNS Name=www.services.mydomain.com

However, when the WCF client connects, the service reports back a DNS identity of www.services.mydomain.com, rather than the subject name of services.mydomain.com. This causes the WCF client to reject the response since it’s connecting to services.mydomain.com and is expecting that to be the name that comes back.

The site that contains this application has both HTTP and HTTPS bindings, but neither of them have host names (it accepts all connections). What can I change to get the service to report the right identity?

What can I change to get the WCF service

Answer 1

For others who might be having this issue (especially with GoDaddy-issued certificates like mine, which have the forced www. prefix in the alternative name), there is a known bug in WCF that causes it to use the last DNS name in the Subject Alternative Name as the identity. The workaround, unfortunately, seems to be specifying the www. prefix as the identity for the client’s endpoint.