.NET 8 WCF调用客户端证书不被IIS接受，.NET 4.8可正常运行

问题场景 #

• 相同WCF调用代码在.NET Framework 4.8控制台应用正常运行，但在.NET 8/6环境下调用失败
• 服务部署于IIS 10，SSL设置已将客户端证书设为必填
• 已尝试System.ServiceModel.Http 4.10.3及最新8.0.0包，切换目标框架到.NET 6也无效
• IIS日志返回403 7 5 15，推测客户端证书未被传递

调用代码 #

public static void Call()
{
    var channelFactory = new ChannelFactory<IExtendedParameterProvisioningPort>(new BasicHttpBinding
    {
        MaxBufferSize = 2147483647,
        MaxBufferPoolSize = 2147483647,
        MaxReceivedMessageSize = 2147483647,
        SendTimeout = new TimeSpan(0, 2, 0),
        ReceiveTimeout = new TimeSpan(0, 1, 0),
        OpenTimeout = new TimeSpan(0, 1, 0),
        CloseTimeout = new TimeSpan(0, 1, 0),
        Security = new BasicHttpSecurity()
        {
            Mode = BasicHttpSecurityMode.Transport,
            Transport = new HttpTransportSecurity()
            {
                ClientCredentialType = HttpClientCredentialType.Certificate
            }
        }
    }, new EndpointAddress("https://example.de:1460/MyWcfService.svc"));

    channelFactory.Credentials.ClientCertificate.SetCertificate(
        StoreLocation.LocalMachine,
        StoreName.My,
        X509FindType.FindByThumbprint,
        "MY-THUMBPRINT");

    channelFactory.Credentials.ServiceCertificate.SslCertificateAuthentication =
        new X509ServiceCertificateAuthentication
        {
            CertificateValidationMode = X509CertificateValidationMode.None,
        };

    var extendedParameterProvisioningPort = channelFactory.CreateChannel();

    var serviceInfoResponse = extendedParameterProvisioningPort.GetServiceInfo(new ServiceInfoRequest());
    Console.WriteLine(serviceInfoResponse.Version);
}

异常信息 #

The HTTP request is unauthorized with client authentication scheme 'Anonymous'.

问题原因与解决方法 #

.NET 6/8的WCF客户端（System.ServiceModel.Http）完全支持客户端证书认证，问题出在证书加载或绑定配置的细节上：

1. 证书加载权限不足 #

如果控制台应用以普通用户身份运行，访问LocalMachine\My证书存储区可能没有权限：

• 可切换到StoreLocation.CurrentUser，将证书导入当前用户的个人存储区
• 或通过MMC证书管理单元，右键目标证书→所有任务→管理私钥，给运行应用的用户添加读取权限

2. BasicHttpBinding配置遗漏 #

在.NET Core/.NET 6+环境中，需显式关闭ExtendedProtectionPolicy以规避IIS端的证书传递干扰，修改Transport配置：

Transport = new HttpTransportSecurity()
{
    ClientCredentialType = HttpClientCredentialType.Certificate,
    ExtendedProtectionPolicy = new ExtendedProtectionPolicy(PolicyEnforcement.Never)
}

3. 证书查找失败（无异常但未加载） #

检查证书指纹是否正确（需去掉空格、区分大小写），或改用FindBySubjectName等更可靠的查找方式。可添加验证代码确认证书是否加载成功：

var cert = channelFactory.Credentials.ClientCertificate.Certificate;
if (cert == null)
{
    throw new InvalidOperationException("未找到指定的客户端证书");
}

4. IIS端SSL设置验证 #

确认IIS站点的SSL设置中，客户端证书选项为“要求”；若使用自签名证书，需将证书颁发机构添加到IIS的受信任根CA列表中

内容的提问来源于stack exchange，提问作者Jannik