Changeset 15386 for stable/HeuristicLab.Clients.Common/3.3

Timestamp:

09/28/17 08:08:13 (7 years ago)

Author:

jkarder

Message:

#2835: merged r15361 into stable

Location:

stable

Files:

• . (modified) (1 prop)
• HeuristicLab.Clients.Common/3.3/ClientFactory.cs (modified) (3 diffs)

stable/HeuristicLab.Clients.Common/3.3/ClientFactory.cs

@@ -21 +21 @@
 
 using System;
+using System.Security.Cryptography.X509Certificates;
 using System.ServiceModel;
 using System.ServiceModel.Description;
+using System.ServiceModel.Security;
 using HeuristicLab.Clients.Common.Properties;
 
@@ -59 +61 @@
       client.ClientCredentials.UserName.UserName = userName;
       client.ClientCredentials.UserName.Password = password;
-      client.ClientCredentials.ServiceCertificate.Authentication.CertificateValidationMode = System.ServiceModel.Security.X509CertificateValidationMode.None;
+      client.ClientCredentials.ServiceCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.ChainTrust;
+
+      // we (jkarder + abeham) have disabled the revocation check for now
+      // the certificate requires OCSP instead of CRL for revocation checks, but the OCSP check fails
+      // we currently don't know why this is the case, because we observed a valid OCSP request/response using wireshark
+      client.ClientCredentials.ServiceCertificate.Authentication.RevocationMode = X509RevocationMode.NoCheck;
       return client;
     }
@@ -83 +90 @@
       channelFactory.Credentials.UserName.UserName = userName;
       channelFactory.Credentials.UserName.Password = password;
-      channelFactory.Credentials.ServiceCertificate.Authentication.CertificateValidationMode = System.ServiceModel.Security.X509CertificateValidationMode.None;
+      channelFactory.Credentials.ServiceCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.ChainTrust;
+
+      // we (jkarder + abeham) have disabled the revocation check for now
+      // the certificate requires OCSP instead of CRL for revocation checks, but the OCSP check fails
+      // we currently don't know why this is the case, because we observed a valid OCSP request/response using wireshark
+      channelFactory.Credentials.ServiceCertificate.Authentication.RevocationMode = X509RevocationMode.NoCheck;
       return channelFactory;
     }