Search code examples
c#sslcertificate

Why do I get RemoteCertificateNameMismatch?

I have the following C# client code to check incoming certificate in a SSL communication(with WCF) : 

private bool ValidateClientCertificate(System.Security.Cryptography.X509Certificates.X509Certificate cert, System.Security.Cryptography.X509Certificates.X509Chain chain, System.Net.Security.SslPolicyErrors sslPolicyErrors)
    {
        _certificateValid = sslPolicyErrors == System.Net.Security.SslPolicyErrors.None ? true : false;
        return true;
    }

When entering the method I can see that the sslPolicyErrors is set to RemoteCertificateNameMismatch?

I have created the server certificate like this :

  1. Create MyCert Root CA on Server 1
  2. Request Subordinate CA certificate created at Server 2 and sent to server 1 to be issued
  3. Install the issued MyCert CA(Subordinate CA) certificate on server 2
  4. Request a function cert at Server 1 from Server 2 with MyCert CA
  5. Install MyCert Services Server 1 on Server 1 and bind it to the service
  6. Install MyCert Root CA and MyCert CA on client and check that it validates the entire chain of 3.
  7. Start client and connect to the service on server 1

Because the request of the MyCert Services Server 1 was created at Server 1 where it also was installed it I should not get the SSL error, right? Is there any attribute or something that need to be set on the function cert that validates against the Server 1?

From what I understand the name does not have to be the same as the server?

Edit : I create a new function certificate and set the CN to the DNS name of the server itself. Each client computer has a host file that points this CN name to a the specific IP of the server. I do however still get the same SSL Policy Error in the ValidateClientCertificate method? Exactly what setting is needed on the certificate to pass the validation?

Solution

  • Try populating the "Subject Alternative Name" field on the certificate with the DNS name of the server your client is calling.

    This error occurs when a client system is making a request to the server (i.e. "https://myserver.com:443/someaction") and will expect either the Common Name, or one of the values in the Subject Alternative Name field, to look like "myserver.com"

    If this doesn't help try adding the following information to your question: - The URL that the WCF client is calling - The Common Name value of the certificate on the server