'WCF service connection error: "The request for security token has invalid or malformed elements"

I set up certificate-based authentication for a WCF service. It works when the service and the client are running on the same computer, but now I have deployed them to different computers, I encounter "The request for security token has invalid or malformed elements".

It seems like this is usually a certificate error. I don't see what is wrong with the setup.

The server has the following certificates installed:

MyRoot in Local Machine\Trusted CAs
MyServer in Local Machine\Personal (with the private key)

The client has the following certificates installed:

MyRoot in Local Machine\Trusted CAs
MyClientCert in Local Machine\Personal (with the private key)

The client configuration is like this:

<system.serviceModel>
    <client>
        <endpoint address="http://10.0.0.4:8000/Handshake" binding="wsHttpBinding" behaviorConfiguration="ClientCertificateBehavior"
      bindingConfiguration="WSHttpBinding_IHandshaker" contract="IHandshaker"
      name="WSHttpBinding_IHandshaker"/>
    </client>
    <bindings>
        <wsHttpBinding>
            <binding name="WSHttpBinding_IHandshaker">
                <security>
                    <message clientCredentialType="Certificate" />
                </security>
            </binding>
        </wsHttpBinding>
    </bindings>
    <behaviors>
        <endpointBehaviors>
            <behavior name="ClientCertificateBehavior">
                <clientCredentials>
                    <clientCertificate findValue="MyClientCert" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName"/>
                    <serviceCertificate>
                        <authentication certificateValidationMode="PeerOrChainTrust" revocationMode="NoCheck"/>
                    </serviceCertificate>
                </clientCredentials>
            </behavior>
        </endpointBehaviors>
    </behaviors>
</system.serviceModel>

The service configuration is like this:

<system.serviceModel>
    <bindings>
        <customBinding>
            <binding name="gzipBinding">
                <gzipMessageEncoding />
                <sslStreamSecurity />
                <tcpTransport>
                </tcpTransport>
            </binding>
        </customBinding>
        <wsHttpBinding>
            <binding name="ClientCertAuthenticationBinding">
                <security mode="Message">
                    <message clientCredentialType="Certificate"/>
                </security>
            </binding>
        </wsHttpBinding>
    </bindings>
    <services>
        <service name="Rdt.CertificateIdentification.ClientAuthentication.HandshakeService" behaviorConfiguration="HandshakeServiceBehavior">
            <host>
                <baseAddresses>
                    <add baseAddress="http://10.0.0.4:8000/Handshake"/>
                </baseAddresses>
            </host>
            <endpoint address="" binding="wsHttpBinding" bindingConfiguration="ClientCertAuthenticationBinding" contract="OCS.Client.KnownLayer.IHandshaker"/>
            <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange"/>
        </service>
    </services>
    <behaviors>
        <serviceBehaviors>
            <behavior name="HandshakeServiceBehavior">
                <serviceMetadata httpGetEnabled="True"/>
                <serviceDebug includeExceptionDetailInFaults="True"/>
                <serviceCredentials>
                    <serviceCertificate findValue="MyServer" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName"/>
                    <clientCertificate>
                        <authentication certificateValidationMode="ChainTrust" revocationMode="NoCheck"/>
                    </clientCertificate>
                </serviceCredentials>
            </behavior>
        </serviceBehaviors>
    </behaviors>
</system.serviceModel>

wcf x509certificate

Solution 1:^[1]

1.You need to specify the DNS value in the client configuration, WcfServer is the name of your server certificate,here is a tutorial on how to use the certificate correctly.

<client>
  <endpoint address="" binding="" bindingConfiguration="" contract="" name="" behaviorConfiguration="">
    <identity>
      <dns value="WcfServer" />
    </identity>
  </endpoint>
</client>

2.There is one more </client> in your service configuration.
3.You can try to set <security mode="Message"> in the client configuration.

Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution	Source
Solution 1	Lan Huang

'WCF service connection error: "The request for security token has invalid or malformed elements"

Solution 1:[1]

Sources

Related Questions

Solution 1:^[1]