HOW TO: Secure XML Web Services with Secure Socket Layer in Windows Server 2003 (324284)

SUMMARY

This step-by-step article describes how to configure a current XML Web service to use an encrypted channel with a Secure Socket Layer (SSL) connection.

back to the top

Configure Your Web Server for SSL

Your XML Web Service will be running on Internet Information Server (IIS) and it will rely on IIS to provide SSL support. Because of this, you must first install an SSL server certificate on your server so that you can enable SSL support. To do this, follow these steps:

1. If you are purchasing a server certificate from a third-party certification authority or if you have an enterprise certification authority available to you, skip to step 2.
   
   Otherwise, to install Certificate Services, follow these steps:
   1. Start the Add or Remove Programs tool.
   2. Click Add/Remove Windows Components.
   3. Click to select the Certificate Services check box.
   4. Follow the on-screen instructions to complete the installation.
2. To run the Web Server Certificate Wizard, follow these steps:
   1. Start Internet Information Services Manager (IISM).
   2. Right-click the site that you want the certificate for.
   3. Click Properties, click the Directory Security tab, and then click Server Certificate.
3. In the Web Server Certificate Wizard, click Next.
4. Click Create a new certificate, and then click Next.
5. Click Prepare the request now, but send it later, and then click Next.
6. Type a name for the certificate, select the Bit length, and then click Next.
7. Type your company's organization and organizational unit names, and then click Next.
8. Type the Common name, and then click Next.
   
   NOTE: Provide the common name for the server that runs your XML Web service.
9. Complete the Geographical Information page, and then click Next.
10. Type a file name for your certificate request, and then click Next.
11. Click Next.
12. Click Finish.
13. When you complete the wizard, a certificate request is saved in a file that you specify. By default, this is C:\Certreq.txt.
14. Do one of the following:
    • If you are submitting your certificate to another certification authority, submit your application by following the certification authority's guidelines. When you receive your certificate file, open it, and then skip to step 15.
    • If you are using Windows Server 2003 Certificate Services to create your certificate, follow these steps:
      1. In Internet Explorer, visit the following Web site:

         http://localhost/certsrv

      2. Click Request a Certificate.
      3. Click Advanced certificate request.
      4. Click Submit a certificate request using a base64 encoded PKCS #10 file or a renewal request using a base64 encoded PKCS #7 file.
      5. On the Submit a Certificate Request or Renewal Request page, click Browse for a file to insert, specify the file that you created in step 13, click Read, and then click Submit.
         
         NOTE: You may also copy and paste the content of the certificate request file into the Saved Request text box.
      6. Click Start, point to Administrative Tools, and then click Certification Authority.
      7. Expand your certification authority's name, and then double-click the Pending Request folder.
      8. Right-click the certificate request that you just submitted, point to All Tasks, and then click Issue.
      9. Quit the Certification Authority Management console.
      10. In Internet Explorer, visit the following Web site:

          http://localhost/certsrv

      11. Click View the status of a pending certificate request.
      12. Click the request that you just created.
      13. On the Certificate Issued page, select either of the encoding schemes, and then click Download certificate.
      14. Click Save in the security dialog box.
      15. Click Close.
15. In Internet Services Manager, right-click the virtual site that you created the certificate for, and then click Properties.
16. Click the Directory Security tab, and then click Server Certificate.
17. Click Next.
18. Click Process the pending request and install the certificate, and then click Next.
19. Click Browse, locate and click your certificate file, and then click Next.
20. Click Next.
    
    NOTE: If a dialog box appears that warns you that the certificate may have come from an untrusted source, click OK.
21. Click Finish.

back to the top

Install Your Certification Authority's Certificate on the Client

If you used your own certificate services, follow these steps to install your certification authority's certificate on the client as a trusted root certification authority:

1. In Internet Explorer, visit the following Web site, where CertificateServer is the name of the Certificate Services server that issued the certificate that is being used on the Web server:

   http://CertificateServer/certsrv

2. Click Download a CA certificate, certificate chain or CRL.
3. Click Download CA certificate.
4. In the File Download dialog box, click Open.
5. In the Certificate dialog box, click Install Certificate.
6. In the Certificate Import Wizard, click Next.
7. Click Automatically select the certificate store based on the type of certificate, and then click Next.
8. Click Finish.
9. Click OK to acknowledge that the import was successful.
10. Click OK to close the Certificate dialog box.

If you plan to access your XML Web Service from an ASP page, follow these steps to add the certification authority's certificate to the computer's trusted root store:

1. In Internet Explorer, visit the following Web site, where CertificateServer is the name of the Certificate Services server that issued the certificate that is being used on the Web server:

   http://CertificateServer/certsrv

2. Click Download a CA certificate, certificate chain or CRL.
3. Click Download CA certificate.
4. In the File Download dialog box, click Save.
5. Click Close.
6. Click Start, and then click Run.
7. In the Open box, type mmc, and then click OK.
8. On the File menu, click Add/Remove Snap-in.
9. Click Add.
10. Click Certificates, and then click Add.
11. Click Computer Account, and then click Next.
12. Click Local Computer, and then click Finish.
13. Click Close, and then click OK.
    
    The list of certificate categories for the local computer appears in the snap-in window.
14. Expand Certificates (Local Computer).
15. Expand Trusted Root Certification Authorities.
16. Right-click Certificates, point to All Tasks, and then click Import.
17. In the Certificate Import Wizard, click Next.
18. Click Browse, and then locate the certificate that you saved in step 14,n.
19. Click the file, and then click Open.
20. Click Next.
21. Click Next, and then click Finish.
22. Click OK to acknowledge the successful import.

back to the top

Modify WSDL from HTTP to HTTPS

1. Edit the Web Service Description Language (WSDL) files for your service so that the address for your Web service begins with https instead of http. Make sure that the copy of the WSDL that your client uses also indicates https.
2. For Microsoft Visual Studio .NET projects, when you add a Web Reference, you can specify an https URL as the location of the XML Web service. To do this, edit the class that was created by Visual Studio .NET that wraps the Web service; modify the line of code that sets the URL. For a C# project, the line of code will look similar to the following after you modify it, where mycomputer refers to the Web server that is hosting Web services that are secured by SSL:

   this.Url = "https://mycomputer/MyWS/Service1.asmx";
   					

Your XML Web Service will now be accessed over SSL.

back to the top

Verify That SSL Is Configured Correctly

To determine whether SSL is configured correctly, try using an https URL such as the following, where mycomputer refers to the Web server that is hosting Web services that are secured by SSL: If you can successfully visit the location without Internet Explorer displaying an error message, your configuration is correct. You are now ready to try to access your Web service programmatically.

back to the top

Enforce SSL-Only Access

To make sure that only SSL requests are accepted by your Web service, follow these steps to configure the virtual directory where your XML Web service resides to be SSL only in Internet Services Manager:

1. Click Start, point to Administrative Tools, and then click Internet Information Services (IIS).
2. Expand the computer that hosts your XML Web service Web site.
3. Expand the Web Sites folder.
4. Expand the Web site that hosts your XML Web service.
5. Right-click the virtual directory where your XML Web service resides, and then click Properties.
6. Click the Directory Security tab, and then click Edit under the Secure Communications section.
7. In the Secure Communications dialog box, click Require secure channel (SSL), and then click OK two times.

back to the top