精心准备的问题.首先，我可能读了同一本书，我想澄清一下这个声明:

那是因为你不应该使用运输安全，因为它应该仅在您所在的环境中使用可以保证有一个之间的点对点连接服务和客户.

是的.HTTPS(传输安全)仅提供点对点安全，但 IMO 人员无法正确理解这种情况.您是否认为如果您通过 HTTP 连接到您的网上银行，它会在 Internet 中间的某个地方随机将通信从 HTTPS 交换为 HTTP?不！点对点连接意味着客户端和提供所请求 URL 的访问网关之间的安全传输通道.在您的方案中，它意味着客户端和您的 ISA 服务器之间的安全传输通道.您的 ISA 和 Web 服务器 2 之间的通信将不会受到保护.如果您想要在客户端和 Web 服务器 2 之间提供安全通道的端到端(ISA 将无法拦截消息)，您需要消息安全性.>

现在回答您的其他问题:

我可以使用相同的证书吗?WCF 服务的消息安全?

是的，您可以，但您必须将私钥复制到您的 Web Server 2.

是消息安全方式可与期望的客户互操作ASMX 网络服务?

没有.除非您编写大量自定义 SOAP 标头和扩展或安装 WSE 3.0，否则纯 ASMX 客户端无法使用消息安全性.

是否可以启用消息上面提到的安全证书而不强制客户端将证书添加到 Trusted人工?

是的，但发布证书的证书颁发机构必须在客户端计算机上受信任.这与 HTTPS 相同.受消息安全保护的服务也可以在 WSDL 中公开证书的指纹.客户端可以使用此指纹验证服务身份.我认为在这种情况下，您也不需要在客户端上安装证书，但是当证书过期时，所有客户端都必须更新.

我是否必须将证书复制到网络服务器能够使用消息安全?

是的，你必须这样做.但这可能是一个问题，因为出于安全原因，证书可以标记为不可导出.***的解决方案是为此目的申请新证书.

I'm preparing to create a WCF Service which our customers can use to update data in our system. So it has to be available over the Internet. I have a book about WCF from which I know the Message Security is the way to go when making a WCF Service available over the Internet. That is because you shouldn't use the transport security because it should only be used in environments where you can guarantee that there is a point-to-point connection between service and client. Did I get that right? So I want to use Message Security in combination with a custom UserName authentication. I understand that I have to get a certificate to accomplish that. Our company already owns a SSL Certificate that is used for our Websites.

• Can I use the same certificate for the message security of the WCF Service?

And

• Is the Message Security way interoperable with clients that expect a ASMX Webservice?

For testing purposes I created my own certificate with Makecert. It worked fine but I always had to add the certificate to the Trusted Persons on the client machine.

• Is it possible to enable the Message Security with the above mentioned certificate without forcing the client to add the certificate to the Trusted Persons manually?

Now, let's assume the following scenario:

There are two Webservers behind an ISA-Server/Firewall. This ISA-Server holds the certificate for the www.company.com address. So all the SSL stuff is handled by it. It also forwards the incoming requests to the webservers accordingly. The newly created WCF Service should run on the 2nd webserver.

• Do I have to copy the certificate to the webserver to be able to use the Message Security?

If yes, I heard copying certificates is not good practice because it reduces the level of security. Moving the certificate to the webserver is not an option, because it's needed for the websites on Web-Server1, too.

• What are my options in this case?

And:

• What would be the best practice for this scenario, regardless of the given requirements?

Thank you...

Nicely prepared question. First of all I probably read the same book and I would like to clarify this statement:

That is because you shouldn't use the transport security because it should only be used in environments where you can guarantee that there is a point-to-point connection between service and client.

Yes. HTTPS (transport security) offers only point-to-point security but IMO people don't understand this scenario correctly. Do you think that if you connect to your Internet banking over HTTPs it will randomly somewhere in the middle of Internet swap communication from HTTPS to HTTP? NO! Point-to-point connection means secured transport channel between client and accessed gateway providing the requested URL. In your scenario it means secured transport channel between Client and your ISA Server. Communication will not be secured between your ISA and Web Server 2. If you want end-to-end which will provide secure channel between client and Web Server 2 (ISA will not be able to intercept messages), you need message security.

Now to your other questions:

Can I use the same certificate for the message security of the WCF Service?

Yes you can, but you have to copy private key to your Web Server 2.

Is the Message Security way interoperable with clients that expect a ASMX Webservice?

No. Pure ASMX client can't use message security unless you code a lot of custom SOAP headers and extensions or install WSE 3.0.

Is it possible to enable the Message Security with the above mentioned certificate without forcing the client to add the certificate to the Trusted Persons manually?

Yes but Certification authority which published certificate must be trusted on client machine. It is same with HTTPS. Services secured with message security also can expose certificate's thumbprint inside WSDL. Clients can validate service identity with this thumbprint. I think that in such case you also don't need to install certificate on client but when certificate expires all clients will have to be updated.

Do I have to copy the certificate to the webserver to be able to use the Message Security?

Yes you must. But this can be a problem because for security reason's certificate can be marked as not exportable. Best solution is to request new certificate just for this purpose.