I'm using the IWSTrustChannelContract class to issue a new SecurityToken. I'm creating the WSTrustChannelFactory in this fashion:
new WSTrustChannelFactory(...)
{
TrustVersion = TrustVersion.WSTrust13,
Credentials =
{
ServiceCertificate =
{
DefaultCertificate = serviceCert,
Authentication =
{
RevocationMode = X509RevocationMode.Online,
CertificateValidationMode = X509CertificateValidationMode.PeerOrChainTrust
},
},
ClientCertificate = { Certificate = clientCert },
},
Endpoint =
{
Address = address,
Contract = { ProtectionLevel = ProtectionLevel.Sign }
}
};
Later in the flow I'm creating a client with that factory and call client.Issue(request) to generate token. This works fine, but I want to introduce the more proper revocation handling that starts with the X509RevocationMode.Offline and when I receive the revocation erorr I want to issue the token with X509RevocationMode.Online (as described in this thread).
What I'm struggling with is that when I simulate the revocation failed conditions, I'm getting the "general" SecurityTokenValidationException, which is descriptive enough to recognize what is the failure, but I don't know how to handle that gracefully via code. All I get is that exception with following message:
The X.509 certificate SERIALNUMBER=XXXX + CN=XXXX, O=XXX, C=XXX chain building failed. The certificate that was used has a trust chain that cannot be verified. Replace the certificate or change the certificateValidationMode. The revocation function was unable to check revocation because the revocation server was offline.
Should I just look in that message for keywords? Problem with that is that I don't really know if that message is localized or not, as my tracks ends at that line of code:
public X509ChainStatus[] ChainStatus
=> throw DiagnosticUtility.ExceptionUtility.ThrowHelperError((Exception) new NotSupportedException());
I'm confused because that property is used to build the SecurityTokenValidationException (basically just enumeration of different errors that come up during chain validation).
Anyway - how do you handle certificate revocation check in your applications?
