Zt:consuming webservices over HTTPS (SSL)

Services|web when webservices are used, a common concern are SECURITY:SOAP messages are transferred in plain text over th E Network, so anyone with a sniffer could intercept the SOAP and read it. In I opinion this could happen also to binary data, but probably it requires a little bit more hacker. So a solution are to use HTTPS (SSL) instead of HTTP, so the communication is encrypted. To accomplish this is need to get and install a certificate (issued by a certificate authority) on your webserver. In a production environment your would buy a certificate from Verisign or another down known CA, or you would install Own CA, which is a component of Windows Server. If you are want to play with HTTPS, SSL and certificates or your project is in the development phase, you can also genera Te a test certificate using the MakeCert.exe tool (included in the. NET Framework SDK). Have to add this certificate to a website in IIS, and set a port which HTTPS should uSe.

When you are in a HTTPS site, you are probably get a dialog window asking you if you want the certificate provided by the webserver. So the responsibility of accepting the certificate are handled by the user. Let's get back to the WebService scenario, if you are want to invoke a webservice located on a webserver which uses SSL and HT TPS there is a problem. When you make the call from code, there are no dialog window popping up, and asking if your trust the certificate (luckily B Ecause this would is pretty ugly in server-side scenarios); Probably ' ll get following exception:
An unhandled exception of type ' System.Net.WebException ' occurred in System.dll

Additional information:the Underlying connection was closed:could don't establish trust relationship with remote server.

But There is a solution to this problem, can solve this in your code by creating your own class (CertificatePolicy Ich implements the ICertificatePolicy interface). In this class you'll have to write your own CheckValidationResult function that has to return true or false and like your Wo Uld Press Yes or No in the dialog window. For development purposes I ' ve created the following class which accepts all certificates and so you won ' t get the nasty WebEx Ception anymore:
public class TrustAllCertificatePolicy:System.Net.ICertificatePolicy
{
Public Trustallcertificatepolicy ()
{}

public bool CheckValidationResult (ServicePoint sp,
X509Certificate cert,webrequest req, int problem)
{
return true;
}
}

As you can have a CheckValidationResult function always returns true, so all certificates would be trusted. If you are want to make this class A little bit more secure, you can add additional checks using the X509Certificate parameter For example. To use this certificatepolicy, your ' ll have to tell the ServicePointManager to use it:
System.Net.ServicePointManager.CertificatePolicy = new Trustallcertificatepolicy ();
This must is done (one time during the "Application Life cycle") before making the call to your webservice.