title: WCF/MSMQ Transport Security with Certificates
body: <p>my goal is to secure the communication between <code>MSMQ</code> Queue Managers – I don’t want unknown clients sending messages to my <code>MSMQ</code> server.</p>
  
  <p>I have spent many hours now trying to get <code>Transport</code> security working for the <code>net.msmq</code> binding in <code>WCF</code>, where <code>MSMQ</code> is in <code>Workgroup</code> mode and the client and server do not have <code>Active Directory</code>… so I’m using certificates.  I have created a new <code>X.509</code> certificate, called <code>Kristan</code> and put it into the “<code>Trusted people</code>” store on the server and into the My store of <code>Current User</code> of the client.</p>
  
  <p>The error I’m getting is:</p>
  
  <blockquote>
    <p>An error occurred while sending to the queue: <code>Unrecognized error -1072824272 (0xc00e0030).Ensure that MSMQ is installed and running. If you are sending to a local queue, ensure the queue exists with the required access mode and authorization</code>.</p>
  </blockquote>
  
  <p>Using smartsniff, I see that there’s no attempted connection with the remote <code>MSMQ</code>, however, it’s an error probably coming from the local queue manager.  The stack trace is:</p>
  
  <pre><code> at System.ServiceModel.Channels.MsmqOutputChannel.OnSend(Message message, TimeSpan timeout)
     at System.ServiceModel.Channels.OutputChannel.Send(Message message, TimeSpan timeout)
     at System.ServiceModel.Dispatcher.OutputChannelBinder.Send(Message message, TimeSpan timeout)
     at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout)
     at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation)
     at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)
  </code></pre>
  
  <p>The code:-</p>
  
  <pre><code>EndpointAddress endpointAddress = new EndpointAddress(new Uri(endPointAddress));
  
              NetMsmqBinding clientBinding = new NetMsmqBinding();
              clientBinding.Security.Mode = NetMsmqSecurityMode.Transport;
  
              clientBinding.Security.Transport.MsmqAuthenticationMode = MsmqAuthenticationMode.Certificate;
              clientBinding.Security.Transport.MsmqProtectionLevel = System.Net.Security.ProtectionLevel.Sign; 
  
              clientBinding.ExactlyOnce = false;
              clientBinding.UseActiveDirectory = false; 
  
              // start new
              var channelFactory = new ChannelFactory&lt;IAsyncImportApi&gt;(clientBinding, endpointAddress);
  
  
              channelFactory.Credentials.ClientCertificate.SetCertificate("CN=Kristan",
                  StoreLocation.CurrentUser,
                  StoreName.My);
  </code></pre>
  
  <p>The queue is flagged as ‘Authenticated’ on the server.  I have checked the effect of this and if I turn off all security in the client send, then I get ‘Signature is invalid’ – which is understandable and shows that it’s definitely looking for a sig. </p>
  
  <p>Are there are special ports that I need to check are open for cert-based msmq auth?</p>