建立TLS连接时忽略分配的客户端证书

问题描述：

正如在这个问题中Connecting to a Web Service using Client Certificate authentication我想从c＃中使用由服务器管理员提供的客户端证书调用SOAP Web服务。就像在那个问题中一样，我可以在浏览器中使用提供的证书来访问Web服务（他使用CURL，我可以使用IE 而不是FF）。我已经确定在浏览器和下面的代码中使用了相同的证书，并且服务器支持TLS 1.2，这与链接问题不同 - 这是唯一让我的问题不同的问题。建立TLS连接时忽略分配的客户端证书

的证书已导入My和Root商店，我能确定它被发现并使得WS方法调用之前分配给WS对象实例。

但在跟踪我可以看到，它被忽略：

System.Net信息：0：[5928] TlsStream＃11958757 ::构造函数（主机= wsuat.domain.com，＃certs = 0）

我使用的代码非常简单，我从之前的开发人员那里继承了它，并被告知它在大约1年前“曾经工作过”。随着证书分配行注释掉它工作正常，在当地，但只要我尝试用双向SSL开启访问服务器上的WS，它失败：

using (ASoapClient client = new ASoapClient()) 
{ 
    try 
    { 
     //ServicePointManager.Expect100Continue = true; 
     ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12; 

     client.ClientCredentials.ClientCertificate.SetCertificate(
      StoreLocation.LocalMachine 
      ,StoreName.Root // also can load from .My 
      ,X509FindType.FindBySerialNumber // also can find by SubjectName 
      ,"FA33.........................634" 
     ); 
     SubmitResult rr = client.Submit(req); 
    } 
    catch(Exception ex) 
    { 
     MessageBox.Show(ex.Message, "Error submitting"); 
    } 
}

当我设置Expect100Continue到true我出现以下情况例外：

System.ServiceModel.CommunicationException: An error occurred while making the HTTP request to https://wsuat.domain.com/wsuat/ws.asmx. 
This could be due to the fact that the server certificate is not configured properly with HTTP.SYS in the HTTPS case. This could also be caused by a mismatch of the security binding between the client and the server. 
---> System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send. 
---> System.IO.IOException: Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host. 
---> System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host

当我评论说出来，我得到如下：

System.ServiceModel.Security.SecurityNegotiationException: Could not establish secure channel for SSL/TLS with authority 'wsuat.domain.com'. 
---> System.Net.WebException: The request was aborted: Could not create SSL/TLS secure channel. 
at System.Net.HttpWebRequest.GetResponse() 
at System.ServiceModel.Channels.HttpChannelFactory`1.HttpRequestChannel.HttpChannelRequest.WaitForReply(TimeSpan timeout)

答

而且经常发生，只要我aske在完全绝望的这个问题中，答案被找到了。抬头basicHttpBinding安全模式在MSDN，发现运输提供clientCredentialType属性。

一旦我加入了transport元素，并将其设置为Certificate如下，一切工作：

<security mode="Transport"> 
    <transport clientCredentialType="Certificate" /> 
    </security>

建立TLS连接时忽略分配的客户端证书

相关推荐