您的位置: 首页  >  技术问答  >  请求被中止：无法创建SSL/TLS安全通道 - IllegalMessage

请求被中止：无法创建SSL/TLS安全通道 - IllegalMessage

分类: 技术问答 • 2022-03-31 09:54:51

请求被中止：无法创建SSL/TLS安全通道 - IllegalMessage

问题描述：

我在这方面看到过几个类似的问题，但似乎没有任何答案真的有助于解决它。请求被中止：无法创建SSL/TLS安全通道 - IllegalMessage

我需要通过证书认证来访问客户Web服务。在提示时选择正确的证书后，使用SoapUI和chrome工作正常。但我无法使用IE，WCF客户端，不是我自己的，也不是WcfTestClient。 操作系统是Windows服务器2012 R2，协议TLS 1.2

我一直在调查事件，tracelogs，也花了相当一段时间分析wireshark捕获，但我卡住了。这是我

事件日志：

下产生致命的警报并发送到远程端点。这可能会导致连接终止。 TLS协议定义的致命错误代码是10，在Windows SChannel中的错误状态是12

跟踪日志：

我会忽略不感兴趣的部分，并只显示相关的。

System.Net Information: 0 : [12208] Connection#11144211 - Created connection 
    from 192.168.3.13:53514 to 145.119.167.109:443. 
System.Net Information: 0 : [12208] TlsStream#3957675::.ctor(host=aaa.bbb.eu, #certs=1) 
System.Net Information: 0 : [12208] Associating HttpWebRequest#37368736 with ConnectStream#35619075 
. 
. 
. 
System.Net Information: 0 : [12208] 
SecureChannel#52136226::.ctor(hostname=aaa.bbb.eu, #clientCertificates=1, encryptionPolicy=RequireEncryption) 
System.Net Information: 0 : [12208] Enumerating security packages: 
System.Net Information: 0 : [12208]  Negotiate 
System.Net Information: 0 : [12208]  NegoExtender 
System.Net Information: 0 : [12208]  Kerberos 
System.Net Information: 0 : [12208]  NTLM 
System.Net Information: 0 : [12208]  TSSSP 
System.Net Information: 0 : [12208]  pku2u 
System.Net Information: 0 : [12208]  WDigest 
System.Net Information: 0 : [12208]  Schannel 
System.Net Information: 0 : [12208]  Microsoft Unified Security Protocol Provider 
System.Net Information: 0 : [12208]  CREDSSP 
System.Net Information: 0 : [12208] SecureChannel#52136226 - Attempting to restart the session using the user-provided certificate: [HERE GOES DATA ABOUT CERTIFICATE] 
. 
. 
. 
System.Net Information: 0 : [12208] SecureChannel#52136226 - Left with 1 client certificates to choose from. 
System.Net Information: 0 : [12208] SecureChannel#52136226 - Trying to find a matching certificate in the certificate store. 
System.Net Information: 0 : [12208] SecureChannel#52136226 - Locating the private key for the certificate: [HERE GOES DATA ABOUT CERTIFICATE] 
. 
. 
. 
System.Net Information: 0 : [12208] SecureChannel#52136226 - Certificate is of type X509Certificate2 and contains the private key. 
System.Net Information: 0 : [12208] AcquireCredentialsHandle(package = Microsoft Unified Security Protocol Provider, intent = Outbound, scc  = System.Net.SecureCredential) 
System.Net Information: 0 : [12208] InitializeSecurityContext(credential = System.Net.SafeFreeCredential_SECURITY, context = (null), targetName = aaa.bbb.eu, inFlags = ReplayDetect, SequenceDetect, Confidentiality, AllocateMemory, InitManualCredValidation) 
System.Net Information: 0 : [12208] InitializeSecurityContext(In-Buffer length=0, Out-Buffer length=161, returned code=ContinueNeeded).

然后一些收到的消息，与

System.Net.Sockets Verbose: 0 : [12208] Exiting Socket#33189039::Receive() -> Int32#2516 
System.Net Information: 0 : [12208] InitializeSecurityContext(credential = System.Net.SafeFreeCredential_SECURITY, context = cb00f8:7980678, targetName = aaa.bbb.eu, inFlags = ReplayDetect, SequenceDetect, Confidentiality, AllocateMemory, InitManualCredValidation) 
System.Net Information: 0 : [12208] InitializeSecurityContext(In-Buffers count=2, Out-Buffer length=0, returned code=ContinueNeeded). 
System.Net.Sockets Verbose: 0 : [12208] Socket#33189039::Receive() 
System.Net.Sockets Verbose: 0 : [12208] Data from Socket#33189039::Receive
之间

。最后，这个问题。

System.Net.Sockets Verbose: 0 : [12208] Exiting Socket#33189039::Receive() -> Int32#2839 
System.Net Information: 0 : [12208] InitializeSecurityContext(credential = System.Net.SafeFreeCredential_SECURITY, context = cb00f8:7980678, targetName = aaa.bbb.eu, inFlags = ReplayDetect, SequenceDetect, Confidentiality, AllocateMemory, InitManualCredValidation) 
System.Net Information: 0 : [12208] InitializeSecurityContext(In-Buffers count=2, Out-Buffer length=0, returned code=IllegalMessage). 
System.Net.Sockets Verbose: 0 : [12208] Socket#33189039::Dispose() 
System.Net Error: 0 : [12208] Exception in HttpWebRequest#37368736:: - The request was aborted: Could not create SSL/TLS secure channel.. 
System.Net Error: 0 : [12208] Exception in HttpWebRequest#37368736::GetResponse - The request was aborted: Could not create SSL/TLS secure channel..

所以，很显然，我有足够的权利，成功地阅读和使用提供的客户端证书（这是蛮好的Chrome和了SoapUI）。 当通过Wireshark检查网络流时，Client Hello和Server Hello在那里，然后是证书和服务器密钥交换消息。然后很多可能没有正确解码的数据包来自服务器（由Wireshark标记为Encrypted Handshake消息，内容看起来像是某些证书），最后是从我的客户端收到ACK RST数据包。

任何想法可能会导致这将不胜感激。

编辑：添加了客户机代码和配置

客户端代码：

ServicePointManager.SetTcpKeepAlive(true, 10000, 1000); 
ServicePointManager.Expect100Continue = true; 
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12; 

try 
{ 
    client = new IncidentBrokerPortTypeClient("gms_endpoint"); 
    client.EchoRequest(new EchoRequest());    
} 
catch (Exception ex) 
{ 
    MessageBox.Show(ex.Message + Environment.NewLine + ex.InnerException); 
}

配置：

<?xml version="1.0" encoding="utf-8" ?> 
<configuration> 
<startup> 
    <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6.1" /> 
</startup> 
<system.serviceModel> 
    <bindings> 
    <basicHttpsBinding> 
    <binding name="HttpsBasicBinding"> 
     <security mode="Transport" > 
     <transport clientCredentialType="Certificate"/> 
     </security> 
    </binding> 
</basicHttpsBinding> 
</bindings> 
<client> 
    <endpoint 
    name ="gms_endpoint" 
    address="https://aaa.bbb.eu/" 
    binding="basicHttpsBinding" 
    bindingConfiguration="HttpsBasicBinding" 
    contract="SomeNamespace.IncidentBrokerPortType" 
    behaviorConfiguration="GmsBehavior" 
     /> 
</client> 
<behaviors> 
    <endpointBehaviors> 
     <behavior name="GmsBehavior">    
      <clientCredentials> 
       <clientCertificate x509FindType="FindByThumbprint" 
findValue="5c1dd5c93d1854cb2d698451e1d2a78a3d94dcb0" 
storeLocation="LocalMachine"/> 
      </clientCredentials>     
     </behavior> 
    </endpointBehaviors> 
    </behaviors> 
</system.serviceModel> 
</configuration>
+0

与chrome浏览器不同，WCFTestClient不具备提示用户附加客户端证书的功能。除非明确编码，否则您的自定义客户端将不具备该功能。虽然我想知道为什么IE不提示您附加客户端证书。 –

+0

根据跟踪日志，我已经将WcfTestClient和我的自定义测试客户端都配置为使用给定证书，至少自定义测试客户端使用它。 –

+0

事实上，它按照预期与soapui和铬，然后没有错误的服务。在这种情况下，我们将不得不检查您的自定义客户端代码。你可以发布它吗？ –

答

也许添加诊断，以客户端的配置会有所帮助，类似如下：

<?xml version="1.0" encoding="utf-8" ?> 
<configuration> 
    <startup> 
    <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6.1" /> 
    </startup> 
    <!--diagnostics traces will be found in Web_messages.svclog file and Web_tracelog.svclog file--> 
    <system.diagnostics> 
    <sources> 
     <source name="System.ServiceModel.MessageLogging" switchValue="Warning, ActivityTracing"> 
     <listeners> 
      <add type="System.Diagnostics.DefaultTraceListener" name="Default"> 
      <filter type="" /> 
      </add> 
      <add name="ServiceModelMessageLoggingListener"> 
      <filter type="" /> 
      </add> 
     </listeners> 
     </source> 
     <source name="System.ServiceModel" switchValue="Warning,ActivityTracing" 
     propagateActivity="true"> 
     <listeners> 
      <add type="System.Diagnostics.DefaultTraceListener" name="Default"> 
      <filter type="" /> 
      </add> 
      <add name="ServiceModelTraceListener"> 
      <filter type="" /> 
      </add> 
     </listeners> 
     </source> 
    </sources> 
    <sharedListeners> 
     <add initializeData="Web_messages.svclog" type="System.Diagnostics.XmlWriterTraceListener, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" 
     name="ServiceModelMessageLoggingListener" traceOutputOptions="Timestamp"> 
     <filter type="" /> 
     </add> 
     <add initializeData="Web_tracelog.svclog" type="System.Diagnostics.XmlWriterTraceListener, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" 
     name="ServiceModelTraceListener" traceOutputOptions="Timestamp"> 
     <filter type="" /> 
     </add> 
    </sharedListeners> 
    <trace autoflush="true" /> 
    </system.diagnostics> 
    <system.serviceModel> 
    <!--Enable diagnostics to record wcf communication--> 
    <diagnostics wmiProviderEnabled="true"> 
     <messageLogging logEntireMessage="true" logMalformedMessages="true" logMessagesAtServiceLevel="true" logMessagesAtTransportLevel="true" /> 
    </diagnostics> 
    <bindings> 
     <basicHttpsBinding> 
     <binding name="HttpsBasicBinding"> 
      <security mode="Transport" > 
      <transport clientCredentialType="Certificate"/> 
      </security> 
     </binding> 
     </basicHttpsBinding> 
    </bindings> 
    <client> 
     <endpoint 
     name ="gms_endpoint" 
     address="https://aaa.bbb.eu/" 
     binding="basicHttpsBinding" 
     bindingConfiguration="HttpsBasicBinding" 
     contract="SomeNamespace.IncidentBrokerPortType" 
     behaviorConfiguration="GmsBehavior" 
     /> 
    </client> 
    <behaviors> 
     <endpointBehaviors> 
     <behavior name="GmsBehavior"> 
      <clientCredentials> 
      <clientCertificate x509FindType="FindByThumbprint" 
findValue="5c1dd5c93d1854cb2d698451e1d2a78a3d94dcb0" 
storeLocation="LocalMachine"/> 
      </clientCredentials> 
     </behavior> 
     </endpointBehaviors> 
    </behaviors> 
    </system.serviceModel> 
</configuration>
+0

我之前已经有过诊断功能（即“Trace log”部分来自哪里），只是在System.Net.I中将它们从配置中排除在外，以节省一些空间。顺便说一句。我之前使用过.svclogs，他们甚至没有描述性 –

相关推荐