我在使用 TLS 1.2 時遇到了自定義證書驗證器的問題
X509CertificateValidator我通過繼承和實作該Validate()功能來設定自定義驗證器。
但是，由于某種原因，Validate()函式永遠不會被呼叫，我的客戶收到錯誤：
呼叫者未經服務驗證
內部例外：
由于身份驗證失敗，無法滿足對安全令牌的請求。
這適用于 TLS 1.0（啟用該功能后，我可以在其中設定一個斷點Validate()并且它會被命中，但禁用它不會。）
正如其他問題所建議的那樣，我嘗試在客戶端和服務器中都添加它：
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
...這在客戶端的組態檔中：
<AppContextSwitchOverrides value="Switch.System.ServiceModel.DisableUsingServicePointManagerSecurityProtocols=false;Switch.System.Net.DontEnableSchUseStrongCrypto=false;;Switch.System.Net.DontEnableSystemDefaultTlsVersions=false" />
...這在服務器的 web.config 檔案中：
<add key="AppContext.SetSwitch:Switch.System.Net.DontEnableSchUseStrongCrypto" value="false" />
<add key="AppContext.SetSwitch:Switch.System.Net.DontEnableSystemDefaultTlsVersions" value="false" />
以下是創建自定義驗證器的代碼：
protected override void ApplyConfiguration() // Overrides ServiceHost.ApplyConfiguration()
{
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
base.ApplyConfiguration();
var binding = new MyAppHttpBinding(); // Custom object inheriting from CustomBinding - See below...
AddServiceEndpoint(typeof(IMyService), binding);
Credentials.ClientCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.Custom;
var configuration = WebConfigurationManager.OpenWebConfiguration("~");
var clientCertificate = configuration.GetCertificate("MyApp.ClientCertificate");
var serviceCertificate = configuration.GetCertificate("MyApp.ServerCertificate");
Credentials.ClientCertificate.Authentication.CustomCertificateValidator = new ThumbprintCertificateValidator(new[] { clientCertificate });
Credentials.ServiceCertificate.Certificate = serviceCertificate;
}
...和Validate()功能...
（似乎僅使用 TLS 1.2 并沒有達到此目的）
public void Validate(string thumbprint)
{
var valid = Thumbprints
.Contains(thumbprint);
if (!valid)
{
throw new SecurityTokenValidationException("Certificate thumbprint does not match any in certificate store.");
}
}
/// <summary>
/// Validates the certificate's thumbprint with those specified.
/// </summary>
public override void Validate(X509Certificate2 certificate)
{
var thumbprint = certificate.Thumbprint;
Validate(thumbprint);
}
MyAppHttpBinding這是從其建構式呼叫的初始化代碼
var sslNegotiationBindingElement = SecurityBindingElement.CreateSslNegotiationBindingElement(true);
sslNegotiationBindingElement.MessageSecurityVersion = MessageSecurityVersion.WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10;
var secureConversationBindingElement = SecurityBindingElement.CreateSecureConversationBindingElement(sslNegotiationBindingElement);
Elements.Add(new TransactionFlowBindingElement());
Elements.Add(secureConversationBindingElement);
Elements.Add(new TextMessageEncodingBindingElement());
Elements.Add(new HttpTransportBindingElement());
uj5u.com熱心網友回復：
要使用 TLS，請參閱檔案
轉載請註明出處，本文鏈接：https://www.uj5u.com/gongcheng/423123.html
標籤：