如何使用证书身份验证自定义套接字TCP协议？

Question

I know that WCF has certificate authentication. How can I do the same thing for my custom sockets protocol? What classes should I use to verify certificates? What data should I transfer between parties? What are the required steps?

Answer 1

Assuming you want to use SSL:

On the server side, you can wrap a NetworkStream in an SslStream and authenticate using a X509Certificate :

SslStream stream = new SslStream(networkStream, false);
stream.AuthenticateAsServer(certificate, false, SslProtocols.Default, false);

The false in that second call controls whether the server requires the client to have a certificate as well.

This link contains code to generate a self-signed certificate, handy during development.

On the client side, you have to provide a validation callback:

SslStream stream = new SslStream(networkStream, false, ValidateRemoteCertificate);
stream.AuthenticateAsClient(RemoteHost);

You can supply client certificates in the AuthenticateAsClient overloads, if desired.

private bool ValidateRemoteCertificate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
    if (sslPolicyErrors == SslPolicyErrors.None)
    {
        return true;
    }

    // Here you decide whether self-signed certificates are OK
    if (allowAnyCertificateAnyway)
    {
        return true;
    }

    return false;
}

I hope this helps, it uses NetworkStream which in the end is simply a wrapper around Socket . This is all built in in the framework, and you can read/write from/to the SslStream as if it was a regular NetworkStream .