SslStream.AuthenticateAsServer证书链

Question

Are possible connect to client as server with certificate chain ?

clientStream.AuthenticateAsServerAsync(certificate, false, System.Security.Authentication.SslProtocols.Tls, false).Wait();

I'm just try connect to client with self-signed certificates chain, and haven't luck. Method of SslStream instance AuthenticateAsServer have only one certificate as argument. But browser ask for additional root certificate . Have u any minds or code samples how do it ?

Answer 1

The chain doesn't send the root, because either A) You already have it, so it's redundant to your root store; or B) You don't, in which case you won't trust it, so why bother?

RFC 5246, section 7.4.2 :

certificate_list: This is a sequence (chain) of certificates. The sender's certificate MUST come first in the list. Each following certificate MUST directly certify the one preceding it. Because certificate validation requires that root keys be distributed independently, the self-signed certificate that specifies the root certificate authority MAY be omitted from the chain, under the assumption that the remote end must already possess it in order to validate it in any case.

The SslStream class will send the server identity certificate followed by any intermediates it knows about, but not the root (unless, of course, the server identity certificate is self-signed).

Normally untrusted roots can be looked up via the Authority Information Access record they write into their child/intermediate CAs. If you don't have AIA or the endpoints are unreachable you'll have to transfer the root to the client machine via a different mechanism.