AuthenticateAsServer - 根据验证过程，远程证书无效

Question

我正在尝试使用以下代码创建测试客户端/服务器连接：

    static void Main(string[] args)
    {
        var listenerThread = new Thread(ListenerThreadEntry);
        listenerThread.Start();

        Thread.Sleep(TimeSpan.FromSeconds(1));

        var socket = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.IP);
        socket.Connect("localhost", Port);

        var rawStream = new NetworkStream(socket);
        var stream = new SslStream(rawStream, false, VerifyServerCertificate);
        var certificate = new X509Certificate(CertsPath + @"test.cer");
        var certificates = new X509CertificateCollection(new[] { certificate });
        stream.AuthenticateAsClient("localhost", certificates, SslProtocols.Tls, false);

        Thread.Sleep(TimeSpan.FromSeconds(1));
    }

    private static bool VerifyServerCertificate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
    {
        return true;
    }

    static void ListenerThreadEntry()
    {
        var listener = new TcpListener(IPAddress.Any, Port);
        listener.Start();

        var client = listener.AcceptTcpClient();
        var serverCertificate = new X509Certificate2(CertsPath + @"\test.pfx");
        var sslStream = new SslStream(client.GetStream(), false);
        sslStream.AuthenticateAsServer(serverCertificate, true, SslProtocols.Tls, false);

        Thread.Sleep(TimeSpan.FromSeconds(10));
    }

并且在AuthenticateAsServer方法中获取“远程证书根据验证过程无效”错误消息。 使用以下命令创建证书并将其保存到文件：

makecert.exe -r -pe -n "CN=localhost" -a sha1 -sky exchange -sv test.pvk test.cer
pvk2pfx -pvk test.pvk -spc test.cer -pfx test.pfx

我错过了什么？

Answer 1

检查这些步骤，似乎工作，

1)First save the certificate in a file
2)Run MMC
3)Open the Certificate Manager (certmgr.msc in C:\Windows\System32)
4)You will see it opens 'Certificates - Current User'
5)In the menu, choose File, Add/Remove Snap-In
6)Now press Add, select 'Certificates' and select 'Computer Account'
7)Select the Local Computer
8)Now you have two snap-ins:
9)Certificates - Current User
10)Certificates (Local Computer)
11)Now import the certificate in "Certificates (Local Computer)\Trusted Root Certificates\Certificates"

Answer 2

我无法在您的过程中看到您为用于身份验证的证书添加信任。 将false作为参数4传递给AuthenticateAsServer()只会跳过检查吊销，它一般不会跳过对信任的检查。

所以你有以下选择让它工作：

• 不要自己生成证书，而是由默认情况下在Windows中受信任的证书颁发机构生成。 这将花费一些钱，但也有一些便宜的CA，它不一定是Thawte证书。
• 通过将证书导入个人证书列表来添加对证书的信任
• 如果您已创建已添加到受信任根证书列表（在公司或组织中很常见）的自签名CA证书，请使用该CA证书签署证书
• 根本不进行身份验证（但可能你不希望这样）