Question

案例：

几天前，我们的集成合作伙伴错过了更改SSL服务器证书的截止日期，证书的有效期至今为两天。
当发生这种情况时，我们的客户端软件开始抛出异常：“远程证书根据验证程序无效”。我们的客户端软件是用.NET 4编写的，可以在Windows Server 2012上运行.SSL调用是通过WCF堆栈完成的。
昨天下午，我们的集成合作伙伴安装了新的有效SSL证书。

现在的问题是我们仍然在客户端上获得相同的异常：“根据验证程序，远程证书无效”。

我的问题：

SSL证书验证状态是否以某种方式缓存在客户端上？我们的客户端软件是一个长期运行的过程，很少重新启动。
或者这是SSL协议的一些固有部分？我不是SSL或网络方面的专家，但是不确定a）仅在SSL握手期间客户端检查服务器证书，以及b）在SSL握手中交换的信息可用于对同一台服务器如果确实如此，那么如何定义SSL握手有效期多长？

更新：我们重新启动了客户端进程，然后就可以了。对我而言，这表明某个SSL服务器证书验证状态在每个进程的客户端上缓存。我仍然非常希望了解更多关于此的详细信息：在这种情况下，堆栈的级别是多少？ WCF？。净？ Windows API？这个缓存有多长？有没有办法调整缓存行为？我可以手动清空缓存吗？这是在某处记录的吗？

完整堆栈跟踪：

[E0]: The remote certificate is invalid according to the validation procedure. 
[T0]: System.Security.Authentication.AuthenticationException    at 
System.Net.Security.SslState.StartSendAuthResetSignal(ProtocolToken message, 
AsyncProtocolRequest asyncRequest, Exception exception)     at 
System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] 
buffer, AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)  
   at System.Threading.ExecutionContext.RunInternal(ExecutionContext 
executionContext, ContextCallback callback, Object state, Boolean 
preserveSyncCtx)     at System.Threading.ExecutionContext.Run(ExecutionContext 
executionContext, ContextCallback callback, Object state, Boolean 
preserveSyncCtx)     at System.Threading.ExecutionContext.Run(ExecutionContext 
executionContext, ContextCallback callback, Object state)     at 
System.Net.TlsStream.ProcessAuthentication(LazyAsyncResult result)     at 
System.Net.TlsStream.Write(Byte[] buffer, Int32 offset, Int32 size)     at 
System.Net.ConnectStream.WriteHeaders(Boolean async) [E1]: The underlying 
connection was closed: Could not establish trust relationship for the SSL/TLS 
secure channel. [T1]: System.Net.WebException    at 
System.Net.HttpWebRequest.GetResponse()     at 
System.ServiceModel.Channels.HttpChannelFactory`1.HttpRequestChannel.HttpChannel
Request.WaitForReply(TimeSpan timeout) [E2]: Could not establish trust 
relationship for the SSL/TLS secure channel with authority 
'***removed***'. [T2]: 
System.ServiceModel.Security.SecurityNegotiationException

Answer 1

我遇到了同样的问题。我正在使用本地Root CA证书验证TLS。如果我从商店中删除了证书，连续的请求（使用HttpWebRequest）将继续验证是否每隔几秒钟进行一次调用。但是，如果我等待很短的时间（30-60秒），下一个呼叫将失败，因为它无法找到根证书。

将HttpWebRequest.KeepAlive属性设置为false以防止缓存。为了获得更多控制权，看起来你必须开始反思。请参阅问题How to clear the client-side .Net SSL session cache。

SSL证书验证 - 是否涉及任何缓存？

1 个答案: