Question

在我的vs2013开发虚拟机上使用Azure SDK 2.3，我可以轻松地使用Azure中托管的服务总线队列。但是，在Windows Server 2008 R2 Standard SP1上，Windows似乎无法信任所涉及的证书，并且会抛出异常。

引发的行：

// Send the message
await queueclient.SendAsync(message);

异常消息：

X.509证书CN = servicebus.windows.net不在受信任范围内人们的商店。 X.509证书CN = servicebus.windows.net链建筑失败了。使用的证书具有信任链无法验证。更换证书或更改 certificateValidationMode。无法构建证书链受信任的根权威。

CAPI2日志（附在下面）指向信任问题，因此我比较了两台计算机上安装的证书。服务器上不存在以下证书：

中级证书颁发机构＆gt; Microsoft Internet Authority   （由Baltimore CyberTrust Root发布）

中级证书颁发机构＆gt; MSIT Machine Auth CA 2   （由Microsoft Internet Authority发布）

问题：

证书来自哪里？
为什么他们从服务器上丢失了？
如何解决此问题？

可能的路径（更新）：

~~在服务器上安装Azure SDK 2.3 for Visual Studio 2013~~
~~在服务器上安装所有Windows更新~~

我试过了：

<appSettings>
  <add key="Microsoft.ServiceBus.X509RevocationMode" value="NoCheck"/>
</appSettings>

CAPI2验证连锁政策事件：

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-CAPI2" Guid="{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}" />
    <EventID>30</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>30</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000001</Keywords>
    <TimeCreated SystemTime="2014-06-11T19:57:38.998656000Z" />
    <EventRecordID>5642</EventRecordID>
    <Correlation />
    <Execution ProcessID="5280" ThreadID="8472" />
    <Channel>Microsoft-Windows-CAPI2/Operational</Channel>
    <Computer>ne-r026-310cn</Computer>
    <Security UserID="S-1-5-82-1758914132-2364927631-3137608320-3227192193-3717738432" />
  </System>
  <UserData>
    <CertVerifyCertificateChainPolicy>
      <Policy type="CERT_CHAIN_POLICY_BASE" constant="1" />
      <Certificate fileRef="3E560462C61B45BE1A59F1286B34A065A878AFA0.cer" subjectName="servicebus.windows.net" />
      <CertificateChain chainRef="{19B5F58A-FA37-4213-A888-C81C340D019C}" />
      <Flags value="1000" CERT_CHAIN_POLICY_IGNORE_PEER_TRUST_FLAG="true" />
      <Status chainIndex="0" elementIndex="-1" />
      <EventAuxInfo ProcessName="w3wp.exe" />
      <CorrelationAuxInfo TaskId="{F8DE43DD-9E68-461E-8A2B-17215BA87E0C}" SeqNumber="1" />
      <Result value="800B010A">A certificate chain could not be built to a trusted root authority.</Result>
    </CertVerifyCertificateChainPolicy>
  </UserData>
</Event>

CAPI2 Build Chain事件：

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-CAPI2" Guid="{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}" />
    <EventID>11</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>11</Task>
    <Opcode>2</Opcode>
    <Keywords>0x4000000000000003</Keywords>
    <TimeCreated SystemTime="2014-06-11T19:57:38.998656000Z" />
    <EventRecordID>5641</EventRecordID>
    <Correlation />
    <Execution ProcessID="5280" ThreadID="8472" />
    <Channel>Microsoft-Windows-CAPI2/Operational</Channel>
    <Computer>ne-r026-310cn</Computer>
    <Security UserID="S-1-5-82-1758914132-2364927631-3137608320-3227192193-3717738432" />
  </System>
  <UserData>
    <CertGetCertificateChain>
      <Certificate fileRef="3E560462C61B45BE1A59F1286B34A065A878AFA0.cer" subjectName="servicebus.windows.net" />
      <ValidationTime>2014-06-11T19:57:38.998Z</ValidationTime>
      <AdditionalStore />
      <ExtendedKeyUsage />
      <Flags value="0" />
      <ChainEngineInfo context="machine" />
      <AdditionalInfo>
        <NetworkConnectivityStatus value="1" _SENSAPI_NETWORK_ALIVE_LAN="true" />
      </AdditionalInfo>
      <CertificateChain chainRef="{19B5F58A-FA37-4213-A888-C81C340D019C}">
        <TrustStatus>
          <ErrorStatus value="10000" CERT_TRUST_IS_PARTIAL_CHAIN="true" />
          <InfoStatus value="0" />
        </TrustStatus>
        <ChainElement>
          <Certificate fileRef="3E560462C61B45BE1A59F1286B34A065A878AFA0.cer" subjectName="servicebus.windows.net" />
          <SignatureAlgorithm oid="1.2.840.113549.1.1.5" hashName="SHA1" publicKeyName="RSA" />
          <PublicKeyAlgorithm oid="1.2.840.113549.1.1.1" publicKeyName="RSA" publicKeyLength="2048" />
          <TrustStatus>
            <ErrorStatus value="0" />
            <InfoStatus value="2" CERT_TRUST_HAS_KEY_MATCH_ISSUER="true" />
          </TrustStatus>
          <ApplicationUsage>
            <Usage oid="1.3.6.1.5.5.7.3.2" name="Client Authentication" />
            <Usage oid="1.3.6.1.5.5.7.3.1" name="Server Authentication" />
          </ApplicationUsage>
          <IssuanceUsage />
        </ChainElement>
      </CertificateChain>
      <EventAuxInfo ProcessName="w3wp.exe" />
      <CorrelationAuxInfo TaskId="{9077AB4E-95E3-449B-AF2F-0BF42E92E6B7}" SeqNumber="11" />
      <Result value="800B010A">A certificate chain could not be built to a trusted root authority.</Result>
    </CertGetCertificateChain>
  </UserData>
</Event>

CAPI2 X509对象事件：

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-CAPI2" Guid="{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}" />
    <EventID>90</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>90</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000200</Keywords>
    <TimeCreated SystemTime="2014-06-11T19:57:38.998656000Z" />
    <EventRecordID>5640</EventRecordID>
    <Correlation />
    <Execution ProcessID="5280" ThreadID="8472" />
    <Channel>Microsoft-Windows-CAPI2/Operational</Channel>
    <Computer>ne-r026-310cn</Computer>
    <Security UserID="S-1-5-82-1758914132-2364927631-3137608320-3227192193-3717738432" />
  </System>
  <UserData>
    <X509Objects>
      <Certificate fileRef="3E560462C61B45BE1A59F1286B34A065A878AFA0.cer" subjectName="servicebus.windows.net">
        <Subject>
          <CN>servicebus.windows.net</CN>
        </Subject>
        <SubjectKeyID computed="false" hash="BD41618C22D8DBEE9D172C12A2C549D61711ED75" />
        <SignatureAlgorithm oid="1.2.840.113549.1.1.5" hashName="SHA1" publicKeyName="RSA" />
        <PublicKeyAlgorithm oid="1.2.840.113549.1.1.1" publicKeyName="RSA" publicKeyLength="2048" />
        <Issuer>
          <CN>MSIT Machine Auth CA 2</CN>
          <DC>redmond</DC>
          <DC>corp</DC>
          <DC>microsoft</DC>
          <DC>com</DC>
        </Issuer>
        <SerialNumber>70DB015B000100008C58</SerialNumber>
        <NotBefore>2013-07-27T03:31:06Z</NotBefore>
        <NotAfter>2015-07-27T03:31:06Z</NotAfter>
        <Extensions>
          <KeyUsage value="B0" CERT_DIGITAL_SIGNATURE_KEY_USAGE="true" CERT_KEY_ENCIPHERMENT_KEY_USAGE="true" CERT_DATA_ENCIPHERMENT_KEY_USAGE="true" />
          <ExtendedKeyUsage>
            <Usage oid="1.3.6.1.5.5.7.3.2" name="Client Authentication" />
            <Usage oid="1.3.6.1.5.5.7.3.1" name="Server Authentication" />
          </ExtendedKeyUsage>
          <SubjectAltName>
            <DNSName>*.servicebus.windows.net</DNSName>
            <DNSName>servicebus.windows.net</DNSName>
          </SubjectAltName>
          <AuthorityKeyIdentifier>
            <KeyID hash="EBDB115EF8099ED8D6629CFD629DE3844A28E127" />
          </AuthorityKeyIdentifier>
        </Extensions>
      </Certificate>
      <EventAuxInfo ProcessName="w3wp.exe" />
      <CorrelationAuxInfo TaskId="{9077AB4E-95E3-449B-AF2F-0BF42E92E6B7}" SeqNumber="10" />
    </X509Objects>
  </UserData>
</Event>

Answer 1

缺少的证书是造成例外的原因。

我无法在网上找到证书，我仍然不确定他们是如何设法自己安装的但我认为我有一个想法..

我们如何设法获取证书？ 我们将Service Bus消息代码隔离到控制台应用程序中，并使用生产服务器上的管理员权限执行它。证书会自动在过程中自行安装。

也许我们的应用程序池在具有有限权限的ApplicationPoolIdentity下运行，不允许Windows下载或安装证书。

~~此链接似乎提供了相关信息：http://netsekure.org/2011/04/automatic-ca-root-certificate-updates-on-windows/~~

更新：您可以下载证书链here。

Answer 2

要从Service Server for Windows Server中消除证书信任问题，请使用以下命令：

创建您信任的证书列表：

    var trustedCertificates = new HashSet<string>(new[]
    {
        "1245…",
        "4567…, 
        "8102…" 
    }, StringComparer.OrdinalIgnoreCase);

相信那些：

    ServicePointManager.ServerCertificateValidationCallback = (sender, certificate, chain, errors) =>
    {
        if (errors == SslPolicyErrors.None)
        {
            return true;
        }

        var hashString = certificate.GetCertHashString();
        var isTrusted = trustedCertificates.Contains(hashString);

        if (!isTrusted)
        {
            telemetryClient.TrackTrace($"Untrusted: {hashString} Errors: {errors} Cert: {certificate.ToString()}", SeverityLevel.Warning);
        }

        return isTrusted;
    };

平静的服务总线也是：

    private static void SetCertificateValidator()
    {
        var retriableCertificateValidatorType = Type.GetType("Microsoft.ServiceBus.Channels.Security.RetriableCertificateValidator, Microsoft.ServiceBus", true, false);
        var instanceProperty = retriableCertificateValidatorType.GetProperty("Instance", BindingFlags.Static | BindingFlags.NonPublic);
        var instance = instanceProperty.GetValue(null);

        var peerOrChainTrustNoCheck = retriableCertificateValidatorType.GetField("peerOrChainTrustNoCheck", BindingFlags.Instance | BindingFlags.NonPublic);
        peerOrChainTrustNoCheck?.SetValue(instance, new EmptyOpX509CertificateValidator());
    }

    private sealed class EmptyOpX509CertificateValidator : X509CertificateValidator
    {
        public override void Validate(X509Certificate2 certificate)
        {
        }
    }

Azure托管服务总线：“X.509证书CN = servicebus.windows.net不在受信任的人员商店中。”

2 个答案: