获取“无法创建SSL / TLS安全通道”

Question

我有一些网站有时无法连接到第三方SOAP WS。当有很多对第三方WS的请求时，它最常发生。所以它不会每次都失败，只有一些时间 - 而且大多数时候都会向第三方提出很多请求。

已使用IIS Crypto修复了我们的内部部署服务器。之前检查了所有已禁用的复选框。

但是在Azure WebApp上，我们无法控制这些设置 - 任何想法该怎么做？

Heres是绑定的代码，更多的是第三方soap ws：

        public static CustomBinding GetDefaultBinding()
    {
        ServicePointManager.ServerCertificateValidationCallback = delegate { return true; };

        AsymmetricSecurityBindingElement securityElement = new AsymmetricSecurityBindingElement();

        securityElement.MessageSecurityVersion = MessageSecurityVersion.WSSecurity11WSTrust13WSSecureConversation13WSSecurityPolicy12;

        securityElement.InitiatorTokenParameters = new X509SecurityTokenParameters(X509KeyIdentifierClauseType.IssuerSerial, SecurityTokenInclusionMode.Never);
        securityElement.RecipientTokenParameters = new X509SecurityTokenParameters(X509KeyIdentifierClauseType.IssuerSerial, SecurityTokenInclusionMode.Never);
        securityElement.ProtectTokens = true;

        securityElement.MessageProtectionOrder = MessageProtectionOrder.SignBeforeEncrypt;

        securityElement.RequireSignatureConfirmation = true;

        securityElement.SecurityHeaderLayout = SecurityHeaderLayout.Lax;
        securityElement.EnableUnsecuredResponse = true;
        securityElement.IncludeTimestamp = true;
        securityElement.SetKeyDerivation(false);
        securityElement.DefaultAlgorithmSuite = SecurityAlgorithmSuite.Basic128Rsa15;
        securityElement.EndpointSupportingTokenParameters.SignedEncrypted.Add(new UserNameSecurityTokenParameters());
        securityElement.AllowSerializedSigningTokenOnReply = true;

        CustomBinding myBinding = new CustomBinding();
        myBinding.Elements.Add(securityElement);

        TextMessageEncodingBindingElement element = new TextMessageEncodingBindingElement(MessageVersion.Soap11WSAddressing10, Encoding.UTF8);
        element.ReaderQuotas.MaxStringContentLength = int.MaxValue;
        element.ReaderQuotas.MaxDepth = int.MaxValue;
        element.ReaderQuotas.MaxArrayLength = int.MaxValue;
        element.ReaderQuotas.MaxBytesPerRead = int.MaxValue;
        element.ReaderQuotas.MaxNameTableCharCount = int.MaxValue;
        myBinding.Elements.Add(element);

        HttpsTransportBindingElement httpsBindingElement = new HttpsTransportBindingElement();
        httpsBindingElement.RequireClientCertificate = true;
        httpsBindingElement.MaxBufferPoolSize = int.MaxValue;
        httpsBindingElement.MaxBufferSize = int.MaxValue;
        httpsBindingElement.MaxReceivedMessageSize = int.MaxValue;
        httpsBindingElement.KeepAliveEnabled = false;
        httpsBindingElement.AllowCookies = false;

        myBinding.Elements.Add(httpsBindingElement);

        myBinding.CloseTimeout = new TimeSpan(0, 10, 0);
        myBinding.ReceiveTimeout = new TimeSpan(0, 10, 0);
        myBinding.SendTimeout = new TimeSpan(0, 10, 0);

        return myBinding;
    }

        private void ConfigureClientCredentials(ClientCredentials cc)
    {
        if (cc == null) return;

        cc.UserName.UserName = Options.WebserviceUsername;
        cc.UserName.Password = Options.AuthPassword;

        cc.ClientCertificate.Certificate = Options.ClientCertificate;
        cc.ServiceCertificate.DefaultCertificate = Options.IbaCertificate;

        cc.ServiceCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.None;
    }

    private void ConfigureEndPoint(ServiceEndpoint endpoint)
    {
        endpoint.Contract.ProtectionLevel = ProtectionLevel.EncryptAndSign;
        endpoint.EndpointBehaviors.Add(new CustomEndpointBehavior());

    }

Answer 1

第三方SOAP WS在一台服务器（负载均衡器设置）上配置了错误的SSL / chiper，导致了问题 - 所以这在我的代码中不是问题。