Question

我正在开发一个小型应用程序，该应用程序在小型dotnet核心应用程序和ASP.NET/C#应用程序之间使用SSL进行加密和身份验证。有一次我可以进行此工作，但是自从更新到2.1以来，某种原因导致它失败。这可能是我糟糕的代码，但我不确定。：）

我收到的错误是：未处理的异常：System.Security.Cryptography.CryptographicException：加密操作期间发生错误。在Internal.Cryptography.Pal.OpenSslX509ChainProcessor.MapVerifyErrorToChainStatus（X509VerifyStatusCode代码）处在Internal.Cryptography.Pal.OpenSslX509ChainProcessor.AddElementStatus（X509VerifyStatusCode errorCode，List 1 elementStatus, List 1 totalStatus）中在Internal.Cryptography.Pal.OpenSslX509ChainProcessor.AddElementStatus（List 1 errorCodes, List 1 elementStatus，List 1 overallStatus) at Internal.Cryptography.Pal.OpenSslX509ChainProcessor.BuildChain(X509Certificate2 leaf, HashSet 1个候选对象上，HashSet`1 systemTrusted，OidCollection applicationPolicy，OidCollection certificatePolicy，X509RevocationMode撤销模式，X509RevocationFlag撤销标志，日期和时间验证时间剩余的下载时间）在Internal.Cryptography.Pal.ChainPal.BuildChain处（布尔useMachineContext，ICertificatePal证书，X509Certificate2Collection extraStore，OidCollection applicationPolicy，OidCollection certificatePolicy，X509RevocationMode撤销模式，X509RevocationFlag撤销标志，DateTime验证时间，TimeSpan超时）在System.Security.Cryptography.X509Certificates.X509Chain.Build（X509Certificate2证书，布尔throwOnException）在System.Security.Cryptography.X509Certificates.X509Chain.Build（X509Certificate2证书）在System.Net.Security.CertificateValidation.BuildChainAndVerifyProperties（X509Chain链，X509Certificate2 remoteCertificate，布尔checkCertName，字符串hostName）中在System.Net.Security.SecureChannel.VerifyRemoteCertificate（RemoteCertValidationCallback remoteCertValidationCallback，ProtocolToken＆alertToken）

这似乎在客户端连接时发生，但是我可以通过Wireshk捕获看到TCP和SSL握手已完成。有问题的代码是：

    public void ProcessSecuredIncomingData(object obj)
    {
        Console.WriteLine("processing incoming secure connection");
        var sb = new StringBuilder();
        var cert = new SrvCrypto().GetServerCertificate(_certificate, string.Empty);
        Console.WriteLine(_certificate);
        using (var client = (TcpClient) obj)
        {
            try
            {
                Console.WriteLine("Grabbing data stream");
                using (var sslStream = new SslStream(client.GetStream(), true, ValidateCertificate))
                {
                    Console.WriteLine("Checkin Cert"); //fails after this point
                    sslStream.AuthenticateAsServer(cert, true, SslProtocols.Tls12, true);
                    Console.WriteLine(sslStream.RemoteCertificate.Subject);
                    int i;
                    Console.WriteLine(cert.IssuerName);
                    while ((i = sslStream.ReadByte()) != 0)
                    {
                        sb.Append((char) i);
                    }
                    try
                    {
                        var cmdList = sb.ToString();
                        var response = ProcessClientRequest(cmdList);
                        sslStream.Write(Encoding.ASCII.GetBytes(response), 0, response.Length);
                        sslStream.Close();
                    }
                    catch (IOException)
                    {
                        const string reply = "TIMEOUT";
                        var msg = reply + '\0';
                        sslStream.Write(Encoding.ASCII.GetBytes(msg), 0, msg.Length);
                    }
                }
                Console.WriteLine(sb.ToString());
            }
            catch (AuthenticationException)
            {
                Console.WriteLine(agentMessages.MSG_AGENT_UNAUTHORIZED);
            }
            //catch (CryptographicException)
            //{
            //    Console.WriteLine(agentMessages.MSG_AGENT_CERT_INVALID);
            //}
            finally
            {
                client?.Close();
            }
        }
    }

如果有注释，则将项目配对：

使用Windows CA服务生成证书
证书CA已作为受信任的权限成功添加到Centos 7。
证书被上传到托管dotnet核心应用程序的Centos服务器，并且OpenSSL能够验证双方使用的证书是否受信任。

任何帮助将不胜感激。

dotnet core v2.1中的SSL问题

0 个答案: