Question

我正在使用vb .net构建一个Web服务客户端。 Web服务使用ssl，基本身份验证进行保护，还需要客户端证书。所以我在Visual Studio中创建了一个Web引用并提供了凭据：

Dim cred As New System.Net.NetworkCredential("usr", "passwd")
Dim proxy As New SimpleFromLocal.simple
proxy.Credentials = cred

Console.WriteLine(proxy.helloWorld())

只要我关闭服务器端的相互身份验证，这就可以正常工作。我添加了这样的客户端证书：

Dim cert As X509Certificate = X509Certificate.CreateFromCertFile(certFile)
proxy.ClientCertificates.Add(cert)

已加载证书，但Web服务调用失败。我可以发布异常，但它是德语，这本身就是一个问题。它基本上说：身份验证失败，因为远程站点关闭了连接。我尝试在服务器端调试ssl握手，看起来好像没有传输客户端证书。

那我在这里错过了什么？是否需要在本地计算机上安装客户端证书？

修改：引发的错误：

System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send. ---> 
System.IO.IOException: Authentication failed because the remote party has closed the transport stream. 
at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)
at System.Net.TlsStream.CallProcessAuthentication(Object state)
at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
at System.Net.TlsStream.ProcessAuthentication(LazyAsyncResult result)
at System.Net.TlsStream.Write(Byte[] buffer, Int32 offset, Int32 size)
at System.Net.PooledStream.Write(Byte[] buffer, Int32 offset, Int32 size)
at System.Net.ConnectStream.WriteHeaders(Boolean async)
--- End of inner exception stack trace ---
at System.Web.Services.Protocols.WebClientProtocol.GetWebResponse(WebRequest request)
at System.Web.Services.Protocols.HttpWebClientProtocol.GetWebResponse(WebRequest request)
at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
at CCClient.SimpleFromLocal.simple.helloWorld() in C:\TP\CCClient\CCClient\Web References\SimpleFromLocal\Reference.vb:Zeile 90.
at CCClient.Module1.clientWithProxy(NetworkCredential cred, String certFile)
in C:\TP\CCClient\CCClient\Module1.vb:Zeile 53.

Answer 1

最后！

这question让我尝试使用X509Certificate2（请注意班级名称中的 2 ）。我将它用于仅包含单个证书的PKCS＃12密钥库。所以这就是我所做的：

创建密钥库文件

我使用了Java的keytool。创建自签名证书后，需要将其导出为所需格式：

keytool -importkeystore -srckeystore keystore.jks \
        -srcstoretype JKS \
        -destkeystore keystore.pfx \
        -deststoretype PKCS12

注意：将证书导出到文件并直接使用它不起作用。

将客户端证书添加到代理

Dim proxy As New SimpleFromLocal.simple
Dim cred As New NetworkCredential("usr", "passwd")
Dim cert As New X509Certificate2(certFile, "passwd")
proxy.Credentials = cred
proxy.ClientCertificates.Add(cert)

Console.WriteLine(proxy.helloWorld())

就是这样。无论出于何种原因，相同的设置都无法使用X509Certificate。

如何使用客户端证书/相互身份验证调用Web服务？

1 个答案: