c# - 无法为 SSL/TLS 建立安全通道

Question

我有 WCF 服务，它被设置为使用这样的服务器和客户端证书:

     ServiceHostFactory.CreateService<MyAppClientService>($"https://localhost:{serverSettings.SmartCardSSLPort}/MyApp5Service/Sll")
                        .UseProtobuf()
                        .AddServiceBehavior(new CustomServiceBehavior_ClientService())
                        .AddAuthorizationPolicy(new CustomAuthorizationPolicy_ClientService())
                        .UseSecureConnection(environmentSettings.SecureConnection)
                        .UseThrottling()
                        .Start(EndpointService.CreateNetHttpsBinding(true));
                    await ServiceHandler.RegisterClientServiceToConsul(MyAppServices.ClientServer_Smartcard, serverSettings.SmartCardSSLPort);

public ServiceHostBuilder<T> UseSecureConnection(SecureConnectionSettings settings)
        {
            if (settings != null && settings.Enabled)
            {
                Console.WriteLine("Setting certificates");
                X509Store store = new X509Store(settings.CertificateStore, settings.CertificateLocation);
                store.Open(OpenFlags.ReadOnly);
                X509Certificate2Collection certs = store.Certificates.Find(X509FindType.FindByThumbprint, settings.Thumbprint, true);
                store.Close();

                if (certs.Count > 0)
                {
                    _serviceHost.Credentials.ServiceCertificate.SetCertificate(settings.CertificateLocation,
                    settings.CertificateStore, X509FindType.FindByThumbprint, settings.Thumbprint);
                }
                else
                    throw new Exception("Could not find certificate with thumbprint " + settings.Thumbprint);
            }
            return this;
        }

public static NetHttpsBinding CreateNetHttpsBinding(bool requiredClientCertificate = false)
        {
            var binding = new NetHttpsBinding();
            SetBindingSettings(binding);
            binding.Security = new BasicHttpsSecurity();
            binding.Security.Mode = BasicHttpsSecurityMode.Transport;
            binding.Security.Transport = new HttpTransportSecurity();

            if (requiredClientCertificate)
                binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.Certificate;
            else
                binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.None;

            return binding;
        }

客户端像这样创建 channel :

private async Task<ChannelFactory<T>> CreateChannelFactory(LoginTypeBase loginType, OrbitToken token)
        {
            var service = await _ConsulService.GetServiceBlocking(loginType.OrbitServicesToUse, forceRefresh: true, token: new CancellationTokenSource(TimeSpan.FromSeconds(30)).Token);

            if (service == null)
                throw new OrbitServiceCommunicationException();

            var cert = loginType.ClientCertificate;
            var uri = loginType.GetOrbitClientServiceURL(service.Address, service.Port);

            var header = AddressHeader.CreateAddressHeader(nameof(OrbitToken), nameof(OrbitToken), token);
            var endpointAddress = new EndpointAddress(uri, header);

            ServiceEndpoint serviceEndpoint = null;
            if (loginType.LoginType == LoginType.SmartCard || loginType.LoginType == LoginType.UsernamePasswordSLL)
            {
                var binding = new NetHttpsBinding("netHttpsBinding");
                binding.Security.Mode = BasicHttpsSecurityMode.Transport;
                if (loginType.LoginType == LoginType.SmartCard)
                    binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.Certificate;
                else
                    binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.None;

                serviceEndpoint = new ServiceEndpoint(ContractDescription.GetContract(typeof(T)), binding, endpointAddress);
            }
            else
            {
                var binding = new NetHttpBinding("netHttpBinding");
                serviceEndpoint = new ServiceEndpoint(ContractDescription.GetContract(typeof(T)), binding, endpointAddress);
            }

            serviceEndpoint.EndpointBehaviors.Add(new ProtoEndpointBehavior());
            serviceEndpoint.EndpointBehaviors.Add(new CustomMessageInspectorBehavior());


            var v = new ChannelFactory<T>(serviceEndpoint);
            if (loginType.LoginType == LoginType.SmartCard)
            {
                v.Credentials.ClientCertificate.Certificate = cert;
                //v.Credentials.ClientCertificate.SetCertificate(StoreLocation.CurrentUser, StoreName.My, X509FindType.FindByThumbprint, cert.Thumbprint);
            }
            return v;
        }

当智能卡插入读卡器时，第三方程序会将证书从这张卡复制到本地存储。

我的应用程序将捕获此更改并将其中一个证书用作客户端证书。

上面的代码第一次运行良好。当客户端首次调用该服务时，第三方程序将询问用户的 PIN，如果这是有效的，则通信将继续。

问题是，如果我移除智能卡然后将其放回原位，我会在下一次服务调用完成时获得 SSL/TLS 吗？此时我还没有创建新 channel ，而是使用与移除卡之前相同的 channel 。

是 .NET 中发生了什么事情还是我的第三方软件阻止了我？也许我必须在删除证书然后重新放入后创建一个新 channel ？

这是我得到的异常示例:

System.ServiceModel.Security.SecurityNegotiationException: Could not establish secure channel for SSL/TLS with authority '139.107.245.141:44310'. ---> System.Net.WebException: The request was aborted: Could not create SSL/TLS secure channel. at System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult)
at System.ServiceModel.Channels.HttpChannelFactory1.HttpRequestChannel.HttpChannelAsyncRequest.CompleteGetResponse(IAsyncResult result) --- End of inner exception stack trace --- at MyApp.Client.Main.Classes.Controllers.ErrorHandler.UnwrapAgentException(Exception exception) in C:\MyApp\Produkter\MyApp Utveckling\Solution\MyApp.Client.Main\Classes\Controllers\ErrorHandler.cs:line 35 at MyApp.Client.Main.ServiceManagement.ServiceAgents.AkutlistanAgent.GetAkutListan(List1 orgEnhetList, List1 tooltipKeys, List1 userItems) in C:\Myapp\Produkter\Myapp Utveckling\Solution\Myapp.Client.Main\Classes\Service Management\Service Agents\AkutlistanAgent.cs:line 88 at Myapp.Client.Main.GUI.Akutlista.ucAkutLista.buildGrid() in C:\Myapp\Produkter\Myapp Utveckling\Solution\Myapp.Client.Main\GUI\Akutlista\ucAkutLista.cs:line 550 at Myapp.Client.Main.GUI.Akutlista.ucAkutLista.SetArbetsstalle(List1 orgEnhetList) in C:\Myapp\Produkter\Myapp Utveckling\Solution\Myapp.Client.Main\GUI\Akutlista\ucAkutLista.cs:line 1742 at Myapp.Client.Main.GUI.Akutlista.ucAkutLista.OrgEnhetList_EditValueChanged(Object sender, EventArgs e) in C:\Myapp\Produkter\Myapp Utveckling\Solution\Myapp.Client.Main\GUI\Akutlista\ucAkutLista.cs:line 1828 at System.EventHandler.Invoke(Object sender, EventArgs e)<br/> at DevExpress.XtraEditors.Repository.RepositoryItem.RaiseEditValueChangedCore(EventArgs e) at DevExpress.XtraEditors.Repository.RepositoryItem.RaiseEditValueChanged(EventArgs e) at DevExpress.XtraEditors.BaseEdit.RaiseEditValueChanged() at DevExpress.XtraEditors.BaseEdit.OnEditValueChanged() at DevExpress.XtraEditors.TextEdit.OnEditValueChanged() at DevExpress.XtraEditors.BaseEdit.OnEditValueChanging(ChangingEventArgs e) at DevExpress.XtraEditors.TextEdit.OnEditValueChanging(ChangingEventArgs e) at DevExpress.XtraEditors.BaseEdit.set_EditValue(Object value)<br/> at Myapp.Client.Main.GUI.Akutlista.ucAkutLista.SetActiveOrganisationEnhet(List1 organisationsEnhetList, List`1 prioriteringsGruppList) in C:\Myapp\Produkter\Myapp Utveckling\Solution\Myapp.Client.Main\GUI\Akutlista\ucAkutLista.cs:line 1731 at Myapp.Client.Main.GUI.Akutlista.ucAkutLista.LoadControl() in C:\Myapp\Produkter\Myapp Utveckling\Solution\Myapp.Client.Main\GUI\Akutlista\ucAkutLista.cs:line 395 at Myapp.Client.Main.GUI.Planering.ucOversiktsTabControl.loadPage() in C:\Myapp\Produkter\Myapp Utveckling\Solution\Myapp.Client.Main\GUI\Planering\ucOversiktsTabControl.cs:line 703 at Myapp.Client.Main.GUI.Planering.ucOversiktsTabControl..ctor() in C:\Myapp\Produkter\Myapp Utveckling\Solution\Myapp.Client.Main\GUI\Planering\ucOversiktsTabControl.cs:line 68 at Myapp.Client.Main.GUI.Planering.frmPlaneringsOversikt.InitializeComponent() in C:\Myapp\Produkter\Myapp Utveckling\Solution\Myapp.Client.Main\GUI\Planering\frmPlaneringsOversikt.Designer.cs:line 180 at Myapp.Client.Main.GUI.Planering.frmPlaneringsOversikt..ctor() in C:\Myapp\Produkter\Myapp Utveckling\Solution\Myapp.Client.Main\GUI\Planering\frmPlaneringsOversikt.cs:line 147 at Myapp.Client.Main.GUI.Planering.frmPlaneringsOversikt.OpenForm() in C:\Myapp\Produkter\Myapp Utveckling\Solution\Myapp.Client.Main\GUI\Planering\frmPlaneringsOversikt.cs:line 112 at Myapp.Client.Main.GUI.frmMainMyapp.OpenPlaningOverview() in C:\Myapp\Produkter\Myapp Utveckling\Solution\Myapp.Client.Main\GUI\frmMainMyapp.cs:line 2265
at Myapp.Client.Main.GUI.frmMainMyapp.navBarItemPlanering_LinkClicked(Object sender, NavBarLinkEventArgs e) in C:\Myapp\Produkter\Myapp Utveckling\Solution\Myapp.Client.Main\GUI\frmMainMyapp.cs:line 619
at DevExpress.XtraNavBar.NavBarItem.RaiseLinkEvent(Object linkEvent, NavBarItemLink link) at DevExpress.XtraNavBar.NavBarItem.RaiseLinkClicked(NavBarItemLink link) at DevExpress.XtraNavBar.NavBarItem.RaiseLinkClickedCore(NavBarItemLink link) at DevExpress.XtraNavBar.NavBarControl.RaiseLinkClicked(NavBarItemLink link) at DevExpress.XtraNavBar.ViewInfo.NavBarViewInfo.DoLinkClick(NavBarHitInfo hitInfo) at DevExpress.XtraNavBar.ViewInfo.NavBarViewInfo.DoClick(NavBarHitInfo hitInfo) at DevExpress.XtraNavBar.ViewInfo.NavigationPaneViewInfo.DoClick(NavBarHitInfo hitInfo) at DevExpress.XtraNavBar.ViewInfo.NavBarViewInfo.OnMouseUp(MouseEventArgs e) at DevExpress.XtraNavBar.NavBarControl.OnMouseUp(MouseEventArgs ev) at System.Windows.Forms.Control.WmMouseUp(Message& m, MouseButtons button, Int32 clicks) at System.Windows.Forms.Control.WndProc(Message& m) at DevExpress.XtraNavBar.NavBarControl.WndProc(Message& m) at System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m) at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m) at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)

编辑:我有一个关于 MS WinInet 的提示可能是问题，要克服它我需要重新启动应用程序或以某种方式重置 MS WinInet？

Answer 1

您检查过您的防火墙设置了吗？如果是这样，则值得检查是否打开了正确的端口以进行通信。