我正在为 REST API 编写一个客户端，为了对 API 进行身份验证，我必须使用提供给我的证书。
这段代码如下：
public string GetCustomer(int custId)
{
X509Certificate2 Cert = new X509Certificate2();
Cert.Import(@"C:\users\foo\desktop\api\pubAndPrivateCert.pkcs12", "", X509KeyStorageFlags.PersistKeySet);
ServicePointManager.ServerCertificateValidationCallback += ValidateServerCertificate;
HttpWebRequest req = (HttpWebRequest)WebRequest.Create("https://api.foo.net/api/customer/v1/" + custId);
req.ClientCertificates.Add(Cert);
req.UserAgent = "LOL API Client";
req.Accept = "application/json";
req.Method = WebRequestMethods.Http.Get;
string result = null;
using (HttpWebResponse resp = (HttpWebResponse)req.GetResponse())
{
StreamReader reader = new StreamReader(resp.GetResponseStream());
result = reader.ReadToEnd();
}
return result;
}
每次我发出请求时，都会收到错误 400，当使用 Fiddler 查看响应时，我会收到以下信息
<html>
<head><title>400 No required SSL certificate was sent</title></head>
<body bgcolor="white">
<center><h1>400 Bad Request</h1></center>
<center>No required SSL certificate was sent</center>
<hr><center>nginx/0.6.32</center>
</body>
</html>
我认为它没有理由不发送证书，但解决 SSL 问题并不是很容易。我确实添加了一些调试语句来添加一些细节并停止使用 fiddler，他就是我得到的
这些错误来自 ValidateServerCertificate()
Certificate error: RemoteCertificateChainErrors
NotSignatureValid
The signature of the certificate cannot be verified.
1048576
Unknown error.
这些是引发的 WebException 的错误。
Cought Exception ProtocolError
The remote server returned an error: (400) Bad Request.
BadRequest
<html>
<head><title>400 No required SSL certificate was sent</title></head>
<body bgcolor="white">
<center><h1>400 Bad Request</h1></center>
<center>No required SSL certificate was sent</center>
<hr><center>nginx/0.6.32</center>
</body>
</html>
这是 ValidateServerCertificate() 代码。它始终返回 true 以忽略任何证书错误。
public static bool ValidateServerCertificate(object sender, X509Certificate certificate,X509Chain chain,SslPolicyErrors sslPolicyErrors)
{
if (sslPolicyErrors == SslPolicyErrors.None)
return true;
if (sslPolicyErrors == SslPolicyErrors.RemoteCertificateChainErrors)
{
Console.WriteLine("Certificate error: {0}", sslPolicyErrors);
foreach (var chainstat in chain.ChainStatus)
{
Console.WriteLine("{0}", chainstat.Status);
Console.WriteLine("{0}", chainstat.StatusInformation);
}
return true;
}
Console.WriteLine("Certificate error: {0}", sslPolicyErrors);
// allow this client to communicate with unauthenticated servers.
return true;
}
