c# - Linux 上的 ClientWebSocket 抛出 AuthenticationException (SSL)

Question

我在 Windows 上运行以下 websocket 客户端代码，一切正常 - 正如预期的那样。但是，如果代码是为 linux-arm 发布并复制到 RaspberryPi3(在 Raspian 下运行)，它将以 AuthenticationException 结束。

csproj文件内容:

  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>netcoreapp2.0</TargetFramework>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="Newtonsoft.Json" Version="10.0.3" />
    <PackageReference Include="System.Net.WebSockets.Client" Version="4.3.1" />
  </ItemGroup>

连接尝试:(抛出异常的点)

private readonly ClientWebSocket _socket;

public ApiConnection()
{
    _socket = new ClientWebSocket();
}

public async Task Connect()
{
    // the uri is like: wss://example.com/ws
    await _socket.ConnectAsync(new Uri(_settings.WebSocketUrl), CancellationToken.None);

    if (_socket.State == WebSocketState.Open)
        Console.WriteLine("connected.");
}

异常堆栈:

System.Net.WebSockets.WebSocketException (0x80004005): Unable to connect to the remote server ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.
         at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
         at System.Net.Security.SslState.StartSendAuthResetSignal(ProtocolToken message, AsyncProtocolRequest asyncRequest, ExceptionDispatchInfo exception)
         at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
         at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
         at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
         at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
         at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
         at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
         at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
         at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
         at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
         at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
         at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
         at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
         at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
         at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
         at System.Net.Security.SslState.PartialFrameCallback(AsyncProtocolRequest asyncRequest)
      --- End of stack trace from previous location where exception was thrown ---
         at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
         at System.Net.Security.SslState.InternalEndProcessAuthentication(LazyAsyncResult lazyResult)
         at System.Net.Security.SslState.EndProcessAuthentication(IAsyncResult result)
         at System.Net.Security.SslStream.EndAuthenticateAsClient(IAsyncResult asyncResult)
         at System.Threading.Tasks.TaskFactory`1.FromAsyncCoreLogic(IAsyncResult iar, Func`2 endFunction, Action`1 endAction, Task`1 promise, Boolean requiresSynchronization)
      --- End of stack trace from previous location where exception was thrown ---
         at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
         at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
         at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
         at System.Net.WebSockets.WebSocketHandle.<ConnectAsyncCore>d__24.MoveNext()
         at System.Net.WebSockets.WebSocketHandle.<ConnectAsyncCore>d__24.MoveNext()
      --- End of stack trace from previous location where exception was thrown ---
         at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
         at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
         at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
         at System.Net.WebSockets.ClientWebSocket.<ConnectAsyncCore>d__16.MoveNext()
      --- End of stack trace from previous location where exception was thrown ---
         at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
         at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
         at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
         at System.Runtime.CompilerServices.TaskAwaiter.GetResult()

目标 websocket 服务器在 Ubuntu 上的 nginx 代理后面运行。我认为问题取决于客户端，因为如果代码在 Windows 上执行，一切正常。

我还尝试将 CA 证书导入 Raspians“证书商店”。没有运气。

更新:
http 连接 (ws://) 也适用于 linux。 WebSocketClient 似乎不信任我的 LetsEncrypt 证书？

Answer 1

当浏览器/客户端不信任服务器向其提供的 SSL 证书时，就会发生这种情况。

要测试，请在浏览器中加载相同网址/同一站点上的网址，您应该会收到警告。

解决证书问题后，警告将消失。

解决 SSL 证书问题的确切过程取决于很多事情，例如......

操作系统、Web 服务器、证书颁发机构、证书提供商门户，因此这里的任何人几乎不可能为您提供有关修复证书问题的具体信息，但话虽如此......

但是在 SE 网络上有一些关于此的通用建议......

https://unix.stackexchange.com/questions/90450/adding-a-self-signed-certificate-to-the-trusted-list

https://unix.stackexchange.com/questions/17748/trust-a-self-signed-pem-certificate

在您的情况下，由于 rasbian 基于 debian，一些标准的 debian 建议可能会有所帮助 ...

在 Debian 中，证书存储位于/etc/ssl/certs/。默认情况下，该目录包含一系列指向由 ca-certificates 包安装的证书的符号链接(symbolic link)(包括由 c_rehash(1) 生成的所需符号链接(symbolic link))和一个 ca-certificates.crt，它是所有这些证书的串联。由 update-ca-certificates(8) 命令管理的所有内容，该命令负责更新符号链接(symbolic link)和 ca-certificates.crt 文件。

将新的 (CA) 证书添加到存储中非常容易，因为 update-ca-certificates(8) 也在/usr/local/share/ca-certificates/中查找文件，管理员只需将在此目录中使用 PEM 格式的新证书(扩展名为 .crt)并以 root 身份运行 update-ca-certificates(8)。系统上的所有应用程序(wget、...)现在都应该信任它。

另一个可能的解决方案可能是“我相信我的代码不会请求错误的 url，所以我会忽略 SSL 证书错误”，你可以用这样的方法来做......

C# Ignore certificate errors?

...但这并不理想，至少它为您提供了解决问题的方法，直到您可以解决问题，最坏的情况下您仍然可以检查，但通过编写您自己的检查代码而不是仅仅返回 true。

最后一点:

我经常发现，无论是什么操作系统，在测试/检查之间做一两次像重启这样简单的事情都可以清除一些您通常不会认为是问题的东西。