c# - SslStream 身份验证在本地系统帐户下失败

Question

我有这个代码:

string certificateFilePath = @"C:\Users\Administrator\Documents\Certificate.pfx";

string certificateFilePassword = "Some Password Here";

X509Certificate clientCertificate = new X509Certificate(certificateFilePath, certificateFilePassword);

TcpClient client = new TcpClient(host, port);

SslStream stream = new SslStream(client.GetStream(), false, (sender, certificate, chain, errors) => true);

X509CertificateCollection clientCertificates = new X509CertificateCollection {clientCertificate};

stream.AuthenticateAsClient(host, clientCertificates, SslProtocols.Tls, false);

当我在控制台应用程序中运行代码时，一切正常，stream.IsAuthenticated 和 stream.IsMutuallyAuthenticated 返回 true 和 stream.LocalCertificate 包含正确的证书对象。

然而，当在 Windows 服务(作为 LOCAL SYSTEM 用户) 中运行完全相同的代码时，尽管 stream.IsAuthenticated 返回 true，stream.IsMutuallyAuthenticated 返回 false 并且 stream.LocalCertificate 返回 null。

在这两种情况下都会发生这种情况，在第一行运行后 clientCertificate 加载正确的证书数据并包含证书的 Subject 和 Issuer< 的正确信息.

我还尝试使用此代码强制 SslStream 选择证书:

string certificateFilePath = @"C:\Users\Administrator\Documents\Certificate.pfx";

string certificateFilePassword = "Some Password Here";

X509Certificate clientCertificate = new X509Certificate(certificateFilePath, certificateFilePassword);

TcpClient client = new TcpClient(host, port);

SslStream stream = new SslStream(client.GetStream(), false, (sender, certificate, chain, errors) => true, (sender, host, certificates, certificate, issuers) => clientCertificate);

X509CertificateCollection clientCertificates = new X509CertificateCollection {clientCertificate};

stream.AuthenticateAsClient(host, clientCertificates, SslProtocols.Tls, false);

但是代码仍然不起作用，stream.IsMutuallyAuthenticated 返回 false 并且 stream.LocalCertificate 返回 null.

这几天我一直在探索这个问题，但我想不通。非常感谢任何帮助。

编辑:使用 WinHttpCertCfg 工具尝试证书后，结果发现与 similar question(s) 不同, LOCAL SYSTEM 帐户已经可以访问目标证书的私钥，如下图所示: 因此问题仍然没有解决。

Answer 1

我终于在使用 X509 类时使代码工作。

这是对我有用的代码:

string host = "The Host";

int port = 777;

string certificateFilePath = @"C:\Users\Administrator\Documents\Certificate.pfx";

string certificateFilePassword = "Some Password Here";

X509Certificate clientCertificate = new X509Certificate(certificateFilePath, certificateFilePassword);

X509Certificate2 clientCertificate2 = new X509Certificate2(clientCertificate); //<== Create a X509Certificate2 object from the X509Certificate which was loaded from the file. The clientCertificate2 loads the proper data

TcpClient client = new TcpClient(host, port);

SslStream stream = new SslStream(client.GetStream(), false, (sender, certificate, chain, errors) => true);

X509CertificateCollection clientCertificates = new X509CertificateCollection { clientCertificate2 }; //<== Using the clientCertificate2 which has loaded the proper data instead of the clientCertificate object

stream.AuthenticateAsClient(host, clientCertificates, SslProtocols.Tls, false);

这样我的代码就可以从系统中找到正确的 X509Store、证书和私钥。

这是我的经验之谈。不过，我在 MSDN 上找不到关于为什么它应该像这样的明确解释。