.net - SSL 证书验证 - 是否涉及缓存？

Question

案例:

• 几天前，我们的集成合作伙伴错过了更改 SSL 服务器证书的最后期限，该证书的有效期是两天前。
• 发生这种情况时，我们的客户端软件开始抛出异常:“根据验证程序，远程证书无效”。我们的客户端软件是用 .NET 4 编写的，在 Windows Server 2012 上运行。SSL 调用是通过 WCF 堆栈完成的。
• 昨天下午，我们的集成合作伙伴安装了新的有效 SSL 证书。

现在的问题是，我们在客户端仍然遇到相同的异常:“根据验证程序，远程证书无效”。

我的问题:

• SSL 证书验证状态是否以某种方式缓存在客户端上？我们的客户端软件是一个长时间运行的进程，很少重新启动。
• 或者这是 SSL 协议(protocol)的某些固有部分？我不是 SSL 或网络方面的专家，但是 a) 只有在 SSL 握手期间客户端才会检查服务器证书，并且 b) SSL 握手中交换的信息可用于对同一台服务器？如果确实如此，如何定义 SSL 握手的有效期？

更新:我们重启了客户端进程，然后就可以了。对我来说，这表明某些 SSL 服务器证书验证状态缓存在每个进程的客户端上。我仍然非常想了解更多有关此的详细信息:这发生在堆栈的哪个级别？世界文化基金会？ 。网？ Windows API？这缓存了多久？有没有办法调整缓存行为？我可以手动清空缓存吗？这在某处记录了吗？

完整堆栈跟踪:

[E0]: The remote certificate is invalid according to the validation procedure. 
[T0]: System.Security.Authentication.AuthenticationException    at 
System.Net.Security.SslState.StartSendAuthResetSignal(ProtocolToken message, 
AsyncProtocolRequest asyncRequest, Exception exception)     at 
System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, 
AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] 
buffer, AsyncProtocolRequest asyncRequest)     at 
System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)  
   at System.Threading.ExecutionContext.RunInternal(ExecutionContext 
executionContext, ContextCallback callback, Object state, Boolean 
preserveSyncCtx)     at System.Threading.ExecutionContext.Run(ExecutionContext 
executionContext, ContextCallback callback, Object state, Boolean 
preserveSyncCtx)     at System.Threading.ExecutionContext.Run(ExecutionContext 
executionContext, ContextCallback callback, Object state)     at 
System.Net.TlsStream.ProcessAuthentication(LazyAsyncResult result)     at 
System.Net.TlsStream.Write(Byte[] buffer, Int32 offset, Int32 size)     at 
System.Net.ConnectStream.WriteHeaders(Boolean async) [E1]: The underlying 
connection was closed: Could not establish trust relationship for the SSL/TLS 
secure channel. [T1]: System.Net.WebException    at 
System.Net.HttpWebRequest.GetResponse()     at 
System.ServiceModel.Channels.HttpChannelFactory`1.HttpRequestChannel.HttpChannel
Request.WaitForReply(TimeSpan timeout) [E2]: Could not establish trust 
relationship for the SSL/TLS secure channel with authority 
'***removed***'. [T2]: 
System.ServiceModel.Security.SecurityNegotiationException 

Answer 1

我遇到了同样的问题。我正在使用本地根 CA 证书验证 TLS。如果我从商店中删除证书，连续请求(使用 HttpWebRequest)继续验证是否每隔几秒调用一次。但如果我等待的时间很短(30-60 秒)，下一次调用就会失败，因为它找不到根证书。

将 HttpWebRequest.KeepAlive 属性设置为 false 以防止缓存。为了获得更多的控制权，看起来你必须开始反射(reflection)。见问题How to clear the client-side .Net SSL session cache .