.NET - 客户端证书身份验证 - 'Left with 0 client certificates to choose from."

Question

我正在为客户开发一个用 C# 编写的客户端程序。该程序连接到客户使用的服务，该服务需要客户端证书进行身份验证。尝试建立从客户盒子到服务的连接时失败(在下面记录)。我无法直接访问我们尝试连接的服务，因此我会尽我所能在本地进行测试，然后向客户发送一个程序版本以供测试。

一些注意事项:- 我的代码在本地使用客户端和我放在一起的“模拟”服务器的自签名证书。- 我正在使用 HttpWebRequest.ClientCertificates.Add(...) 来设置客户端证书。- 目前我正在使用 ServicePointManager.ServerCertificateValidationCallback 始终接受服务器证书(临时/只是暂时尝试隔离客户端证书问题)。- 客户使用来自 CA 的证书作为他们的客户端证书(即:不是自签名证书)。- 客户端证书存储在我们的程序直接打开的 p12 文件中(不是从 Windows 证书管理器)。- 基于其他一些日志记录，我有客户端证书加载正常并且有私钥。

以下是来自客户系统的日志。我真的不确定如何解释它。这一行似乎很重要:“我们有用户提供的证书。服务器已指定 6 个颁发者。正在寻找与任何颁发者匹配的证书。”这是否意味着客户端证书颁发者需要与服务器指定的颁发者之一相匹配？我怎样才能看到该列表是什么，它似乎不在任何地方的网络跟踪日志中(我可以看到客户端证书颁发者，但看不到服务器期望的颁发者)。

System.Net Warning: 0 : [1272] The Registry value 'Software\Microsoft\Windows NT\CurrentVersion\InstallationType' was either empty or not a string type.
System.Net Information: 0 : [1272] Current OS installation type is 'Unknown'.
System.Net Verbose: 0 : [1272] WebRequest::Create(https://[redacted])
System.Net Verbose: 0 : [1272] HttpWebRequest#27504314::HttpWebRequest(https://[redacted]#-921164489)
System.Net Information: 0 : [1272] RAS supported: True
System.Net Verbose: 0 : [1272] Exiting HttpWebRequest#27504314::HttpWebRequest() 
System.Net Verbose: 0 : [1272] Exiting WebRequest::Create()     -> HttpWebRequest#27504314
System.Net Verbose: 0 : [1272] HttpWebRequest#27504314::GetRequestStream()
System.Net Information: 0 : [1272] Associating HttpWebRequest#27504314 with ServicePoint#46212239
System.Net Information: 0 : [1272] Associating Connection#13256970 with HttpWebRequest#27504314
System.Net Information: 0 : [1272] Connection#13256970 - Created connection from [redacted] to [redacted].
System.Net Information: 0 : [1272] TlsStream#52203868::.ctor(host=[redacted], #certs=1)
System.Net Information: 0 : [1272] Associating HttpWebRequest#27504314 with ConnectStream#72766
System.Net Verbose: 0 : [1272] Exiting HttpWebRequest#27504314::GetRequestStream()  -> ConnectStream#72766
System.Net Verbose: 0 : [1272] ConnectStream#72766::Write()
System.Net Verbose: 0 : [1272] Data from ConnectStream#72766::Write
[redacted (xml)]
System.Net Verbose: 0 : [1272] Exiting ConnectStream#72766::Write() 
System.Net Verbose: 0 : [1272] ConnectStream#72766::Close()
System.Net Verbose: 0 : [1272] Exiting ConnectStream#72766::Close() 
System.Net Verbose: 0 : [1272] HttpWebRequest#27504314::GetResponse()
System.Net Information: 0 : [1272] HttpWebRequest#27504314 - Request: POST [redacted] HTTP/1.1

System.Net Information: 0 : [1272] SecureChannel#5894079::.ctor(hostname=[redacted], #clientCertificates=1, encryptionPolicy=RequireEncryption)
System.Net Information: 0 : [1272] Enumerating security packages:
System.Net Information: 0 : [1272]     Negotiate
System.Net Information: 0 : [1272]     Kerberos
System.Net Information: 0 : [1272]     NTLM
System.Net Information: 0 : [1272]     Schannel
System.Net Information: 0 : [1272]     Microsoft Unified Security Protocol Provider
System.Net Information: 0 : [1272]     WDigest
System.Net Information: 0 : [1272]     DPA
System.Net Information: 0 : [1272]     Digest
System.Net Information: 0 : [1272]     MSN
System.Net Information: 0 : [1272] SecureChannel#5894079 - Attempting to restart the session using the user-provided certificate: [Version]
  V3

[Subject]
  CN=[redacted]
  Simple Name: [redacted]
  DNS Name: [redacted]

[Issuer]
  CN=[redacted]
  Simple Name: [redacted]
  DNS Name: [redacted]

[Serial Number]
  [redacted]

[Not Before]
  5/8/2013 9:34:17 AM

[Not After]
  4/28/2015 9:34:17 AM

[Thumbprint]
  [redacted]

[Signature Algorithm]
  [redacted]

[Public Key]
  Algorithm: RSA
  Length: 2048
  Key Blob: [redacted]
System.Net Information: 0 : [1272] SecureChannel#5894079 - Left with 1 client certificates to choose from.
System.Net Information: 0 : [1272] SecureChannel#5894079 - Trying to find a matching certificate in the certificate store.
System.Net Information: 0 : [1272] SecureChannel#5894079 - Locating the private key for the certificate: [Version]
  V3

[Subject]
  CN=[redacted]
  Simple Name: [redacted]
  DNS Name: [redacted]

[Issuer]
  CN=[redacted]
  Simple Name: [redacted]
  DNS Name: [redacted]

[Serial Number]
  [redacted]

[Not Before]
  5/8/2013 9:34:17 AM

[Not After]
  4/28/2015 9:34:17 AM

[Thumbprint]
  [redacted]

[Signature Algorithm]
  [redacted]

[Public Key]
  Algorithm: RSA
  Length: 2048
  Key Blob: [redacted]
System.Net Information: 0 : [1272] SecureChannel#5894079 - Certificate is of type X509Certificate2 and contains the private key.
System.Net Information: 0 : [1272] AcquireCredentialsHandle(package = Microsoft Unified Security Protocol Provider, intent  = Outbound, scc     = System.Net.SecureCredential)
System.Net Information: 0 : [1272] InitializeSecurityContext(credential = System.Net.SafeFreeCredential_SECURITY, context = (null), targetName = [redacted], inFlags = ReplayDetect, SequenceDetect, Confidentiality, AllocateMemory, InitManualCredValidation)
System.Net Information: 0 : [1272] InitializeSecurityContext(In-Buffer length=0, Out-Buffer length=77, returned code=ContinueNeeded).
System.Net Information: 0 : [1272] InitializeSecurityContext(credential = System.Net.SafeFreeCredential_SECURITY, context = 1e5098:1962c68, targetName = [redacted], inFlags = ReplayDetect, SequenceDetect, Confidentiality, AllocateMemory, InitManualCredValidation)
System.Net Information: 0 : [1272] InitializeSecurityContext(In-Buffers count=2, Out-Buffer length=0, returned code=CredentialsNeeded).
System.Net Information: 0 : [1272] SecureChannel#5894079 - We have user-provided certificates. The server has specified 6 issuer(s). Looking for certificates that match any of the issuers.
System.Net Information: 0 : [1272] SecureChannel#5894079 - Left with 0 client certificates to choose from.
System.Net Information: 0 : [1272] Using the cached credential handle.
System.Net Information: 0 : [1272] InitializeSecurityContext(credential = System.Net.SafeFreeCredential_SECURITY, context = 1e5098:1962c68, targetName = [redacted], inFlags = ReplayDetect, SequenceDetect, Confidentiality, AllocateMemory, InitManualCredValidation)
System.Net Information: 0 : [1272] InitializeSecurityContext(In-Buffers count=2, Out-Buffer length=317, returned code=ContinueNeeded).
System.Net Information: 0 : [1272] InitializeSecurityContext(credential = System.Net.SafeFreeCredential_SECURITY, context = 1e5098:1962c68, targetName = [redacted], inFlags = ReplayDetect, SequenceDetect, Confidentiality, AllocateMemory, InitManualCredValidation)
System.Net Information: 0 : [1272] InitializeSecurityContext(In-Buffers count=2, Out-Buffer length=0, returned code=CertUnknown).
System.Net Error: 0 : [1272] Exception in the HttpWebRequest#27504314:: - The request was aborted: Could not create SSL/TLS secure channel.
System.Net Error: 0 : [1272] Exception in the HttpWebRequest#27504314::GetResponse - The request was aborted: Could not create SSL/TLS secure channel.

Answer 1

Does this mean the client certificate issuer needs to match one of the issuers the server specified?

是的。该服务器端日志消息看起来不标准，就像他们自己编写的一样，因此您可能需要与他们核实。

How can I see what that list is

您可能无法直接执行此操作，但很可能您需要将颁发者证书加载到服务器上的“受信任的颁发者”或“受信任的根授权机构”存储中。