c# - 检查 WebException 中的证书验证错误

Question

我在 Android 的 Mono 上使用 WebRequests，对于某些服务器，证书验证失败。我已经实现了 ICertificatePolicy(因为从未调用过 ServerCertificateValidationCallback - 可能是 Android 的 Mono 问题？？)如果用户已启用接受应用程序中的所有证书，则返回 true设置。如果用户禁用此设置，我会在出现验证问题时返回 false。在这种情况下，我想显示一条消息，告诉用户发生了证书验证问题。

根据 Problem SSL Certificate C# ，我实现了一个 catch block ，比如

catch (WebException we)
        {   // If SSL throws exception that will be handled here
            if (we.Status == WebExceptionStatus.TrustFailure)
                throw new Exception( "some nice message" );
        }

但事实证明这是无用的，因为 Status 被设置为 SendFailure。异常如何告诉我验证失败？我是否应该检查 InnerException 并找到 TlsException 以检查错误代码是否是 http://msdn.microsoft.com/en-us/library/system.net.icertificatepolicy(v=vs.110).aspx 中列出的代码之一？ ？

你有更好的解决方案吗？

如果我的 ICertificatePolicy 返回 false，这是我得到的异常:

 System.Net.WebException: Error getting response stream (Write: The authentication or decryption has failed.): SendFailure ---> System.IO.IOException: The authentication or decryption has failed. ---> Mono.Security.Protocol.Tls.TlsException: Invalid certificate received from server. Error code: 0xffffffff800b010a
D/KP2A    (17517):   at Mono.Security.Protocol.Tls.Handshake.Client.TlsServerCertificate.RemoteValidation (Mono.Security.Protocol.Tls.ClientContext context, AlertDescription description) [0x00000] in <filename unknown>:0
D/KP2A    (17517):   at Mono.Security.Protocol.Tls.Handshake.Client.TlsServerCertificate.validateCertificates (Mono.Security.X509.X509CertificateCollection certificates) [0x00000] in <filename unknown>:0
D/KP2A    (17517):   at Mono.Security.Protocol.Tls.Handshake.Client.TlsServerCertificate.ProcessAsTls1 () [0x00000] in <filename unknown>:0
D/KP2A    (17517):   at Mono.Security.Protocol.Tls.Handshake.HandshakeMessage.Process () [0x00000] in <filename unknown>:0
D/KP2A    (17517):   at Mono.Security.Protocol.Tls.ClientRecordProtocol.ProcessHandshakeMessage (Mono.Security.Protocol.Tls.TlsStream handMsg) [0x00000] in <filename unknown>:0
D/KP2A    (17517):   at Mono.Security.Protocol.Tls.RecordProtocol.InternalReceiveRecordCallback (IAsyncResult asyncResult) [0x00000] in <filename unknown>:0
D/KP2A    (17517):   --- End of inner exception stack trace ---
D/KP2A    (17517):   at Mono.Security.Protocol.Tls.SslStreamBase.AsyncHandshakeCallback (IAsyncResult asyncResult) [0x00000] in <filename unknown>:0
D/KP2A    (17517):   --- End of inner exception stack trace ---
D/KP2A    (17517):   at System.Net.HttpWebRequest.EndGetResponse (IAsyncResult asyncResult) [0x00000] in <filename unknown>:0
D/KP2A    (17517):   at System.Net.HttpWebRequest.GetResponse () [0x00000] in <filename unknown>:0
D/KP2A    (17517):   at System.Net.WebClient.GetWebResponse (System.Net.WebRequest request) [0x00000] in <filename unknown>:0
D/KP2A    (17517):   at System.Net.WebClient.OpenRead (System.Uri address) [0x00000] in <filename unknown>:0

Answer 1

我找到的唯一解决方案是使用“ToString()”方法检查完整的 ex 堆栈，看看它是否包含一些文本。

    catch(WebException ex)
    {
        string fullExStack = ex.ToString();
        if (fullExStack.Contains(("System.IO.IOException: The authentication or decryption has failed.").ToLower())
            || fullExStack.Contains(("Mono.Security.Protocol.Tls.TlsException: Invalid certificate received from server.").ToLower()))

        {
            // Do Anything you need here
            // like throwing a custom exception
        }
    }