C#。证书。系统.NotSupportedException

Question

我正在创建客户端-服务器应用程序。

服务器代码:

public sealed class SslTcpServer {
    static X509Certificate serverCertificate = null;
    public static void RunServer(string certificate) {
        serverCertificate = new X509Certificate2(certificate, "123", X509KeyStorageFlags.MachineKeySet);
        TcpListener listener = new TcpListener(IPAddress.Parse("127.0.0.1"), 56748);
        listener.Start();
        while (true) {
            Console.WriteLine("Waiting for a client to connect...");
            TcpClient client = listener.AcceptTcpClient();
            ProcessClient(client);
        }
    }
    static void ProcessClient(TcpClient client) {
        SslStream sslStream = new SslStream(client.GetStream());
        try {
            sslStream.AuthenticateAsServer(serverCertificate,
                clientCertificateRequired: false, 
                checkCertificateRevocation: true);

            sslStream.ReadTimeout = 5000;
            sslStream.WriteTimeout = 5000;
            Console.WriteLine("Waiting for client message...");
            string messageData = ReadMessage(sslStream);
            Console.WriteLine("Received: {0}", messageData);

            byte[] message = Encoding.UTF8.GetBytes("Hello from the server.<EOF>");
            Console.WriteLine("Sending hello message.");
            sslStream.Write(message);
        } catch (AuthenticationException e) {
            Console.WriteLine("Exception: {0}", e.Message);
            if (e.InnerException != null) {
                Console.WriteLine("Inner exception: {0}", e.InnerException.Message);
            }
            Console.WriteLine("Authentication failed - closing the connection.");
            sslStream.Close();
            client.Close();
            return;
        } finally {
            sslStream.Close();
            client.Close();
        }
    }
    static string ReadMessage(SslStream sslStream) {
        byte[] buffer = new byte[2048];
        StringBuilder messageData = new StringBuilder();
        int bytes = -1;
        do {
            bytes = sslStream.Read(buffer, 0, buffer.Length);
            Decoder decoder = Encoding.UTF8.GetDecoder();
            char[] chars = new char[decoder.GetCharCount(buffer, 0, bytes)];
            decoder.GetChars(buffer, 0, bytes, chars, 0);
            messageData.Append(chars);
            if (messageData.ToString().IndexOf("<EOF>") != -1)
                break;
        } while (bytes != 0);

        return messageData.ToString();
    }
    public static int Main(string[] args) {
        string certificate = "server.crt";
        RunServer(certificate);
        return 0;
    }
}

客户代码:

public class SslTcpClient {
    private static Hashtable certificateErrors = new Hashtable();

    public static bool ValidateServerCertificate(
          object sender,
          X509Certificate certificate,
          X509Chain chain,
          SslPolicyErrors sslPolicyErrors) {
        if (sslPolicyErrors == SslPolicyErrors.None)
            return true;

        Console.WriteLine("Certificate error: {0}", sslPolicyErrors);

        return false;
    }
    public static void RunClient(string machineName, string serverName) {
        TcpClient client = new TcpClient("127.0.0.1", 56748);
        Console.WriteLine("Client connected.");
        SslStream sslStream = new SslStream(
            client.GetStream(),
            false,
            new RemoteCertificateValidationCallback(ValidateServerCertificate),
            null
            );
        try {
            sslStream.AuthenticateAsClient("127.0.0.1");
        } catch (AuthenticationException e) {
            Console.WriteLine("Exception: {0}", e.Message);
            Console.WriteLine(e.StackTrace);
            if (e.InnerException != null) {
                Console.WriteLine("Inner exception: {0}", e.InnerException.Message);
            }
            Console.WriteLine("Authentication failed - closing the connection.");
            client.Close();
            return;
        }
        byte[] messsage = Encoding.UTF8.GetBytes("Hello from the client.<EOF>");
        sslStream.Write(messsage);
        sslStream.Flush();
        string serverMessage = ReadMessage(sslStream);
        Console.WriteLine("Server says: {0}", serverMessage);
        client.Close();
        Console.WriteLine("Client closed.");
    }
    static string ReadMessage(SslStream sslStream) {
        byte[] buffer = new byte[2048];
        StringBuilder messageData = new StringBuilder();
        int bytes = -1;
        do {
            bytes = sslStream.Read(buffer, 0, buffer.Length);
            Decoder decoder = Encoding.UTF8.GetDecoder();
            char[] chars = new char[decoder.GetCharCount(buffer, 0, bytes)];
            decoder.GetChars(buffer, 0, bytes, chars, 0);
            messageData.Append(chars);
            if (messageData.ToString().IndexOf("<EOF>") != -1) {
                break;
            }
        } while (bytes != 0);

        return messageData.ToString();
    }
    public static int Main(string[] args) {
        string serverCertificateName = "127.0.0.1";
        string machineName = "127.0.0.1";
        SslTcpClient.RunClient(machineName, serverCertificateName);
        return 0;
    }
}

我已经创建了 SSL 证书“server.crt”，但我无法将用户连接到服务器。

我有一个未处理的异常:

System.NotSupportedException: The server mode SSL must use a certificate with the associated private key.

Answer 1

异常告诉您您还需要服务器证书的私钥，因为 SSL 服务器需要它来解密客户端生成的 session key 。现在，话虽如此，您传递给 RunServer 方法的证书是 Server.crt，它只是一个公共(public)证书(即它没有关联的私钥)。如果您自己生成了此证书，您还应该生成一个 server.p12 或 server.pfx 文件(其中也有私钥)，然后从中创建一个 X509Certificate。像这样的..

var certificate = new X509Certificate("server.pfx", "password_of_the_private_key");