SSL/TLS 不适用于 .p7b 证书

Question

我从一些支付提供商生成了客户端证书，我必须在请求他们的 https API 时使用它。我的代码如下所示:

HttpWebRequest request = (HttpWebRequest)WebRequest.Create("https://site/api/requests/");

request.Method = "POST";
request.ContentType = "application/json";
request.ContentLength = Encoding.UTF8.GetByteCount(postDataSerialized);
request.KeepAlive = false;

request.ProtocolVersion = HttpVersion.Version10;

ServicePointManager.Expect100Continue = false;
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls11;
ServicePointManager.ServerCertificateValidationCallback = delegate { return true; };

X509Certificate2Collection certCollection = new X509Certificate2Collection();
certCollection.Import(@"d:\Production Merchant Certificate.p7b");

request.ClientCertificates.AddRange(certCollection);
request.PreAuthenticate = true;


using (StreamWriter os = new StreamWriter(request.GetRequestStream())) //Exception
{
}

而且我总是会遇到两个错误:

Error occured while sending POST (Form) request The underlying connection was closed: An unexpected error occurred on a send. System.IO.IOException: Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host. ---> System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host.

和

The request was aborted: Could not create SSL/TLS secure channel.

如果您能告诉我用证书链发送请求的正确方法是什么，我将不胜感激。

在 Microsoft 管理控制台中，我已将 p7b 添加到本地计算机的个人和中级证书颁发机构，但我仍然遇到这两个错误。

Answer 1

问题是您的客户端证书根本不包含私钥。 PKCS#7 容器(带有 .p7b 文件扩展名)不应存储带有私钥的证书。您需要获取具有对私钥的有效引用的证书对象。证书可以安装在您的个人证书存储区 (CurrentUser\My) 中，或通过导入 PKCS#12(具有 .pfx 或 .p12 文件扩展名)容器安装，该容器应该存储带有私钥的证书。