c# - 请求被中止 : Could not create SSL/TLS secure channel - IllegalMessage

Question

我在 SO 上看到了几个关于这个主题的类似问题，但似乎没有一个答案真正有助于解决它。

我需要通过证书身份验证访问客户网络服务。在出现提示时选择正确的证书后，使用 SoapUI 和 chrome 可以正常工作。但是我无法通过 IE、WCF 客户端(不是我自己的，也不是 WcfTestClient)访问该服务。操作系统为Windows server 2012 R2，协议(protocol)TLS 1.2

我一直在调查事件、跟踪日志，也花了很多时间分析 wireshark 捕获，但我被卡住了。这是我的

事件日志:

已生成致命警报并将其发送到远程端点。这可能会导致连接终止。 TLS 协议(protocol)定义的 fatal error 代码为 10。Windows SChannel 错误状态为 12。

跟踪日志:

我会省略不感兴趣的部分，只显示相关的部分。

System.Net Information: 0 : [12208] Connection#11144211 - Created connection 
  from 192.168.3.13:53514 to 145.119.167.109:443.
System.Net Information: 0 : [12208] TlsStream#3957675::.ctor(host=aaa.bbb.eu, #certs=1)
System.Net Information: 0 : [12208] Associating HttpWebRequest#37368736 with ConnectStream#35619075
.
.
.
System.Net Information: 0 : [12208] 
SecureChannel#52136226::.ctor(hostname=aaa.bbb.eu, #clientCertificates=1, encryptionPolicy=RequireEncryption)
System.Net Information: 0 : [12208] Enumerating security packages:
System.Net Information: 0 : [12208]     Negotiate
System.Net Information: 0 : [12208]     NegoExtender
System.Net Information: 0 : [12208]     Kerberos
System.Net Information: 0 : [12208]     NTLM
System.Net Information: 0 : [12208]     TSSSP
System.Net Information: 0 : [12208]     pku2u
System.Net Information: 0 : [12208]     WDigest
System.Net Information: 0 : [12208]     Schannel
System.Net Information: 0 : [12208]     Microsoft Unified Security Protocol Provider
System.Net Information: 0 : [12208]     CREDSSP
System.Net Information: 0 : [12208] SecureChannel#52136226 - Attempting to restart the session using the user-provided certificate:  [HERE GOES DATA ABOUT CERTIFICATE]
.
.
.
System.Net Information: 0 : [12208] SecureChannel#52136226 - Left with 1 client certificates to choose from.
System.Net Information: 0 : [12208] SecureChannel#52136226 - Trying to find a matching certificate in the certificate store.
System.Net Information: 0 : [12208] SecureChannel#52136226 - Locating the private key for the certificate:  [HERE GOES DATA ABOUT CERTIFICATE]
.
.
.
System.Net Information: 0 : [12208] SecureChannel#52136226 - Certificate is of type X509Certificate2 and contains the private key.
System.Net Information: 0 : [12208] AcquireCredentialsHandle(package = Microsoft Unified Security Protocol Provider, intent  = Outbound, scc     = System.Net.SecureCredential)
System.Net Information: 0 : [12208] InitializeSecurityContext(credential = System.Net.SafeFreeCredential_SECURITY, context = (null), targetName = aaa.bbb.eu, inFlags = ReplayDetect, SequenceDetect, Confidentiality, AllocateMemory, InitManualCredValidation)
System.Net Information: 0 : [12208] InitializeSecurityContext(In-Buffer length=0, Out-Buffer length=161, returned code=ContinueNeeded).

然后是一些传入的消息，带有

System.Net.Sockets Verbose: 0 : [12208] Exiting Socket#33189039::Receive()  -> Int32#2516
System.Net Information: 0 : [12208] InitializeSecurityContext(credential = System.Net.SafeFreeCredential_SECURITY, context = cb00f8:7980678, targetName = aaa.bbb.eu, inFlags = ReplayDetect, SequenceDetect, Confidentiality, AllocateMemory, InitManualCredValidation)
System.Net Information: 0 : [12208] InitializeSecurityContext(In-Buffers count=2, Out-Buffer length=0, returned code=ContinueNeeded).
System.Net.Sockets Verbose: 0 : [12208] Socket#33189039::Receive()
System.Net.Sockets Verbose: 0 : [12208] Data from Socket#33189039::Receive

介于两者之间。最后，问题。

System.Net.Sockets Verbose: 0 : [12208] Exiting Socket#33189039::Receive()  -> Int32#2839
System.Net Information: 0 : [12208] InitializeSecurityContext(credential = System.Net.SafeFreeCredential_SECURITY, context = cb00f8:7980678, targetName = aaa.bbb.eu, inFlags = ReplayDetect, SequenceDetect, Confidentiality, AllocateMemory, InitManualCredValidation)
System.Net Information: 0 : [12208] InitializeSecurityContext(In-Buffers count=2, Out-Buffer length=0, returned code=IllegalMessage).
System.Net.Sockets Verbose: 0 : [12208] Socket#33189039::Dispose()
System.Net Error: 0 : [12208] Exception in HttpWebRequest#37368736:: - The request was aborted: Could not create SSL/TLS secure channel..
System.Net Error: 0 : [12208] Exception in HttpWebRequest#37368736::GetResponse - The request was aborted: Could not create SSL/TLS secure channel..

因此，显然，我有足够的权利成功读取和使用提供的客户端证书(这对 Chrome 和 SoapUI 来说很好)。当通过 Wireshark 检查网络流量时，会出现 Client Hello 和 Server Hello，然后是 Certificate 和 Server Key Exchange 消息。然后有很多来自服务器的可能没有正确解码的数据包(被 Wireshark 标记为加密握手消息，从内容来看它似乎是一些证书)，最后是来 self 的客户端的 ACK RST 数据包。

任何可能导致这种情况的想法将不胜感激。

编辑:添加客户端代码和配置

客户端代码:

ServicePointManager.SetTcpKeepAlive(true, 10000, 1000);
ServicePointManager.Expect100Continue = true;
ServicePointManager.SecurityProtocol =  SecurityProtocolType.Tls12;

try
{
    client = new IncidentBrokerPortTypeClient("gms_endpoint");   
    client.EchoRequest(new EchoRequest());             
}
catch (Exception ex)
{
     MessageBox.Show(ex.Message + Environment.NewLine + ex.InnerException);
}

配置:

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
 <startup> 
    <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6.1" />
 </startup>
 <system.serviceModel>
  <bindings>
   <basicHttpsBinding>
    <binding name="HttpsBasicBinding">
      <security mode="Transport" >
         <transport clientCredentialType="Certificate"/> 
      </security>
    </binding>  
 </basicHttpsBinding>
</bindings> 
<client>
  <endpoint
     name ="gms_endpoint"
     address="https://aaa.bbb.eu/"
     binding="basicHttpsBinding"
     bindingConfiguration="HttpsBasicBinding"
     contract="SomeNamespace.IncidentBrokerPortType"
     behaviorConfiguration="GmsBehavior"
      />
</client>
 <behaviors>
     <endpointBehaviors>
        <behavior name="GmsBehavior">               
            <clientCredentials>
                <clientCertificate x509FindType="FindByThumbprint" 
findValue="5c1dd5c93d1854cb2d698451e1d2a78a3d94dcb0" 
storeLocation="LocalMachine"/>
            </clientCredentials>                
        </behavior>
   </endpointBehaviors>
  </behaviors>
 </system.serviceModel>
</configuration>

Answer 1

Enable strong cryptography in .NET Framework 4.5 or higher

我们遇到了一个问题，导致堆栈跟踪末尾出现相同的 IllegalMessage。对我们来说，结果是我们域上的组策略更新禁用了较旧且较弱的 SSL 和 TLS 协议(protocol)。默认情况下未启用更强的加密，导致握手失败。我们的解决方法是为报告错误的服务器在注册表中添加两个条目:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319] "SchUseStrongCrypto"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319] "SchUseStrongCrypto"=dword:00000001