c# - 如何自动访问具有 "require client certificates"的 IIS 网站？

Question

我在 IIS6/ASP.NET 网站上工作，该网站必须以智能卡(特别是 Common Access Card)的形式“要求客户端证书”。我需要创建一些服务来访问计时器上的各种 URL，以执行更新搜索索引、预热 Sharepoint 页面和其他任务等操作。

如果您没有智能卡上的证书，网站不允许访问，这怎么办？我尝试加载证书 (.cer) 并像这样加载它:

HttpWebRequest request = (HttpWebRequest)
            WebRequest.Create("https://.../someURL.html");

const string certFilename = @"my.cer";
var cert = X509Certificate2.CreateFromCertFile(certFilename);
cert.Import(certFilename, "my pin", X509KeyStorageFlags.Exportable);
request.ClientCertificates.Add(cert);
HttpWebResponse response = (HttpWebResponse)
       request.GetResponse();

但我得到了 403 禁止。

Answer 1

您可以按如下方式从您的个人商店加载您的证书:

 System.Security.Cryptography.X509Certificates.X509Certificate cert = FindCertByName(PART_AFTER_CN_IN_CERT_SUBJECT);
request.ClientCertificates.Add(cert);

..

        private System.Security.Cryptography.X509Certificates.X509Certificate FindCertByName(string simpleName)
        {
            X509Store store = new X509Store(StoreName.My, StoreLocation.CurrentUser);
            store.Open(OpenFlags.ReadOnly);
            foreach (X509Certificate cert in store.Certificates)
            {
                if( cert.Subject.Contains("CN="+simpleName))
                {
                    return cert;
                }
            }

            string msg = "The '" + simpleName + "' security certificate is not installed on this system!";
            throw new ApplicationException(msg);
        }