c# - X509Certificate.LoadStoreFromFile() : The computer must be trusted for delegation and the current user account must be configured to allow delegation

Question

当通过 AD 帐户登录时，我在尝试在 C# MVC Web 应用程序中加载 p12 证书文件时遇到问题。

我们在加载证书时遇到的错误是:必须信任计算机才能进行委托(delegate)，并且当前用户帐户必须配置为允许委托(delegate)。

加载证书的代码:

ServicePointManager.SecurityProtocol = SecurityProtocolType.Ssl3 | SecurityProtocolType.Tls | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12;

var handler = new WebRequestHandler();

var certificate = new X509Certificate2Collection();
certificate.Import(@"D:\certificate.p12", "password", X509KeyStorageFlags.DefaultKeySet);
handler.ClientCertificates.AddRange(certificate);
handler.ServerCertificateValidationCallback = ValidateServerCertificate;

var client = new HttpClient(handler)
{
    BaseAddress = new Uri(chargeCodeServer)
};

我们在以下行得到一个异常:

certificate.Import(@"D:\certificate.p12", "password", X509KeyStorageFlags.DefaultKeySet);

堆栈跟踪:

The requested operation cannot be completed. The computer must be trusted for delegation and the current user account must be configured to allow delegation.
at System.Security.Cryptography.X509Certificates.X509Certificate2Collection.LoadStoreFromFile(String fileName, String password, UInt32 dwFlags, Boolean persistKeyContainers)
at System.Security.Cryptography.X509Certificates.X509Certificate2Collection.Import(String fileName, String password, X509KeyStorageFlags keyStorageFlags)

相同的代码在控制台应用程序中运行良好。

正在加载证书以通过 https 调用 Web API。

如果需要更多信息，请告诉我。

Answer 1

我有同样的错误，对我来说是这样的:

certificate = new X509Certificate2(keyCertificateFilePath, keyCertificatePassword, X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.Exportable);