且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

IIS下的Https客户端认证失败

更新时间:2023-12-04 12:53:16

本文给了我一个解决问题的思路.
Asp.net检查服务器证书名称"CN = ..."是否与服务器域名匹配.

因此,如果外部服务器的证书不符合该规则,则来自asp.net应用程序的https请求将不信任该连接.因此,如果您没有机会更改外部服务器的配置(第三方),则必须禁用该检查.

可以通过将自定义委托传递给asp.net的(主要是)静态ServicePointManager类来关闭它.

我把它放在了我的https连接器类的静态构造函数中:
(但是将关闭整个应用程序中任何https连接的检查)

This article gave me an idea how to solve the problem.
Asp.net checks whether a server certificate''s name "CN= ..." matches the server''s domain name.

So if the external server''s certificate does not comply to that rule a https request from a asp.net application will not trust the connection. So if you have no chance to change the external server''s configuration (3rd party) you have to disable the check.

It can be switched off by passing a custom delegate to asp.net''s (mainly) static ServicePointManager class.

I put that bit into a static constructor of my https connector-class:
(however that check will be switched off for any https connection in the whole application)

public class MyExternalSslServiceConnector : IMyExternalServiceConnector<br />
{<br />
	 protected string ServiceUrl { get; set; }<br />
	 public X509Certificate2 SslCertificate { get; set; }<br />
<br />
	 static MyExternalSslServiceConnector()<br />
	 {<br />
		  ServicePointManager.ServerCertificateValidationCallback = delegate { return true; };<br />
	 }<br />
<br />
	 public MyExternalSslServiceConnector(string myExternalServiceUrl, X509Certificate2 sslCertificate)<br />
	 {<br />
		  this.ServiceUrl = myExternalServiceUrl;<br />
		  this.SslCertificate = sslCertificate;<br />
	 }<br />
	<br />
	 // further implementation using HttpRequest class [...]<br />
}



亲切的问候C.



Kind regards, C.