Żądanie zostało przerwane: Nie można utworzyć bezpiecznego kanału SSL/TLS

Question

Mój klient poinformował mnie o swoich problemach z ich SSL i Internet Explorerem. Powiedzieli, że mają problemy z zaufaniem podczas uzyskiwania dostępu do adresu URL.

Uzyskuję dostęp do JSON przez HTTPS. Witryna znajduje się na jednym serwerze i korzystam z aplikacji konsoli na moim komputerze lokalnym. Próbuję ominąć certyfikat SSL, jednak mój kod nadal się nie udaje.

Czy mogę zmienić HttpWebRequest, aby rozwiązać ten problem?

otrzymuję ten błąd przy użyciu tego kodu:

// You must change the URL to point to your Web server. 
     HttpWebRequest req = (HttpWebRequest)WebRequest.Create(url); 
     req.Method = "GET"; 
     req.AllowAutoRedirect = true; 

     // allows for validation of SSL conversations 
     ServicePointManager.ServerCertificateValidationCallback = delegate { return true; }; 


     WebResponse respon = req.GetResponse(); 
     Stream res = respon.GetResponseStream(); 

     string ret = ""; 
     byte[] buffer = new byte[1048]; 
     int read = 0; 
     while ((read = res.Read(buffer, 0, buffer.Length)) > 0) 
     { 
      //Console.Write(Encoding.ASCII.GetString(buffer, 0, read)); 
      ret += Encoding.ASCII.GetString(buffer, 0, read); 
     } 
     return ret; 

Answer 1

I włączone rejestrowanie przy użyciu tego kodu:

http://blogs.msdn.com/b/dgorti/archive/2005/09/18/471003.aspx

Dziennik był w folderze bin/debugowania (byłem w trybie debugowania dla mojego app konsoli). Należy dodać typ protokołu zabezpieczeń jako SSL 3

Otrzymałem niezgodność algorytmu w dzienniku. Oto mój nowy kod:

 // You must change the URL to point to your Web server. 
     HttpWebRequest req = (HttpWebRequest)WebRequest.Create(url); 
     req.Method = "GET"; 
     ServicePointManager.SecurityProtocol = SecurityProtocolType.Ssl3; 


     // Skip validation of SSL/TLS certificate 
     ServicePointManager.ServerCertificateValidationCallback = delegate { return true; }; 


     WebResponse respon = req.GetResponse(); 
     Stream res = respon.GetResponseStream(); 

     string ret = ""; 
     byte[] buffer = new byte[1048]; 
     int read = 0; 
     while ((read = res.Read(buffer, 0, buffer.Length)) > 0) 
     { 
      Console.Write(Encoding.ASCII.GetString(buffer, 0, read)); 
      ret += Encoding.ASCII.GetString(buffer, 0, read); 
     } 
     return ret; 

Answer 2

Może to być spowodowane przez kilka rzeczy (najprawdopodobniej najmniej prawdopodobne):

1. certyfikat SSL serwera jest niezaufane przez klient. Najprostszym sprawdzeniem jest wskazanie przeglądarki pod adresem URL i sprawdzenie, czy pojawi się ikona blokady SSL. Jeśli masz blokady, ikony złamane, kliknij na niego aby zobaczyć na czym polega problem:

   1. Przeterminowane daty - uzyskać nowy certyfikat SSL
   2. nazwa nie pasuje - upewnij się, że adres URL używa tego samego serwera nazwa jako certyfikat.
   3. Brak podpisu przez zaufany organ - kup certyfikat od organu takiego jak Verisign lub dodaj certyfikat do zaufanego magazynu certyfikatów klienta.
   4. W środowiskach testowych można zaktualizować weryfikator certyfikatów, aby pominąć sprawdzanie dostępu. Nie rób tego w produkcji.

2. Serwer wymaga certyfikatu SSL klienta - w takim przypadku konieczne będzie zaktualizowanie kodu w celu podpisania żądania za pomocą certyfikatu klienta.

Answer 3

musiałem włączyć inne wersje protokołów bezpieczeństwa, aby rozwiązać ten problem:

ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls 
     | SecurityProtocolType.Tls11 
     | SecurityProtocolType.Tls12 
     | SecurityProtocolType.Ssl3; 

Answer 4

proszę zobaczyć poniżej linku raz. SecurityProtocolType.SsL3 jest już stary.

http://codemust.com/poodle-vulnerability-fix-openssl/

Answer 5

podobne do an existing answer ale w PowerShell:

[System.Net.ServicePointManager]::SecurityProtocol = ` 
[System.Net.SecurityProtocolType]::Tls11 -bor 
[System.Net.SecurityProtocolType]::Tls12 -bor ` 
[System.Net.SecurityProtocolType]::Tls -bor ` 
[System.Net.SecurityProtocolType]::Ssl3 

następnie wywołanie Invoke-WebRequest powinno działać.

Got to od anonimowej informacji zwrotnej, dobra propozycja: prościej napisać to byłoby:

[System.Net.ServicePointManager]::SecurityProtocol = @("Tls12","Tls11","Tls","Ssl3") 

Znaleziony ten fantastyczny i Related Post przez Jaykul: Validating Self-Signed Certificates From .Net and PowerShell

Answer 6

znalazłem typ certyfikatu także wchodzi w grę.

miałem cert, który był:

(wyjście poniżej był w MMC, właściwości certyfikat)

podpis cyfrowy, Klucz szyfrowanie (A0)

(wyjście poniżej pochodził mój kod C# poniżej)

X509Extension.X509KeyUsageExtension.KeyUsages = 'keyEncipherment, digitalSignature' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.CrlSign = 'false' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.DataEncipherment = 'false' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.DecipherOnly = 'false' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.DigitalSignature = 'prawda' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.EncipherOnly = 'false' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.KeyAgreement = 'false' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.KeyCertSign = 'false' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.KeyEncipherment = 'prawda' X509KeyUsageExtension.KeyUsages.X509KeyU sageFlags.None = 'false' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.NonRepudiation = 'false'

wyżej zrobił nie pracy.

===============================

Następnie inny certyfikatu z:

(The poniżej wyjściowy był w MMC właściwości certyfikat)

Podpisywanie certyfikatu, Off-line Podpisywanie CRL, Podpisywanie CRL (06)

(wyjście poniżej było z mojego kodu C# poniżej)

X509Extension.X509KeyUsageExtension.KeyUsages = 'cRLSign, KeyCertSign' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.CrlSign = 'prawda ' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.DataEncipherment =' false' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.DecipherOnly =” false” X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.DigitalSignature = 'false' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.EncipherOnly = 'false' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.KeyAgreement = 'false' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.KeyCertSign = 'prawda ' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.KeyEncipherment =' false' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.None = 'false' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.NonRepudiation = 'false'

i wyszło

poniższy kod pozwoli Ci sprawdzić swoją certyfikat klienta

using System; 
using System.Collections.Generic; 
using System.Linq; 
using System.Security.Cryptography; 
using System.Security.Cryptography.X509Certificates; 
using System.Text; 

namespace MyNamespace 
{ 
    public static class SecurityShower 
    { 
     public static void ShowHttpWebRequest(System.Net.HttpWebRequest hwr) 
     { 
      StringBuilder sb = new StringBuilder(); 
      if (null != hwr) 
      { 
       sb.Append("-----------------------------------------------HttpWebRequest" + System.Environment.NewLine); 
       sb.Append(string.Format("HttpWebRequest.Address.AbsolutePath='{0}'", hwr.Address.AbsolutePath) + System.Environment.NewLine); 
       sb.Append(string.Format("HttpWebRequest.Address.AbsoluteUri='{0}'", hwr.Address.AbsoluteUri) + System.Environment.NewLine); 
       sb.Append(string.Format("HttpWebRequest.Address='{0}'", hwr.Address) + System.Environment.NewLine); 

       sb.Append(string.Format("HttpWebRequest.RequestUri.AbsolutePath='{0}'", hwr.RequestUri.AbsolutePath) + System.Environment.NewLine); 
       sb.Append(string.Format("HttpWebRequest.RequestUri.AbsoluteUri='{0}'", hwr.RequestUri.AbsoluteUri) + System.Environment.NewLine); 
       sb.Append(string.Format("HttpWebRequest.RequestUri='{0}'", hwr.RequestUri) + System.Environment.NewLine); 

       foreach (X509Certificate cert in hwr.ClientCertificates) 
       { 
        sb.Append("START*************************************************"); 
        ShowX509Certificate(sb, cert); 
        sb.Append("END*************************************************"); 
       } 
      } 

      string result = sb.ToString(); 
      Console.WriteLine(result); 
     } 

     public static void ShowCertAndChain(X509Certificate2 cert) 
     { 
      X509Chain chain = new X509Chain(); 
      chain.ChainPolicy.RevocationFlag = X509RevocationFlag.EntireChain; 
      chain.ChainPolicy.RevocationMode = X509RevocationMode.Offline; 
      chain.ChainPolicy.VerificationFlags = X509VerificationFlags.AllFlags; 

      ////chain.ChainPolicy.VerificationFlags = X509VerificationFlags.IgnoreCtlSignerRevocationUnknown && 
      ////X509VerificationFlags.IgnoreRootRevocationUnknown && 
      ////X509VerificationFlags.IgnoreEndRevocationUnknown && 
      ////X509VerificationFlags.IgnoreCertificateAuthorityRevocationUnknown && 
      ////X509VerificationFlags.IgnoreCtlNotTimeValid; 

      chain.Build(cert); 

      ShowCertAndChain(cert, chain); 
     } 

     public static void ShowCertAndChain(X509Certificate cert, X509Chain chain) 
     { 
      StringBuilder sb = new StringBuilder(); 
      if (null != cert) 
      { 
       ShowX509Certificate(sb, cert); 
      } 

      if (null != chain) 
      { 
       sb.Append("-X509Chain(Start)-" + System.Environment.NewLine); 
       ////sb.Append(string.Format("Cert.ChainStatus='{0}'", string.Join(",", chain.ChainStatus.ToList())) + System.Environment.NewLine); 

       foreach (X509ChainStatus cstat in chain.ChainStatus) 
       { 
        sb.Append(string.Format("X509ChainStatus::'{0}'-'{1}'", cstat.Status.ToString(), cstat.StatusInformation) + System.Environment.NewLine); 
       } 

       X509ChainElementCollection ces = chain.ChainElements; 
       ShowX509ChainElementCollection(sb, ces); 
       sb.Append("-X509Chain(End)-" + System.Environment.NewLine); 
      } 

      string result = sb.ToString(); 
      Console.WriteLine(result); 
     } 

     private static void ShowX509Extension(StringBuilder sb, int x509ExtensionCount, X509Extension ext) 
     { 
      sb.Append(string.Empty + System.Environment.NewLine); 
      sb.Append(string.Format("--------X509ExtensionNumber(Start):{0}", x509ExtensionCount) + System.Environment.NewLine); 
      sb.Append(string.Format("X509Extension.Critical='{0}'", ext.Critical) + System.Environment.NewLine); 

      AsnEncodedData asndata = new AsnEncodedData(ext.Oid, ext.RawData); 
      sb.Append(string.Format("Extension type: {0}", ext.Oid.FriendlyName) + System.Environment.NewLine); 
      sb.Append(string.Format("Oid value: {0}", asndata.Oid.Value) + System.Environment.NewLine); 
      sb.Append(string.Format("Raw data length: {0} {1}", asndata.RawData.Length, Environment.NewLine) + System.Environment.NewLine); 
      sb.Append(asndata.Format(true) + System.Environment.NewLine); 

      X509BasicConstraintsExtension basicEx = ext as X509BasicConstraintsExtension; 
      if (null != basicEx) 
      { 
       sb.Append("-X509BasicConstraintsExtension-" + System.Environment.NewLine); 
       sb.Append(string.Format("X509Extension.X509BasicConstraintsExtension.CertificateAuthority='{0}'", basicEx.CertificateAuthority) + System.Environment.NewLine); 
      } 

      X509EnhancedKeyUsageExtension keyEx = ext as X509EnhancedKeyUsageExtension; 
      if (null != keyEx) 
      { 
       sb.Append("-X509EnhancedKeyUsageExtension-" + System.Environment.NewLine); 
       sb.Append(string.Format("X509Extension.X509EnhancedKeyUsageExtension.EnhancedKeyUsages='{0}'", keyEx.EnhancedKeyUsages) + System.Environment.NewLine); 
       foreach (Oid oi in keyEx.EnhancedKeyUsages) 
       { 
        sb.Append(string.Format("------------EnhancedKeyUsages.Oid.FriendlyName='{0}'", oi.FriendlyName) + System.Environment.NewLine); 
        sb.Append(string.Format("------------EnhancedKeyUsages.Oid.Value='{0}'", oi.Value) + System.Environment.NewLine); 
       } 
      } 

      X509KeyUsageExtension usageEx = ext as X509KeyUsageExtension; 
      if (null != usageEx) 
      { 
       sb.Append("-X509KeyUsageExtension-" + System.Environment.NewLine); 
       sb.Append(string.Format("X509Extension.X509KeyUsageExtension.KeyUsages='{0}'", usageEx.KeyUsages) + System.Environment.NewLine); 
       sb.Append(string.Format("X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.CrlSign='{0}'", (usageEx.KeyUsages & X509KeyUsageFlags.CrlSign) != 0) + System.Environment.NewLine); 
       sb.Append(string.Format("X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.DataEncipherment='{0}'", (usageEx.KeyUsages & X509KeyUsageFlags.DataEncipherment) != 0) + System.Environment.NewLine); 
       sb.Append(string.Format("X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.DecipherOnly='{0}'", (usageEx.KeyUsages & X509KeyUsageFlags.DecipherOnly) != 0) + System.Environment.NewLine); 
       sb.Append(string.Format("X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.DigitalSignature='{0}'", (usageEx.KeyUsages & X509KeyUsageFlags.DigitalSignature) != 0) + System.Environment.NewLine); 
       sb.Append(string.Format("X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.EncipherOnly='{0}'", (usageEx.KeyUsages & X509KeyUsageFlags.EncipherOnly) != 0) + System.Environment.NewLine); 
       sb.Append(string.Format("X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.KeyAgreement='{0}'", (usageEx.KeyUsages & X509KeyUsageFlags.KeyAgreement) != 0) + System.Environment.NewLine); 
       sb.Append(string.Format("X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.KeyCertSign='{0}'", (usageEx.KeyUsages & X509KeyUsageFlags.KeyCertSign) != 0) + System.Environment.NewLine); 
       sb.Append(string.Format("X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.KeyEncipherment='{0}'", (usageEx.KeyUsages & X509KeyUsageFlags.KeyEncipherment) != 0) + System.Environment.NewLine); 
       sb.Append(string.Format("X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.None='{0}'", (usageEx.KeyUsages & X509KeyUsageFlags.None) != 0) + System.Environment.NewLine); 
       sb.Append(string.Format("X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.NonRepudiation='{0}'", (usageEx.KeyUsages & X509KeyUsageFlags.NonRepudiation) != 0) + System.Environment.NewLine); 
      } 

      X509SubjectKeyIdentifierExtension skIdEx = ext as X509SubjectKeyIdentifierExtension; 
      if (null != skIdEx) 
      { 
       sb.Append("-X509SubjectKeyIdentifierExtension-" + System.Environment.NewLine); 
       sb.Append(string.Format("X509Extension.X509SubjectKeyIdentifierExtension.Oid='{0}'", skIdEx.Oid) + System.Environment.NewLine); 
       sb.Append(string.Format("X509Extension.X509SubjectKeyIdentifierExtension.SubjectKeyIdentifier='{0}'", skIdEx.SubjectKeyIdentifier) + System.Environment.NewLine); 
      } 

      sb.Append(string.Format("--------X509ExtensionNumber(End):{0}", x509ExtensionCount) + System.Environment.NewLine); 
     } 

     private static void ShowX509Extensions(StringBuilder sb, string cert2SubjectName, X509ExtensionCollection extColl) 
     { 
      int x509ExtensionCount = 0; 
      sb.Append(string.Format("--------ShowX509Extensions(Start):for:{0}", cert2SubjectName) + System.Environment.NewLine); 
      foreach (X509Extension ext in extColl) 
      { 
       ShowX509Extension(sb, ++x509ExtensionCount, ext); 
      } 

      sb.Append(string.Format("--------ShowX509Extensions(End):for:{0}", cert2SubjectName) + System.Environment.NewLine); 
     } 

     private static void ShowX509Certificate2(StringBuilder sb, X509Certificate2 cert2) 
     { 
      if (null != cert2) 
      { 
       sb.Append(string.Format("X509Certificate2.SubjectName.Name='{0}'", cert2.SubjectName.Name) + System.Environment.NewLine); 
       sb.Append(string.Format("X509Certificate2.Subject='{0}'", cert2.Subject) + System.Environment.NewLine); 
       sb.Append(string.Format("X509Certificate2.Thumbprint='{0}'", cert2.Thumbprint) + System.Environment.NewLine); 
       sb.Append(string.Format("X509Certificate2.HasPrivateKey='{0}'", cert2.HasPrivateKey) + System.Environment.NewLine); 
       sb.Append(string.Format("X509Certificate2.Version='{0}'", cert2.Version) + System.Environment.NewLine); 
       sb.Append(string.Format("X509Certificate2.NotBefore='{0}'", cert2.NotBefore) + System.Environment.NewLine); 
       sb.Append(string.Format("X509Certificate2.NotAfter='{0}'", cert2.NotAfter) + System.Environment.NewLine); 
       sb.Append(string.Format("X509Certificate2.PublicKey.Key.KeySize='{0}'", cert2.PublicKey.Key.KeySize) + System.Environment.NewLine); 

       ////List<X509KeyUsageExtension> keyUsageExtensions = cert2.Extensions.OfType<X509KeyUsageExtension>().ToList(); 
       ////List<X509Extension> extensions = cert2.Extensions.OfType<X509Extension>().ToList(); 

       ShowX509Extensions(sb, cert2.Subject, cert2.Extensions); 
      } 
     } 

     private static void ShowX509ChainElementCollection(StringBuilder sb, X509ChainElementCollection ces) 
     { 
      int x509ChainElementCount = 0; 
      foreach (X509ChainElement ce in ces) 
      { 
       sb.Append(string.Empty + System.Environment.NewLine); 
       sb.Append(string.Format("----X509ChainElementNumber:{0}", ++x509ChainElementCount) + System.Environment.NewLine); 
       sb.Append(string.Format("X509ChainElement.Cert.SubjectName.Name='{0}'", ce.Certificate.SubjectName.Name) + System.Environment.NewLine); 
       sb.Append(string.Format("X509ChainElement.Cert.Issuer='{0}'", ce.Certificate.Issuer) + System.Environment.NewLine); 
       sb.Append(string.Format("X509ChainElement.Cert.Thumbprint='{0}'", ce.Certificate.Thumbprint) + System.Environment.NewLine); 
       sb.Append(string.Format("X509ChainElement.Cert.HasPrivateKey='{0}'", ce.Certificate.HasPrivateKey) + System.Environment.NewLine); 

       X509Certificate2 cert2 = ce.Certificate as X509Certificate2; 
       ShowX509Certificate2(sb, cert2); 

       ShowX509Extensions(sb, cert2.Subject, ce.Certificate.Extensions); 
      } 
     } 

     private static void ShowX509Certificate(StringBuilder sb, X509Certificate cert) 
     { 
      sb.Append("-----------------------------------------------" + System.Environment.NewLine); 
      sb.Append(string.Format("Cert.Subject='{0}'", cert.Subject) + System.Environment.NewLine); 
      sb.Append(string.Format("Cert.Issuer='{0}'", cert.Issuer) + System.Environment.NewLine); 

      sb.Append(string.Format("Cert.GetPublicKey().Length='{0}'", cert.GetPublicKey().Length) + System.Environment.NewLine); 

      X509Certificate2 cert2 = cert as X509Certificate2; 
      ShowX509Certificate2(sb, cert2); 
     } 
    } 
}