Could not establish trust relationship for the SSL/TLS secure channel

女爷i 2022-08-08 17:30 152阅读 0赞

贴图   
![这里写图片描述][SouthEast]

知乎：显著提升程序员身心健康和工作效率的装备有哪些？

> 1.  笔记本：   
>     1.[银河舰队 PAVILION 15-bc011TX光暗影精灵2][PAVILION 15-bc011TX_2]   
>     2.[顽石 —FL5900U7500超薄i7（性价比最高）][_FL5900U7500_i7]   
>       
>     
> 2.  键盘：   
>     1.机械键盘：[FILCO 圣手 87键 红轴（日）][FILCO _ 87_]，[樱桃（Cherry）G80-3000 茶轴   
>     （德）][Cherry_G80-3000 _]，[DUCKY   
>     2087S（台）][DUCKY_ 2087S]   
>     2.静电容：[HHKB（日）][HHKB]   
>     3.情怀插入：小黑USB键盘 ThinkPad USB Track Point 键盘 0B47082   
>       
>     
> 3.  显示器：Eizo，戴尔，三星，明基，22寸以上（[AOC C3208VW8 32英寸曲屏][AOC C3208VW8 32]）   
>       
>     
> 4.  PC配置：i7，16G，SSD，双显示器   
>       
>     
> 5.  电脑椅：[Aeron Chair][]（个人经济承受能力下，最贵的）   
>       
>     
> 6.  萌妹纸一枚（多多益善，不过太多小心受用不起）   
>       
>

1.  IDE：
    
        1.Win（Visual Studio）
        2.Linux（Vim，其他真的还有必要说吗？）
        3.Mac（Xcode，CodeRunner，SnippetsLab）
        4.跨平台（Pycharm，UltraEdit，Eclipse，Source Insight，Codeblocks）
        5.插件（Visual Assist X,Pydev）
2.  耳机：   
    1.听音乐：[AKG Q460][]   
    2.玩游戏：[赛睿西伯利亚][Link 1] v1，v2

贴图   
![这里写图片描述][SouthEast 1]

当我在用NET命名空间下获取URL的时候，提示如下错误：

The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.

使用传输安全模式，证书建立SSL，宿主端口证书配置完毕，但是客户调用服务出错。  
  
Could not establish trust relationship for the SSL/TLS secure channel with authority 'computer:9001'.  
不能和授权计算机为 SSL/TLS 安全通道建立信任关系

【1】问题分析：  
       Could not establish trust relationship for the SSL/TLS secure channel with authority 'computer:9001'.  
不能和授权计算机为 SSL/TLS 安全通道建立信任关系.  
       实际原因和证书有很大关系，这里证书是跟证书颁发机构信任的证书，在客户端和服务端建立安全会话的时候，无法信任此证书。  
    另外一个可能的原因是你其他域里也使用此一个证，这个也有可能导致错误。  
【2】解决办法：  
    3.1：**定义一个类，来对远程X.509证书的验证，进行处理，返回为true.我们要自己定义一个类，然后在客户单调用WCF服务之前，执行一次即可**。代码如下：

public   static   class  Util  
     \{  
         ///   <summary>   
         ///  Sets the cert policy.  
         ///   </summary>   
          public   static   void  SetCertificatePolicy()  
         \{  
             ServicePointManager.ServerCertificateValidationCallback  
                        \+=  RemoteCertificateValidate;  
         \}  
  
         ///   <summary>   
         ///  Remotes the certificate validate.  
         ///   </summary>   
          private   static   bool  RemoteCertificateValidate(  
            object  sender, X509Certificate cert,  
             X509Chain chain, SslPolicyErrors error)  
         \{  
             //  trust any certificate!!!   
              System.Console.WriteLine( " Warning, trust any certificate " );  
             return   true ;  
         \}  
     \}

你要在调用操作点先调用这个方法： Util.SetCertificatePolicy();  
                sResult = wcfServiceProxyHttp.SayHello(sName);  
     3.2：就是需要你在客户端和服务端各安装一个跟证书授权机构。然后制作一受信任的根证书机构的证书。可以参考这个：  
[http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%20-%20Create%20and%20Install%20Temporary%20Certificates%20in%20WCF%20for%20Message%20Security%20During%20Development&referringTitle=How%20Tos][http_www.codeplex.com_WCFSecurity_Wiki_View.aspx_title_How_20To_20-_20Create_20and_20Install_20Temporary_20Certificates_20in_20WCF_20for_20Message_20Security_20During_20Development_referringTitle_How_20Tos]

出处：[http://social.microsoft.com/Forums/zh-CN/wcfzhchs/thread/1591a00d-d431-4ad8-bbd5-34950c39d563][http_social.microsoft.com_Forums_zh-CN_wcfzhchs_thread_1591a00d-d431-4ad8-bbd5-34950c39d563]

=============================================================================================================

要使用SSL证书加密，必须要根据证书创建X509Certificate实例，添加到WebService实例的ClientCertificates集合属性中：

string certificateFile = AppDomain.CurrentDomain.BaseDirectory + @"\\certificate.cer";  
System.Security.Cryptography.X509Certificates.X509Certificate certificate =  
System.Security.Cryptography.X509Certificates.X509Certificate.CreateFromCertFile(certificateFile);  
creatinoService.ClientCertificates.Add(certificate);

调用会提示出现:The remote certificate is invalid according to the validation procedure.异常，它的内部异常是WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel。

解决方案,声明一个类：  
using System.Net;  
using System.Security.Cryptography.X509Certificates;  
public class MyPolicy : ICertificatePolicy \{  
public bool CheckValidationResult(  
ServicePoint srvPoint  
, X509Certificate certificate  
, WebRequest request  
, int certificateProblem) \{  
//Return True to force the certificate to be accepted.  
return true;  
\} // end CheckValidationResult  
\} // class MyPolicy  
System.Net.ServicePointManager.CertificatePolicy = new MyPolicy();

但是由于是使用.NET 2.0，它会提示CertificatePolicy 属性已经过期了，可以使用下面的回调方式来替代它：

System.Net.ServicePointManager.ServerCertificateValidationCallback =  
new System.Net.Security.RemoteCertificateValidationCallback(RemoteCertificateValidationCallback);

增加一个静态回调函数 RemoteCertificateValidationCallback：

public static bool RemoteCertificateValidationCallback(  
Object sender,  
X509Certificate certificate,  
X509Chain chain,  
System.Net.Security.SslPolicyErrors sslPolicyErrors  
)  
\{  
//Return True to force the certificate to be accepted.  
return true;  
\}  
以上方法是我从国外的网络上搜集整理出来的。并不是完全是自己的原创。

===========================================================================

用httpwebrequest访问一个SSL类型的地址 [https://xxxx][https_xxxx] 时，报错 “未能为 SSL/TLS 安全通道建立信任关系(Could not establish trust relationship for the SSL/TLS secure channel)”

查了下MSDN，找到了解决方法，SSL网站，连接时需要提供证书，对于非必须提供客户端证书的情况，只要返回一个安全确认 即可。但是此方法的实现，在.NET 1.1 和 .NET 2.0 下是不同的，下面写出2个framework版本下的实现方法：

使用的命名空间：

using System.Net;  
using System.Net.Security;  
using System.Security.Authentication;  
using System.Security.Cryptography.X509Certificates;

public class util  
\{

//.Net 2.0  
    public bool CheckValidationResult(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors errors)  
    \{

//直接确认，否则打不开     
        return true;  
    \}

private void button1\_Click(object sender, EventArgs e)  
    \{  
        ServicePointManager.ServerCertificateValidationCallback = new System.Net.Security.RemoteCertificateValidationCallback(CheckValidationResult);  
        HttpWebRequest req = (HttpWebRequest)WebRequest.CreateDefault(new Uri("[https://zu14.cn/][https_zu14.cn]"));  
        req.Method = "GET";  
        HttpWebResponse res = (HttpWebResponse)req.GetResponse();  
    \}

\}  
//...正常使用了，和访问普通的 http:// 地址一样了

//.Net 1.1  
internal class AcceptAllCertificatePolicy : ICertificatePolicy  
\{

public AcceptAllCertificatePolicy()  
    \{  
    \}

public bool CheckValidationResult(ServicePoint sPoint, System.Security.Cryptography.X509Certificates.X509Certificate cert, WebRequest wRequest, int certProb)  
    \{  
        //直接确认  
        return true;  
    \}

private void button1\_Click(object sender, EventArgs e)  
    \{  
        ServicePointManager.CertificatePolicy = new AcceptAllCertificatePolicy();  
        HttpWebRequest req = (HttpWebRequest)WebRequest.CreateDefault(new Uri("[https://zu14.cn/][https_zu14.cn]"));  
        req.Method = "GET";  
        HttpWebResponse res = (HttpWebResponse)req.GetResponse();

\}  
\}  
//...正常使用了，和访问普通的 http:// 地址一样了

[SouthEast]: /images/20220731/aa7c3268b8fd42af8fadcb175d3aa81b.png
[PAVILION 15-bc011TX_2]: https://s.click.taobao.com/wSZbZJx
[_FL5900U7500_i7]: https://s.click.taobao.com/6neZZJx
[FILCO _ 87_]: https://s.click.taobao.com/RtYXZJx
[Cherry_G80-3000 _]: https://s.click.taobao.com/Cl9XZJx
[DUCKY_ 2087S]: https://s.click.taobao.com/7dwWZJx
[HHKB]: https://s.click.taobao.com/A89WZJx
[AOC C3208VW8 32]: https://s.click.taobao.com/QW3TZJx
[Aeron Chair]: https://s.click.taobao.com/4OcRZJx
[AKG Q460]: https://s.click.taobao.com/rKzQZJx
[Link 1]: https://s.click.taobao.com/LSoPZJx
[SouthEast 1]: /images/20220731/b498ccc2b95647cfbbb857ec2e5c3447.png
[http_www.codeplex.com_WCFSecurity_Wiki_View.aspx_title_How_20To_20-_20Create_20and_20Install_20Temporary_20Certificates_20in_20WCF_20for_20Message_20Security_20During_20Development_referringTitle_How_20Tos]: http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%20-%20Create%20and%20Install%20Temporary%20Certificates%20in%20WCF%20for%20Message%20Security%20During%20Development&referringTitle=How%20Tos
[http_social.microsoft.com_Forums_zh-CN_wcfzhchs_thread_1591a00d-d431-4ad8-bbd5-34950c39d563]: http://social.microsoft.com/Forums/zh-CN/wcfzhchs/thread/1591a00d-d431-4ad8-bbd5-34950c39d563
[https_xxxx]: https://xxxx/
[https_zu14.cn]: https://zu14.cn/