使用 SslStream 时验证自签名证书的链

Question

我有一个 chain.pem

-----BEGIN CERTIFICATE-----
// My server cert signed by intemediate CA
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
// My intermediate cert signed by root CA
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
// My self signed root cert
-----END CERTIFICATE-----

还有一个server.key.pem

-----BEGIN RSA PRIVATE KEY-----
// Private key for server cert
-----END RSA PRIVATE KEY-----

从那里，我生成了一个 pfx 文件 - 它包含服务器证书及其私钥以及链的其余部分。

openssl pkcs12 -export -out certificate.pfx -inkey server.key.pem -in chain.pem

我将导出密码留空

接下来我使用 SslStream 托管一个 TcpListener

namespace fun_with_ssl
{
    internal class Program
    {
        public static int Main(string[] args)
        {
            var serverCertificate = new X509Certificate2("certificate.pfx");
            var listener = new TcpListener(IPAddress.Any, 1443);
            listener.Start();

            while (true)
            {
                using (var client = listener.AcceptTcpClient())
                using (var sslStream = new SslStream(client.GetStream(), false))
                {
                    sslStream.AuthenticateAsServer(serverCertificate, false, SslProtocols.Tls12, false);
                    //send/receive from the sslStream
                }
            }
        }
    }
}

但是当我尝试从 openssl 检查链时，它失败了

openssl s_client -connect 127.0.0.1:1443 -CAfile ca.cert.pem

CONNECTED(00000005)
depth=0 CN = SERVER
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = SERVER
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
 0 s:CN = SERVER
   i:CN = Intermediate
---
Server certificate
-----BEGIN CERTIFICATE-----
// My Server certificate
-----END CERTIFICATE-----
subject=CN = SERVER

issuer=CN = Intermediate

---
No client certificate CA names sent
Client Certificate Types: RSA sign, DSA sign, ECDSA sign
Requested Signature Algorithms: RSA+SHA256:RSA+SHA384:RSA+SHA1:ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA1:DSA+SHA1:RSA+SHA512:ECDSA+SHA512
Shared Requested Signature Algorithms: RSA+SHA256:RSA+SHA384:RSA+SHA1:ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA1:DSA+SHA1:RSA+SHA512:ECDSA+SHA512
Peer signing digest: SHA256
Peer signature type: RSA
Server Temp Key: ECDH, P-384, 384 bits
---
SSL handshake has read 1439 bytes and written 481 bytes
Verification error: unable to verify the first certificate
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: E82C0000B86186D0051CFE6290C12F0D62C4D376B7E40437029B8B85687C4B18
    Session-ID-ctx:
    Master-Key: 13681EAE940F241726072A4586A96A9FEEEF29B8309B9122FA2F07AC7C9F949128CB66D0F9C430E1D2480E61E287C578
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1566533377
    Timeout   : 7200 (sec)
    Verify return code: 21 (unable to verify the first certificate)
    Extended master secret: yes
---
140266287337920:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../ssl/record/rec_layer_s3.c:1528:SSL alert number 46

我似乎没有提供中间证书或根证书，以便它可以验证链。我在这里错过了什么？

在我的场景中，客户端将拥有根证书公钥。

Answer 1

• 即使 PFX 包含整个链，使用单证书构造函数也使其仅加载具有私钥的证书，其余的被丢弃。
• 即使使用 load-the-PFX-as-a-collection 方法，SslStream 也仅使用集合来查找可接受的服务器证书（具有私钥和正确的 EKU 值），然后忽略其余部分。

只有当 X509Chain 可以通过系统环境上下文找到中间证书时，才会发送中间证书。如果您的证书不是公共信任证书，那么您的方案的最佳答案是将中间（以及可选的根）添加到 CurrentUser\CA (X509StoreName.CertificateAuthority) 证书存储区。 “CA”存储不提供信任，它只是系统所看到的所有中间颁发者 CA 的抓包，系统在构建新链时将其用作缓存。

您可以在启动时以编程方式执行此操作

X509Certificate2 serverCertificate = null;

using (X509Store store = new X509Store(StoreName.CertificateAuthority, StoreLocation.CurrentUser))
{
    store.Open(OpenFlags.ReadWrite);

    X509Certificate2Collection coll = new X509Certificate2Collection();
    coll.Import("certificate.pfx");

    foreach (X509Certificate2 cert in coll)
    {
        if (cert.HasPrivateKey)
        {
            // Maybe apply more complex logic if you really expect multiple private-key certs.
            if (serverCertificate == null)
            {
                serverCertificate = cert;
            }
            else
            {
                cert.Dispose();
            }
        }
        else
        {
            // This handles duplicates (as long as no custom properties have been applied using MMC)
            store.Add(cert);
            cert.Dispose();
        }
    }
}

// tcpListener, et al.

其他选项：将整个集合输入 X509Chain.ChainPolicy.ExtraStore，在 serverCert 上调用 X509Chain.Build，仅在第一个证书之后添加证书（也可以选择不添加最后一个证书）...仅取决于有多少额外的东西预计将在 PFX 中。