一些 HTTPS 域在单声道中失败

Question

我有一些 HTTPS 域，无论我做什么，Mono 都无法加载其内容。

我正在 OSX 10.11.X 上编译和运行以下代码

using System;
using System.IO;
using System.Net;
using System.Net.Security;
using System.Security.Cryptography.X509Certificates;

class MainClass
{
    public static bool Validator (object sender, X509Certificate certificate, X509Chain chain,
                                      SslPolicyErrors sslPolicyErrors)
    {
        return true;
    }

    public static void Main (string[] args)
    {
        ServicePointManager.ServerCertificateValidationCallback = Validator;
        WebRequest wr = WebRequest.Create (args [0]);
        Stream stream = wr.GetResponse ().GetResponseStream ();
        Console.WriteLine (new StreamReader (stream).ReadToEnd ());
    }
}

使用以下命令编译代码

mcs test.cs /r:System.dll /r:Mono.Security.dll

并在此通过例如调用http s://davidwalsh.name来执行

mono tlstest.exe https://davidwalsh.name

即使我已确定我接受证书是什么，它也会失败并显示此消息

Unhandled Exception:
System.Net.WebException: Error: SendFailure (Error writing headers) ---> System.Net.WebException: Error writing headers ---> System.IO.IOException: The authentication or decryption has failed. ---> Mono.Security.Protocol.Tls.TlsException: The authentication or decryption has failed.
  at Mono.Security.Protocol.Tls.RecordProtocol.EndReceiveRecord (IAsyncResult asyncResult) <0x37e5fb8 + 0x000e3> in <filename unknown>:0
  at Mono.Security.Protocol.Tls.SslClientStream.SafeEndReceiveRecord (IAsyncResult ar, Boolean ignoreEmpty) <0x37e5f10 + 0x0001f> in <filename unknown>:0
  at Mono.Security.Protocol.Tls.SslClientStream.NegotiateAsyncWorker (IAsyncResult result) <0x37da130 + 0x0019b> in <filename unknown>:0
  --- End of inner exception stack trace ---
  at System.Net.WebConnection.EndWrite (System.Net.HttpWebRequest request, Boolean throwOnError, IAsyncResult result) <0x37e7408 + 0x00183> in <filename unknown>:0
  at System.Net.WebConnectionStream+<SetHeadersAsync>c__AnonStorey1.<>m__0 (IAsyncResult r) <0x37e6e50 + 0x000eb> in <filename unknown>:0
  --- End of inner exception stack trace ---
  --- End of inner exception stack trace ---
  at System.Net.HttpWebRequest.EndGetResponse (IAsyncResult asyncResult) <0x1e97358 + 0x00187> in <filename unknown>:0
  at System.Net.HttpWebRequest.GetResponse () <0x1e8c208 + 0x0004c> in <filename unknown>:0
  at MainClass.Main (System.String[] args) <0x727f88 + 0x00082> in <filename unknown>:0
[ERROR] FATAL UNHANDLED EXCEPTION: System.Net.WebException: Error: SendFailure (Error writing headers) ---> System.Net.WebException: Error writing headers ---> System.IO.IOException: The authentication or decryption has failed. ---> Mono.Security.Protocol.Tls.TlsException: The authentication or decryption has failed.
  at Mono.Security.Protocol.Tls.RecordProtocol.EndReceiveRecord (IAsyncResult asyncResult) <0x37e5fb8 + 0x000e3> in <filename unknown>:0
  at Mono.Security.Protocol.Tls.SslClientStream.SafeEndReceiveRecord (IAsyncResult ar, Boolean ignoreEmpty) <0x37e5f10 + 0x0001f> in <filename unknown>:0
  at Mono.Security.Protocol.Tls.SslClientStream.NegotiateAsyncWorker (IAsyncResult result) <0x37da130 + 0x0019b> in <filename unknown>:0
  --- End of inner exception stack trace ---
  at System.Net.WebConnection.EndWrite (System.Net.HttpWebRequest request, Boolean throwOnError, IAsyncResult result) <0x37e7408 + 0x00183> in <filename unknown>:0
  at System.Net.WebConnectionStream+<SetHeadersAsync>c__AnonStorey1.<>m__0 (IAsyncResult r) <0x37e6e50 + 0x000eb> in <filename unknown>:0
  --- End of inner exception stack trace ---
  --- End of inner exception stack trace ---
  at System.Net.HttpWebRequest.EndGetResponse (IAsyncResult asyncResult) <0x1e97358 + 0x00187> in <filename unknown>:0
  at System.Net.HttpWebRequest.GetResponse () <0x1e8c208 + 0x0004c> in <filename unknown>:0
  at MainClass.Main (System.String[] args) <0x727f88 + 0x00082> in <filename unknown>:0

而mozroots --import --ask-remove也无济于事，无论如何都会抛出异常。

我还有一些其他 HTTPS 域也失败了：

• http s://christian.panton.org
• http s://penny-arcade.com
• http s://rigeligtsmor.dk

而且我似乎无法找到为什么这些域失败的模式，即使我正在接受所有内容。

我查看了http://www.mono-project.com/docs/faq/security/ 或http://www.mono-project.com/archived/usingtrustedrootsrespectfully/ 并在网上搜索了它，但到目前为止没有成功。

我最接近的是这个 http://stackoverflow.com/questions/9733750/mono-certificate-issue-with-https-httpwebrequest，但这是在 *nix 而不是 OSX 中。类似的帖子 http://answers.unity3d.com/questions/792342/how-to-validate-ssl-certificates-when-using-httpwe.html 和 http://stackoverflow.com/questions/4926676/mono-webrequest- https 失败

这个小程序在 Windows 上运行良好，那是因为 Windows 拥有我需要的所有根证书。

也许你们中的一些人知道这个问题的解决方案，但我有一种感觉，没有人知道如何解决这个问题。

Answer 1

您列为失败的域都需要Server Name Indication (SNI)。我的猜测是您的 Mono 未知版本 尚不支持 SNI。如果是这种情况，仅添加更多 CA 证书将无济于事，因为此问题与证书验证无关。

根据this bugreport，Mono 至少应该从 3.0.10 版本开始支持 SNI，但在 2.x 中不支持，因此您可以检查您正在运行的版本。