如何解决“无法为具有权限的SSL/TLS安全通道建立信任关系"

问题描述：

我有一个使用 HTTPS 托管在 IIS 7 中的 WCF 服务.当我在 Internet Explorer 中浏览到这个站点时，它的作用就像一个魅力，这是因为我将证书添加到本地根证书颁发机构存储中.

I have a WCF service hosted in IIS 7 using HTTPS. When I browse to this site in Internet Explorer, it works like a charm, this is because I have added the certificate to the local root certificate authority store.

我在一台机器上开发，所以客户端和服务器是同一台机器.该证书是直接从 IIS 7 管理单元自签名的.

I'm developing on 1 machine, so client and server are same machine. The certificate is self-signed directly from IIS 7 management snap in.

我现在不断收到此错误...

I continually get this error now...

无法为具有授权的 SSL/TLS 安全通道建立信任关系.

Could not establish trust relationship for the SSL/TLS secure channel with authority.

...从客户端控制台调用时.

... when called from client console.

我使用findprivatekey 和cacls.exe 手动为自己授予了证书的权限和网络服务.

I manually gave myself permissions and network service to the certificate, using findprivatekey and using cacls.exe.

我尝试使用 SOAPUI 连接到服务，并且成功了，所以这一定是我的客户端应用程序中的问题，该应用程序是基于过去使用 http 的代码.

I tried to connect to the service using SOAPUI, and that works, so it must be an issue in my client application, which is code based on what used to work with http.

我还可以在哪里查看我似乎已经用尽了无法连接的所有可能性?

Where else can I look I seem to have exhausted all possibilities as to why I can't connect?

答

作为一种解决方法，您可以在客户端向 ServicePointManager 的 ServerCertificateValidationCallback 添加处理程序:

As a workaround you could add a handler to the ServicePointManager's ServerCertificateValidationCallback on the client side:

System.Net.ServicePointManager.ServerCertificateValidationCallback +=
    (se, cert, chain, sslerror) =>
        {
            return true;
        };

但请注意，这不是一个好的做法，因为它完全忽略服务器证书并告诉服务点管理器任何证书都可以，这会严重危害客户端安全.您可以改进它并进行一些自定义检查(对于证书名称、哈希等).使用测试证书至少可以规避开发过程中的问题.

but be aware that this is not a good practice as it completely ignores the server certificate and tells the service point manager that whatever certificate is fine which can seriously compromise client security. You could refine this and do some custom checking (for certificate name, hash etc). at least you can circumvent problems during development when using test certificates.

如何解决“无法为具有权限的SSL/TLS安全通道建立信任关系"

相关推荐