|
|
想出家的毛豆 · 性能工具-内存篇 - 知乎· 2 年前 · |
|
|
深沉的大白菜 · vue3使用setup语法糖时vscode组 ...· 2 年前 · |
|
|
俊逸的草稿本 · c# - Deserializing ...· 2 年前 · |
|
|
光明磊落的春卷 · 求助:错误1 ...· 2 年前 · |
|
|
欢乐的甜瓜 · 8. Introducing Spring ...· 2 年前 · |
在对远程web服务的web服务请求过程中,我收到以下错误:
无法为SSL/TLS安全通道建立信任关系。-> System.Security.Authentication.AuthenticationException:根据验证流程,远程证书无效。
有什么办法可以忽略这个错误,然后继续吗?
远程证书似乎未签名。
我连接的站点是
www.czebox.cz
-所以请随意访问该站点,请注意,即使是浏览器也会抛出安全异常。
添加证书验证处理程序。返回
true
将允许忽略验证错误:
ServicePointManager
.ServerCertificateValidationCallback +=
(sender, cert, chain, sslPolicyErrors) => true;
失败的原因不是因为它没有签名,而是因为您的客户端不信任根证书。另一种方法是将根CA证书添加到应用程序信任的CA列表中,而不是关闭SSL验证。
这是你的应用当前不信任的根CA证书:
-----BEGIN CERTIFICATE-----
MIIFnDCCBISgAwIBAgIBZDANBgkqhkiG9w0BAQsFADBbMQswCQYDVQQGEwJDWjEs
MCoGA1UECgwjxIxlc2vDoSBwb8WhdGEsIHMucC4gW0nEjCA0NzExNDk4M10xHjAc
BgNVBAMTFVBvc3RTaWdudW0gUm9vdCBRQ0EgMjAeFw0xMDAxMTkwODA0MzFaFw0y
NTAxMTkwODA0MzFaMFsxCzAJBgNVBAYTAkNaMSwwKgYDVQQKDCPEjGVza8OhIHBv
xaF0YSwgcy5wLiBbScSMIDQ3MTE0OTgzXTEeMBwGA1UEAxMVUG9zdFNpZ251bSBS
b290IFFDQSAyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoFz8yBxf
2gf1uN0GGXknvGHwurpp4Lw3ZPWZB6nEBDGjSGIXK0Or6Xa3ZT+tVDTeUUjT133G
7Vs51D6z/ShWy+9T7a1f6XInakewyFj8PT0EdZ4tAybNYdEUO/dShg2WvUyfZfXH
0jmmZm6qUDy0VfKQfiyWchQRi/Ax6zXaU2+X3hXBfvRMr5l6zgxYVATEyxCfOLM9
a5U6lhpyCDf2Gg6dPc5Cy6QwYGGpYER1fzLGsN9stdutkwlP13DHU1Sp6W5ywtfL
owYaV1bqOOdARbAoJ7q8LO6EBjyIVr03mFusPaMCOzcEn3zL5XafknM36Vqtdmqz
iWR+3URAUgqE0wIDAQABo4ICaTCCAmUwgaUGA1UdHwSBnTCBmjAxoC+gLYYraHR0
cDovL3d3dy5wb3N0c2lnbnVtLmN6L2NybC9wc3Jvb3RxY2EyLmNybDAyoDCgLoYs
aHR0cDovL3d3dzIucG9zdHNpZ251bS5jei9jcmwvcHNyb290cWNhMi5jcmwwMaAv
oC2GK2h0dHA6Ly9wb3N0c2lnbnVtLnR0Yy5jei9jcmwvcHNyb290cWNhMi5jcmww
gfEGA1UdIASB6TCB5jCB4wYEVR0gADCB2jCB1wYIKwYBBQUHAgIwgcoagcdUZW50
byBrdmFsaWZpa292YW55IHN5c3RlbW92eSBjZXJ0aWZpa2F0IGJ5bCB2eWRhbiBw
b2RsZSB6YWtvbmEgMjI3LzIwMDBTYi4gYSBuYXZhem55Y2ggcHJlZHBpc3UvVGhp
cyBxdWFsaWZpZWQgc3lzdGVtIGNlcnRpZmljYXRlIHdhcyBpc3N1ZWQgYWNjb3Jk
aW5nIHRvIExhdyBObyAyMjcvMjAwMENvbGwuIGFuZCByZWxhdGVkIHJlZ3VsYXRp
b25zMBIGA1UdEwEB/wQIMAYBAf8CAQEwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQW
BBQVKYzFRWmruLPD6v5LuDHY3PDndjCBgwYDVR0jBHwweoAUFSmMxUVpq7izw+r+
S7gx2Nzw53ahX6RdMFsxCzAJBgNVBAYTAkNaMSwwKgYDVQQKDCPEjGVza8OhIHBv
xaF0YSwgcy5wLiBbScSMIDQ3MTE0OTgzXTEeMBwGA1UEAxMVUG9zdFNpZ251bSBS
b290IFFDQSAyggFkMA0GCSqGSIb3DQEBCwUAA4IBAQBeKtoLQKFqWJEgLNxPbQNN
5OTjbpOTEEkq2jFI0tUhtRx//6zwuqJCzfO/KqggUrHBca+GV/qXcNzNAlytyM71
fMv/VwgL9gBHTN/IFIw100JbciI23yFQTdF/UoEfK/m+IFfirxSRi8LRERdXHTEb
vwxMXIzZVXloWvX64UwWtf4Tvw5bAoPj0O1Z2ly4aMTAT2a+y+z184UhuZ/oGyMw
eIakmFM7M7RrNki507jiSLTzuaFMCpyWOX7ULIhzY6xKdm5iQLjTvExn2JTvVChF
Y+jUu/G0zAdLyeU4vaXdQm1A8AEiJPTd0Z9LAxL6Sq2iraLNN36+NyEK/ts3mPLL
-----END CERTIFICATE-----
您可以使用以下命令解码和查看此证书
IgnoreBadCertificates方法:
//I use a method to ignore bad certs caused by misc errors
IgnoreBadCertificates();
// after the Ignore call i can do what ever i want...
HttpWebRequest request_data = System.Net.WebRequest.Create(urlquerystring) as HttpWebRequest;
and below the Methods we are using...
/// <summary>
/// Together with the AcceptAllCertifications method right
/// below this causes to bypass errors caused by SLL-Errors.
/// </summary>
public static void IgnoreBadCertificates()
System.Net.ServicePointManager.ServerCertificateValidationCallback = new System.Net.Security.RemoteCertificateValidationCallback(AcceptAllCertifications);
/// <summary>
/// In Short: the Method solves the Problem of broken Certificates.
/// Sometime when requesting Data and the sending Webserverconnection
/// is based on a SSL Connection, an Error is caused by Servers whoes
/// Certificate(s) have Errors. Like when the Cert is out of date
/// and much more... So at this point when calling the method,
/// this behaviour is prevented
/// </summary>
/// <param name="sender"></param>
/// <param name="certification"></param>
/// <param name="chain"></param>
/// <param name="sslPolicyErrors"></param>
/// <returns>true</returns>
private static bool AcceptAllCertifications(object sender, System.Security.Cryptography.X509Certificates.X509Certificate certification, System.Security.Cryptography.X509Certificates.X509Chain chain, System.Net.Security.SslPolicyErrors sslPolicyErrors)
return true;
}
为了进一步扩展BIGNUM的post,理想情况下,你需要一个能够模拟你在生产中看到的条件的解决方案,而修改你的代码不会做到这一点,如果你在部署代码之前忘记取出代码,那可能是危险的。
您将需要某种类型的自签名证书。如果你知道你在做什么,你可以使用发布的二进制BIGNUM,但是如果你不知道,你可以去寻找证书。如果你正在使用IIS Express,你已经有一个这样的工具了,你只需要找到它。打开Firefox或任何你喜欢的浏览器,然后转到你的开发网站。您应该能够从URL栏中查看证书信息,并且根据您的浏览器,您应该能够将证书导出到文件中。
接下来,打开MMC.exe,并添加证书管理单元。将证书文件导入受信任的根证书颁发机构存储中,这就是您需要的全部内容。重要的是要确保它进入了那个商店,而不是像“私人”这样的其他商店。如果你不熟悉MMC或证书,有许多网站提供了如何做到这一点的信息。
现在,您的计算机作为一个整体将隐式地信任它自己生成的任何证书,并且您不需要添加代码来专门处理此问题。当您迁移到生产环境时,它将继续工作,前提是您在那里安装了适当的有效证书。不要在生产服务器上这样做-那是不好的,除了服务器本身上的客户端之外,它不会对任何其他客户端起作用。
要在客户端配置中禁用ssl证书验证,请执行以下操作。
<behaviors>
<endpointBehaviors>
<behavior name="DisableSSLCertificateValidation">
<clientCredentials>
<serviceCertificate>
<sslCertificateAuthentication certificateValidationMode="None" />
</serviceCertificate>
</clientCredentials>
</behavior>
如果您直接使用套接字并作为客户端进行身份验证,则Service Point Manager回调方法将不起作用。以下是对我起作用的方法。 请仅使用 进行测试。
var activeStream = new SslStream(networkStream, false, (a, b, c, d) => { return true; });
await activeStream.AuthenticateAsClientAsync("computer.local");
这里的关键是在SSL流的构造函数中提供远程证书验证回调。
允许所有证书是非常强大的,但它也可能是危险的。如果你想只允许有效的证书加上一些特定的证书,可以这样做。
.Net核心:
using (var httpClientHandler = new HttpClientHandler())
httpClientHandler.ServerCertificateCustomValidationCallback = (message, cert, chain, sslPolicyErrors) => {
if (sslPolicyErrors == SslPolicyErrors.None)
return true; //Is valid
if (cert.GetCertHashString() == "99E92D8447AEF30483B1D7527812C9B7B3A915A7")
return true;
return false;
using (var httpClient = new HttpClient(httpClientHandler))
var httpResponse = httpClient.GetAsync("https://example.com").Result;
}
.Net框架:
System.Net.ServicePointManager.ServerCertificateValidationCallback += delegate (
object sender,
X509Certificate cert,
X509Chain chain,
SslPolicyErrors sslPolicyErrors)
if (sslPolicyErrors == SslPolicyErrors.None)
return true; //Is valid
if (cert.GetCertHashString() == "99E92D8447AEF30483B1D7527812C9B7B3A915A7")
return true;
return false;
};
更新:
如何在Chrome中获取
cert.GetCertHashString()
值:
单击地址栏中的
Secure
或
Not Secure
。
然后单击证书->详细信息->指纹并复制值。记住要做
cert.GetCertHashString().ToLower()
。
这段代码对我很有效。我必须添加TLS2,因为这是我感兴趣的网址所使用的。
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
ServicePointManager.ServerCertificateValidationCallback +=
(sender, cert, chain, sslPolicyErrors) => { return true; };
using (var client = new HttpClient())
client.BaseAddress = new Uri(UserDataUrl);
client.DefaultRequestHeaders.Accept.Clear();
client.DefaultRequestHeaders.Accept.Add(new
MediaTypeWithQualityHeaderValue("application/json"));
Task<string> response = client.GetStringAsync(UserDataUrl);
response.Wait();
if (response.Exception != null)
return null;
return JsonConvert.DeserializeObject<UserData>(response.Result);
}
绕过SSL证书....
HttpClientHandler clientHandler = new HttpClientHandler();
clientHandler.ServerCertificateCustomValidationCallback = (sender, cert, chain, sslPolicyErrors) => { return true; };
// Pass the handler to httpclient(from you are calling api)
var client = new HttpClient(clientHandler)
|
|
想出家的毛豆 · 性能工具-内存篇 - 知乎 2 年前 |