在Web服务X509Certificate2验证
-
16-09-2019 - |
题
我开发来检查,如果在XML签名的证书是有效的WCF Web服务。 XML是合格的,有效的X509证书签名。当我运行中的Visual Studio开发环境服务X509Certificate2.Verify()和X509Chain.Build()方法返回TRUE。但是,当我发表我的服务IIS下这些方法返回FALSE。我做错了或缺什么?这是我的验证代码:
public static void VerifyXml(XmlDocument xDoc)
{
// Create a new SignedXml object and pass it
// the XML document class.
SignedXml signedXml = new SignedXml(xDoc);
// Find the "Signature" node and create a new
// XmlNodeList object.
XmlNodeList nodeList = xDoc.GetElementsByTagName("Signature");
// Load the first <signature> node.
signedXml.LoadXml((XmlElement)nodeList[0]);
IEnumerable<KeyInfoX509Data> x509Data = signedXml.KeyInfo.Cast<KeyInfoX509Data>();
KeyInfoX509Data info = x509Data.First<KeyInfoX509Data>();
X509Certificate2 cert = info.Certificates[0] as X509Certificate2;
bool certIsValid = cert.Verify();
// Here I receive TRUE in development environment and FALSE under IIS
if (!certIsValid)
throw new X509Exception("Invalid certificate");
bool chainIsValid = false;
X509Chain chain = new X509Chain();
chain.ChainPolicy.RevocationFlag = X509RevocationFlag.EntireChain;
chain.ChainPolicy.RevocationMode = X509RevocationMode.Online;
chain.ChainPolicy.UrlRetrievalTimeout = new TimeSpan(0, 1, 0);
chain.ChainPolicy.VerificationFlags = X509VerificationFlags.NoFlag;
chainIsValid = chain.Build(cert);
// Here I also receive TRUE in development environment and FALSE under IIS
if (!chainIsValid)
throw new X509Exception("Chain is invalid");
// Check the signature
bool signatureOK = signedXml.CheckSignature(cert, false);
if (!signatureOK)
throw new X509Exception("Signature is invalid");
}
任何想法? 感谢
解决方案
其中位于根证书?我认为ASP.NET将使用本地计算机存储中 - 也许VS开发服务器使用的用户存储并找到根证书有,但ASP.NET是没有找到它?尝试添加的根证书的本地计算机存储
您可以检查X509Chain的状态,以获得更多的细节:
foreach (X509ChainElement element in chain.ChainElements)
{
Console.WriteLine ("Element issuer name: {0}", element.Certificate.Issuer);
Console.WriteLine ("Element certificate valid until: {0}", element.Certificate.NotAfter);
Console.WriteLine ("Element certificate is valid: {0}", element.Certificate.Verify ());
Console.WriteLine ("Element error status length: {0}", element.ChainElementStatus.Length);
Console.WriteLine ("Element information: {0}", element.Information);
Console.WriteLine ("Number of element extensions: {0}{1}", element.Certificate.Extensions.Count, Environment.NewLine);
if (ch.ChainStatus.Length > 1)
{
for (int index = 0; index < element.ChainElementStatus.Length; index++)
{
Console.WriteLine (element.ChainElementStatus[index].Status);
Console.WriteLine (element.ChainElementStatus[index].StatusInformation);
}
}
}
不隶属于 StackOverflow