Mono https with请求失败，并显示"The authentication or decryption failed“。

Question

我正在制作一个简单的REST客户机，用于我的C#应用程序。在Windows上的.net中，它与http://和https://连接一起工作得很好。在Ubuntu 10.10上的mono 2.6.7 (也是用2.8进行了测试，结果相同)中，只有http://可以工作。Request.GetResponse:// connections在https()方法上抛出此异常：

Unhandled Exception: System.Net.WebException: Error getting response stream (Write: The authentication or decryption has failed.): SendFailure ---> System.IO.IOException: The authentication or decryption has failed. ---> Mono.Security.Protocol.Tls.TlsException: Invalid certificate received from server. Error code: 0xffffffff800b010a
  at Mono.Security.Protocol.Tls.Handshake.Client.TlsServerCertificate.validateCertificates (Mono.Security.X509.X509CertificateCollection certificates) [0x00000] in <filename unknown>:0 
  at Mono.Security.Protocol.Tls.Handshake.Client.TlsServerCertificate.ProcessAsTls1 () [0x00000] in <filename unknown>:0 
  at Mono.Security.Protocol.Tls.Handshake.HandshakeMessage.Process () [0x00000] in <filename unknown>:0 
  at (wrapper remoting-invoke-with-check) Mono.Security.Protocol.Tls.Handshake.HandshakeMessage:Process ()
  at Mono.Security.Protocol.Tls.ClientRecordProtocol.ProcessHandshakeMessage (Mono.Security.Protocol.Tls.TlsStream handMsg) [0x00000] in <filename unknown>:0 
  at Mono.Security.Protocol.Tls.RecordProtocol.InternalReceiveRecordCallback (IAsyncResult asyncResult) [0x00000] in <filename unknown>:0 
  --- End of inner exception stack trace ---
  at Mono.Security.Protocol.Tls.SslStreamBase.AsyncHandshakeCallback (IAsyncResult asyncResult) [0x00000] in <filename unknown>:0 
  --- End of inner exception stack trace ---
  at System.Net.HttpWebRequest.EndGetResponse (IAsyncResult asyncResult) [0x00000] in <filename unknown>:0 
  at System.Net.HttpWebRequest.GetResponse () [0x00000] in <filename unknown>:0 

我还没能找到任何解决这个问题的方法。有谁知道为什么会发生这种情况，以及如何修复它？

同样，这只在Mono中失败，.Net似乎没有任何建立连接的问题。

下面是调用代码：

public JToken DoRequest(string path, params string[] parameters) {
    if(!path.StartsWith("/")) {
        path = "/" + path;
    }
    string fullUrl = url + path + ToQueryString(parameters);

    if(DebugUrls) Console.WriteLine("Requesting: {0}", fullUrl);

    WebRequest request = HttpWebRequest.CreateDefault(new Uri(fullUrl));
    using(WebResponse response = request.GetResponse())
    using(Stream responseStream = response.GetResponseStream()) {
        return ReadResponse(responseStream);
    }
}

Answer 1

Mono默认情况下不信任任何证书，要导入Mozilla受信任的根授权，可以在mozroots.exe所在的mono安装文件夹中运行mozroots --import --quiet

Answer 2

我在Unity (也使用单声道)上遇到了同样的问题，this post帮助我解决了这个问题。

在发出请求之前，只需添加以下行：

ServicePointManager.ServerCertificateValidationCallback = MyRemoteCertificateValidationCallback;

这个方法是：

public bool MyRemoteCertificateValidationCallback(System.Object sender,
    X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
    bool isOk = true;
    // If there are errors in the certificate chain,
    // look at each error to determine the cause.
    if (sslPolicyErrors != SslPolicyErrors.None) {
        for (int i=0; i<chain.ChainStatus.Length; i++) {
            if (chain.ChainStatus[i].Status == X509ChainStatusFlags.RevocationStatusUnknown) {
                continue;
            }
            chain.ChainPolicy.RevocationFlag = X509RevocationFlag.EntireChain;
            chain.ChainPolicy.RevocationMode = X509RevocationMode.Online;
            chain.ChainPolicy.UrlRetrievalTimeout = new TimeSpan (0, 1, 0);
            chain.ChainPolicy.VerificationFlags = X509VerificationFlags.AllFlags;
            bool chainIsValid = chain.Build ((X509Certificate2)certificate);
            if (!chainIsValid) {
                isOk = false;
                break;
            }
        }
    }
    return isOk;
}

Answer 3

使用.NET证书存储(mmc、添加/删除管理单元、证书)来确定是否接受来自远程站点的SSL证书。Windows附带了一组根证书颁发机构和中间证书颁发机构(CA)，它们由Windows Update定期更新。因此，只要证书是由证书库中的CA或CA的后代颁发的(包括最有信誉的商业CA)，您的.NET代码通常会信任该证书。

在Mono中，没有Windows证书存储。Mono有自己的商店。默认情况下，它为空(没有受信任的默认CA)。您需要自己管理这些条目。

看看这里：

• http://www.mono-project.com/FAQ:_Security
• https://raw.github.com/mono/mono/master/mcs/class/Mono.Security/Test/tools/tlstest/tlstest.cs

Firefox点将使您的mono安装在默认安装后信任mozroots.exe信任的所有内容。