如何将x509证书从客户端发送到服务器WebSocketSharp C#

Question

我正在尝试用WebSocketSharp在客户机/服务器之间发送和验证SSL证书

服务器端

wss = new WebSocketServer(IPAddress.Parse("127.0.0.1"), 6070, true);
string _certificatePath = Path.GetDirectoryName(typeof(WSS_Server).Assembly.Location) + "\\cert\\public_privatekey.pfx";
wss.SslConfiguration.ServerCertificate = new X509Certificate2(_certificatePath, "mypass");
wss.SslConfiguration.ClientCertificateRequired = false; // true;
wss.SslConfiguration.CheckCertificateRevocation = false; // true;
wss.SslConfiguration.ClientCertificateValidationCallback = RemoteCertificateValidationCallback;

wss.AddWebSocketService<MyRemoteService>(
"/myservice",
() => new MyRemoteService()
{
    OriginValidator = val =>
    {
        // Check the value of the Origin header, and return true if valid.
        return true;
    },
    CookiesValidator = (req, res) =>
    {
        return true; // If valid.
    }

});

客户端

var ws = new WebSocket("wss://127.0.0.1:6070/myservice/");
string _certificatePath = "\\cert\\public_privatekey.pfx";
X509Certificate2 x509 = new X509Certificate2(_certificatePath, "mypass");
X509CertificateCollection xcol = new X509CertificateCollection();
xcol.Add(x509);

ws.SslConfiguration = new WebSocketSharp.Net.ClientSslConfiguration("127.0.0.1", xcol, System.Security.Authentication.SslProtocols.Default, false);
//ws.SslConfiguration.ClientCertificates = new X509CertificateCollection();
//ws.SslConfiguration.ClientCertificates.Add(x509);

ws.OnOpen += Ws_OnOpen;
ws.OnMessage += Ws_OnMessage;
ws.OnError += Ws_OnError;
ws.OnClose += Ws_OnClose;
ws.Connect();

在服务器端，RemoteCertificateValidationCallback证书和链总是空。

就像客户从来不发证书一样。

知道怎么解决吗？

Answer 1

这里的答案对我都没有用。为了使它正常工作，我需要使用一个适当的值来设置SslConfiguration.ClientCertificateSelectionCallback，如下所示：

X509Certificate2 cert = new X509Certificate2(fileName, "", X509KeyStorageFlags.MachineKeySet);
ws.SslConfiguration.ClientCertificateSelectionCallback =
            (sender,targethost,localCertificates, remoteCertificate,acceptableIssuers) =>
            {
                return cert;
            };

实际上，SslConfiguration.ClientCertificateSelectionCallback在WebsocketSharp源代码中明确声明：

获取或设置用于选择要提供给服务器的证书的回调。如果回调返回空，则不提供证书。..。默认值是调用的委托，该方法只返回空。

因此，如果您没有在此回调中显式提供客户端证书，则不会发送证书。

Answer 2

您可以始终在WebSocketSharp中设置或获取包含客户端证书的集合。

要做到这一点，您可以在X509Certificate2中添加ClientCertificates对象。

给你：

var ws = new WebSocket("wss://127.0.0.1:6070/myservice/");
string _certificatePath = "\\cert\\public_privatekey.pfx";
X509Certificate2 x509 = new X509Certificate2(_certificatePath, "mypass");    
ws.SslConfiguration.ClientCertificates.Add(x509);
ws.Connect();

然后，可以在服务器端验证此证书。希望这将是你问题的答案。

Answer 3

我也遇到了同样的问题

X509Certificate2 cert = new X509Certificate2(fileName, "", X509KeyStorageFlags.MachineKeySet);
ws.SslConfiguration.ClientCertificates = new X509CertificateCollection() { };
ws.SslConfiguration.ClientCertificates.Add(cert);