我正在尝试连接到使用自签名SSL证书的API。我使用的是.NET的HttpWebRequest和HttpWebResponse对象。我得到了一个例外:
基础连接已关闭:无法为SSL/TLS安全通道建立信任关系。
我明白这意味着什么。我理解为什么.NET认为它应该警告我并关闭连接。但在这种情况下,我只想连接到API,中间人攻击是可恶的。
那么,如何为这个自签名证书添加一个例外呢?或者是告诉HttpWebRequest/Response根本不验证证书的方法?我该怎么做呢?
发布于 2009-02-09 00:51:08
@Domster:这是可行的,但您可能希望通过检查证书散列是否符合您的期望来加强一点安全性。因此,扩展版本看起来有点像这样(基于我们正在使用的一些实时代码):
static readonly byte[] apiCertHash = { 0xZZ, 0xYY, ....};
/// <summary>
/// Somewhere in your application's startup/init sequence...
/// </summary>
void InitPhase()
{
// Override automatic validation of SSL server certificates.
ServicePointManager.ServerCertificateValidationCallback =
ValidateServerCertficate;
}
/// <summary>
/// Validates the SSL server certificate.
/// </summary>
/// <param name="sender">An object that contains state information for this
/// validation.</param>
/// <param name="cert">The certificate used to authenticate the remote party.</param>
/// <param name="chain">The chain of certificate authorities associated with the
/// remote certificate.</param>
/// <param name="sslPolicyErrors">One or more errors associated with the remote
/// certificate.</param>
/// <returns>Returns a boolean value that determines whether the specified
/// certificate is accepted for authentication; true to accept or false to
/// reject.</returns>
private static bool ValidateServerCertficate(
object sender,
X509Certificate cert,
X509Chain chain,
SslPolicyErrors sslPolicyErrors)
{
if (sslPolicyErrors == SslPolicyErrors.None)
{
// Good certificate.
return true;
}
log.DebugFormat("SSL certificate error: {0}", sslPolicyErrors);
bool certMatch = false; // Assume failure
byte[] certHash = cert.GetCertHash();
if (certHash.Length == apiCertHash.Length)
{
certMatch = true; // Now assume success.
for (int idx = 0; idx < certHash.Length; idx++)
{
if (certHash[idx] != apiCertHash[idx])
{
certMatch = false; // No match
break;
}
}
}
// Return true => allow unauthenticated server,
// false => disallow unauthenticated server.
return certMatch;
}
发布于 2009-02-09 00:07:28
原来,如果您只想完全禁用证书验证,您可以更改ServicePointManager上的ServerCertificateValidationCallback,如下所示:
ServicePointManager.ServerCertificateValidationCallback = delegate { return true; };
这将验证所有证书(包括无效证书、过期证书或自签名证书)。
发布于 2013-02-28 04:35:47
请注意,在SSL4.5中,您可以覆盖每个HttpWebRequest本身的.NET验证(而不是通过影响所有请求的全局委托):
HttpWebRequest request = (HttpWebRequest)HttpWebRequest.Create(uri);
request.ServerCertificateValidationCallback = delegate { return true; };
https://stackoverflow.com/questions/526711
复制相似问题