.net 无法为具有“*”权限的 SSL/TLS 建立安全通道
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/4463485/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Could not establish secure channel for SSL/TLS with authority '*'
提问by Casper Broeren
I must consume a PHP webservice which has a SSL certificate. My .net 3.5 Class library references the webservice with 'Add Service references' in Visualstudio 2010 (WCF right?).
我必须使用具有 SSL 证书的 PHP 网络服务。我的 .net 3.5 类库在 Visualstudio 2010 中使用“添加服务引用”引用了 Web 服务（WCF 对吗？）。
When calling the main method of the webservice I receive;
当调用我收到的 webservice 的 main 方法时；
Could not establish secure channel for SSL/TLS with authority '{base_url_of_WS}'.
无法为具有权限“{base_url_of_WS}”的 SSL/TLS 建立安全通道。
I tried a lot, like
我尝试了很多，比如
System.Net.ServicePointManager.ServerCertificateValidationCallback = new RemoteCertificateValidationCallback(CheckValidationResult);
public bool CheckValidationResult(Object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
return true;
}
But It wouldn't work. Also I have the certificate installed on my own machine.
但这行不通。此外，我在自己的机器上安装了证书。
*Extra info; When I use the wsdl location in 'Add service reference' the same error occurs. Before I tried it, I worked with a static wsdl.
*额外信息；当我在“添加服务引用”中使用 wsdl 位置时，会发生同样的错误。在尝试之前，我使用了静态 wsdl。
采纳答案by Graham
Yes an Untrusted certificate can cause this. Look at the certificate path for the webservice by opening the websservice in a browser and use the browser tools to look at the certificate path. You may need to install one or more intermediate certificates onto the computer calling the webservice. In the browser you may see "Certificate errors" with an option to "Install Certificate" when you investigate further - this could be the certificate you missing.
是的，不受信任的证书会导致这种情况。通过在浏览器中打开 websservice 来查看 webservice 的证书路径，并使用浏览器工具查看证书路径。您可能需要在调用 Web 服务的计算机上安装一个或多个中间证书。在浏览器中，当您进一步调查时，您可能会看到“证书错误”和“安装证书”选项 - 这可能是您丢失的证书。
My particular problem was a Geotrust Geotrust DV SSL CA intermediate certificate missing following an upgrade to their root server in July 2010
我的特殊问题是 Geotrust Geotrust DV SSL CA 中间证书在 2010 年 7 月升级到根服务器后丢失
https://knowledge.geotrust.com/support/knowledge-base/index?page=content&id=AR1422
https://knowledge.geotrust.com/support/knowledge-base/index?page=content&id=AR1422
回答by MICHA
This was exact the problem I was facing. At some other article I got a hint to change the configuration. For me this works:
这正是我面临的问题。在其他一些文章中，我得到了更改配置的提示。对我来说这有效：
<bindings>
<basicHttpBinding>
<binding name="xxxBinding">
<security mode="Transport">
<transport clientCredentialType="Certificate"/>
</security>
</binding>
</basicHttpBinding>
</bindings>
回答by Tod Birdsall
Problem
问题
I was running into the same error message while calling an third party API from my ASP.NET Core MVC project.
从我的 ASP.NET Core MVC 项目调用第三方 API 时，我遇到了相同的错误消息。
Could not establish secure channel for SSL/TLS with authority '{base_url_of_WS}'.
无法为具有权限“{base_url_of_WS}”的 SSL/TLS 建立安全通道。
Solution
解决方案
It turned out that the third party API's server required TLS 1.2. To resolve this issue, I added the following line of code to my controller's constructor:
结果证明第三方 API 的服务器需要 TLS 1.2。为了解决这个问题，我在控制器的构造函数中添加了以下代码行：
System.Net.ServicePointManager.SecurityProtocol = System.Net.SecurityProtocolType.Tls12;
回答by Robert Williams
We had this issue on a new webserver from .aspx pages calling a webservice. We had not given permission to the app pool user to the machine certificate. The issue was fixed after we granted permission to the app pool user.
我们在来自 .aspx 页面的新网络服务器上遇到了这个问题，调用了网络服务。我们没有向应用程序池用户授予机器证书的权限。在我们向应用程序池用户授予权限后，该问题已得到解决。
回答by Perspicace
Ensure you run Visual Studio as an administrator.
确保以管理员身份运行 Visual Studio。
回答by trebor74
In case it helps anyone else, using the new Microsoft Web Service Reference Provider tool, which is for .NET Standard and .NET Core, I had to add the following lines to the binding definition as below:
如果它对其他人有帮助，使用适用于 .NET Standard 和 .NET Core的新 Microsoft Web 服务引用提供程序工具，我必须将以下几行添加到绑定定义中，如下所示：
binding.Security.Mode = BasicHttpSecurityMode.Transport;
binding.Security.Transport = new HttpTransportSecurity{ClientCredentialType = HttpClientCredentialType.Certificate};
This is effectively the same as Micha's answer but in code as there is no config file.
这实际上与 Micha 的答案相同，但在代码中没有配置文件。
So to incorporate the binding with the instantiation of the web service I did this:
因此，为了将绑定与 Web 服务的实例化结合起来，我这样做了：
System.ServiceModel.BasicHttpBinding binding = new System.ServiceModel.BasicHttpBinding();
binding.Security.Mode = System.ServiceModel.BasicHttpSecurityMode.Transport;
binding.Security.Transport.ClientCredentialType = System.ServiceModel.HttpClientCredentialType.Certificate;
var client = new WebServiceClient(binding, GetWebServiceEndpointAddress());
Where WebServiceClient is the proper name of your web service as you defined it.
其中 WebServiceClient 是您定义的 Web 服务的正确名称。
回答by Stanley
Here is what fixed for me:
这是为我解决的问题：
1) Make sure you are running Visual Studio as Administrator
1) 确保您以管理员身份运行 Visual Studio
2) Install and run winhttpcertcfg.exe to grant access
2) 安装并运行 winhttpcertcfg.exe 授予访问权限
https://msdn.microsoft.com/en-us/library/windows/desktop/aa384088(v=vs.85).aspx
https://msdn.microsoft.com/en-us/library/windows/desktop/aa384088(v=vs.85).aspx
The command is similar to below: (enter your certificate subject and service name)
该命令类似于以下内容：（输入您的证书主题和服务名称）
winhttpcertcfg -g -c LOCAL_MACHINE\MY -s "certificate subject" -a "NetworkService"
winhttpcertcfg -g -c LOCAL_MACHINE\MY -s "certificate subject" -a "LOCAL SERVICE"
winhttpcertcfg -g -c LOCAL_MACHINE\MY -s "certificate subject" -a "My Apps Service Account"
回答by Ramunas
Had same error with code:
代码有同样的错误：
X509Certificate2 mycert = new X509Certificate2(@"C:\certificate.crt");
Solved by adding password:
通过添加密码解决：
X509Certificate2 mycert = new X509Certificate2(@"C:\certificate.crt", "password");
回答by Christian Davén
This error can occur for lots of reasons, and the last time, I solved it by modifying the Reference.svcmapfile, and changing how the WSDL file is referenced.
出现此错误的原因有很多，上次我通过修改Reference.svcmap文件和更改 WSDL 文件的引用方式解决了这个问题。
Throwing exception:
抛出异常：
<MetadataSource Address="C:\Users\Me\Repo\Service.wsdl" Protocol="file" SourceId="1" />
<MetadataFile FileName="Service.wsdl" ... SourceUrl="file:///C:/Users/Me/Repo/Service.wsdl" />
Working fine:
工作正常：
<MetadataSource Address="https://server.domain/path/Service.wsdl" Protocol="http" SourceId="1" />
<MetadataFile FileName="Service.wsdl" ... SourceUrl="https://server.domain/path/Service.wsdl" />
This seems weird, but I have reproduced it. This was in a console application on .NET 4.5 and 4.7, as well as a .NET WebAPI site on 4.7.
这看起来很奇怪，但我已经复制了它。这是在 .NET 4.5 和 4.7 上的控制台应用程序以及 4.7 上的 .NET WebAPI 站点中。
