为什么remoteCertificate参数在LocalCertificateSelectionCallback方法中是空的？

Question

我想建立一个SSL连接，但实际上并不了解有关SSL握手规则和生命周期的所有信息。我写一个代码

void main() 
{ 
TcpClient client = new TcpClient("192.168.1.160", 4113); 
SslStream sslStream = new SslStream(
       client.GetStream(), 
       false, 
       new RemoteCertificateValidationCallback(ValidateServerCertificate), 
       new LocalCertificateSelectionCallback(localCertSelection) 
       ); 
sslStream.AuthenticateAsClient(serverName); 
} 

public X509Certificate localCertSelection(object sender, string targetHost, X509CertificateCollection localCertificates, X509Certificate remoteCertificate, string[] acceptableIssuers) 
     {// why here 'remoteCertificate' parameter is empty? 'acceptableIssuers' and 'localCertificates' too 
      string cert = "MIIEwjCCA6qgAwIBAgIBADANBgkqhkiG9w..."; 
      X509Certificate clientCert = new X509Certificate(System.Text.Encoding.ASCII.GetBytes(cert)); 
      return clientCert; 
     } 

public bool ValidateServerCertificate(
       object sender, 
       X509Certificate certificate, 
       X509Chain chain, 
       SslPolicyErrors sslPolicyErrors) 
     { 
// 'certificate' has data now. it has come from server 
      if (sslPolicyErrors == SslPolicyErrors.None) 
       return true; 

      Console.WriteLine("Certificate error: {0}", sslPolicyErrors); 

      // Do not allow this client to communicate with unauthenticated servers. 
      return false; 
     } 

当我运行的代码，程序流程首先前进到“localCertSelection”方法，然后进行到“ValidateServerCertificate”方法。 'localCertSelection'方法'remoteCertificate'中的
是空的，但是在'ValidateServerCertificate'方法'certificate'中有数据。它来自服务器，但为什么 'sslPolicyErrors'是'RemoteCertificateNameMismatch | RemoteCertificateChainErrors'？ 有什么不对？我必须做什么？

Answer 1

如果您的“服务器名称”错误，则可能会出现RemoteCertificateNameMismatch错误。我的意思是在

sslStream.AuthenticateAsClient(serverName); 

该服务器名称必须是“192.168.1.160”，一样

TcpClient client = new TcpClient("192.168.1.160", 4113); 

的RemoteCertificateChainErrors发生，如果出错了根证书。当您创建证书时，您必须在CN中放置适当的主机， CN = 192.168.1.160。不要忘记将您的根证书导入“受信任的根证书颁发机构”。