如何使用客户端证书/相互认证来调用Web服务？

Question

我正在构建一个使用vb.net的web服务客户端。 Web服务使用ssl，基本身份验证进行安全保护，并且还需要客户端证书。因此，我创建在Visual Studio的Web引用和提供的凭据：

Dim cred As New System.Net.NetworkCredential("usr", "passwd") 
Dim proxy As New SimpleFromLocal.simple 
proxy.Credentials = cred 

Console.WriteLine(proxy.helloWorld()) 

可正常工作，只要我关掉相互认证在服务器端。 我说像这样的客户端证书：

Dim cert As X509Certificate = X509Certificate.CreateFromCertFile(certFile) 
proxy.ClientCertificates.Add(cert) 

证书加载，但Web服务调用失败。我可以发布例外情况，但它是用德语发布的，这本身就是一个问题。它基本上说：验证失败，因为远程站点关闭了连接。 我试着调试服务器端的ssl握手，看起来客户端证书没有被传输。

那么我在这里错过了什么？是否需要在本地机器上安装客户端证书？

编辑：引发的错误：

System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send. ---> 
System.IO.IOException: Authentication failed because the remote party has closed the transport stream. 
at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest) 
at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest) 
at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest) 
at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest) 
at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest) 
at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest) 
at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest) 
at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest) 
at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest) 
at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest) 
at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult) 
at System.Net.TlsStream.CallProcessAuthentication(Object state) 
at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state) 
at System.Net.TlsStream.ProcessAuthentication(LazyAsyncResult result) 
at System.Net.TlsStream.Write(Byte[] buffer, Int32 offset, Int32 size) 
at System.Net.PooledStream.Write(Byte[] buffer, Int32 offset, Int32 size) 
at System.Net.ConnectStream.WriteHeaders(Boolean async) 
--- End of inner exception stack trace --- 
at System.Web.Services.Protocols.WebClientProtocol.GetWebResponse(WebRequest request) 
at System.Web.Services.Protocols.HttpWebClientProtocol.GetWebResponse(WebRequest request) 
at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters) 
at CCClient.SimpleFromLocal.simple.helloWorld() in C:\TP\CCClient\CCClient\Web References\SimpleFromLocal\Reference.vb:Zeile 90. 
at CCClient.Module1.clientWithProxy(NetworkCredential cred, String certFile) 
in C:\TP\CCClient\CCClient\Module1.vb:Zeile 53. 

Answer 1

终于来了！

This question让我尝试使用X509Certificate2（注意类名中的）。我将它与仅包含单个证书的PKCS＃12密钥库一起使用。因此，这里是我做过什么：

创建密钥库文件

我用Java的keytool这一点。创建一个自签名证书后，需要导出到所需的格式：

keytool -importkeystore -srckeystore keystore.jks \ 
     -srcstoretype JKS \ 
     -destkeystore keystore.pfx \ 
     -deststoretype PKCS12 

注：导出证书到一个文件，并使用它直接不起作用。

添加客户端证书代理

Dim proxy As New SimpleFromLocal.simple 
Dim cred As New NetworkCredential("usr", "passwd") 
Dim cert As New X509Certificate2(certFile, "passwd") 
proxy.Credentials = cred 
proxy.ClientCertificates.Add(cert) 

Console.WriteLine(proxy.helloWorld()) 

就是这样。无论出于何种原因，使用X509Certificate都会导致相同的设置失败。