如何在C#中手动验证自签名证书? [英] How do I manually validate a self-signed certificate in C#?
问题描述
在过去的几周中,我在Docker容器中进行了大量工作,遇到了一个障碍,在该障碍中,自签名证书会导致问题,因为Docker容器无法识别证书颁发机构.
I’ve been working a lot in Docker containers in the past couple of weeks and I came across the obstacle where a self signed cert was causing issues because the Docker container did not recognize the Certificate Authority.
问题在于,由于我们在公司使用Docker的方式,我无法在服务器配置上放置自己的证书.
The issue was that I was unable to put my own certs on the server configuration because the way we use Docker at my company.
推荐答案
经过大量研究,我提出了一种基于构建链和验证指纹来手动验证证书的解决方案.
After a good bit of research, I came up with a solution that manually validates the cert based off building the chain and verification of the thumbprint.
注意:您必须使用支持证书验证回调的库,以便可以编写自己的委托方法.下面是我的实现.
Note: You have to be using a library that supports a Certificate Validation Callback so that you can code your own delegate method. Below is my implementation.
public static bool ManualSslVerification(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
try
{
//Testing to see if the Certificate and Chain build properly, aka no forgery.
chain.ChainPolicy.VerificationFlags = X509VerificationFlags.NoFlag;
chain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
chain.Build(new X509Certificate2(certificate));
//Looking to see if there are no errors in the build that we don’t like
foreach (X509ChainStatus status in chain.ChainStatus)
{
if (status.Status == X509ChainStatusFlags.NoError || status.Status == X509ChainStatusFlags.UntrustedRoot)
{
//Acceptable Status, We want to know if it builds properly.
}
else
{
return false;
}
}
X509Certificate2 trustedRootCertificateAuthority = new X509Certificate2(ViewController.Properties.Resources.My_Infrastructure_Root_CA);
//Now that we have tested to see if the cert builds properly, we now will check if the thumbprint of the root ca matches our trusted one
if(chain.ChainElements[chain.ChainElements.Count – 1].Certificate.Thumbprint != trustedRootCertificateAuthority.Thumbprint)
{
return false;
}
//Once we have verified the thumbprint the last fun check we can do is to build the chain and then see if the remote cert builds properly with it
//Testing to see if the Certificate and Chain build properly, aka no forgery.
X509Chain trustedChain = new X509Chain();
trustedChain.ChainPolicy.ExtraStore.Add(trustedRootCertificateAuthority);
trustedChain.ChainPolicy.VerificationFlags = X509VerificationFlags.NoFlag;
trustedChain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
trustedChain.Build(new X509Certificate2(certificate));
//Looking to see if there are no errors in the build that we don’t like
foreach (X509ChainStatus status in trustedChain.ChainStatus)
{
if(status.Status == X509ChainStatusFlags.NoError || status.Status == X509ChainStatusFlags.UntrustedRoot)
{
//Acceptable Status, We want to know if it builds properly.
}
else
{
return false;
}
}
}
catch (Exception ex)
{
Console.WriteLine(ex);
return false;
}
return true;
}
这篇关于如何在C#中手动验证自签名证书?的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!