我尝试做一个C#程序,监听TCP隧道,以便通过TLS接收安全信息。我已经按照通常的方式用OpenSSL创建了一对certificate.crt
和private.key
文件,以便从我的C#程序导入X509Certificate2
。
我的C#程序:
using System.Net;
using System.Net.Security;
using System.Net.Sockets;
using System.Reflection;
using System.Security.Authentication;
using System.Security.Cryptography.X509Certificates;
using KeysExchange;
class Program
{
static void Main(string[] args)
{
// Load the SSL certificate
// Load the server certificate from an embedded resource
string certFilePath = "/etc/ssl/private/certificate.crt";
string skFilePath = "/etc/ssl/private/private.key";
// Load the certificate with the associated private key
X509Certificate2 serverCertificate = new X509Certificate2(certFilePath);
int port = 443;
IPAddress ipAddress = IPAddress.Parse("... my local IP");
if (serverCertificate != null)
{
TcpListener listener = new TcpListener(ipAddress, port);
listener.Start();
Console.WriteLine("SSL listener started...");
while (true)
{
var client = listener.AcceptTcpClient();
Console.WriteLine($"[TCP] Listening on port: {port}, ipaddr: {ipAddress}. Client availability:" +
$"{client.Available}");
// Wrap the stream with an SSL stream
SslStream sslStream = new SslStream(client.GetStream(), false);
try
{
// Authenticate the SSL connection with the private key password
sslStream.AuthenticateAsServer(serverCertificate, false, SslProtocols.Tls12, true);
// Read the incoming message
using (StreamReader reader = new StreamReader(sslStream))
{
var message = reader.ReadLine();
Console.WriteLine($"Received message: {message}");
}
// Close the SSL stream and the client connection
sslStream.Close();
client.Close();
}
catch (Exception ex)
{
Console.WriteLine($"Error: {ex.Message}");
client.Close();
}
}
}
Console.ReadLine();
}
}
问题是当我启动.NET程序时,显示以下输出:
SSL listener started...
[TCP] Listening on port: 443, ipaddr: (...). Client availability:165
Error: The server mode SSL must use a certificate with the associated private key.
我的服务器运行在Ubuntu 20.04上,这是一个远程虚拟服务器,其中密钥已在/etc/ssl/private
位置创建。有人知道为什么我的C#程序对该证书没有响应吗?我尝试了几种解决方案,例如将我的自签名证书添加到CA证书,并查看以下命令是否会产生相同的输出:
openssl x509 -noout -modulus -in certificate.crt | openssl md5
openssl rsa -noout -modulus -in private.key | openssl md5
而且很明显两种情况都收到了相同的输出。我有点绝望,我真的不知道出了什么问题。
1条答案
按热度按时间jyztefdp1#
.NET使用its own certificate store,在Linux上位于
~/.dotnet/corefx/cryptography/x509stores/
。其中一种管理证书的方法是使用certificate-tool,例如:
另外请注意,Linux上不存在
LocalMachine
存储,因此您必须使用CurrentUser
。