SslStream 身份验证在 LOCAL SYSTEM 帐户下失败

Question

我有这个代码：

string certificateFilePath = @"C:\Users\Administrator\Documents\Certificate.pfx";

string certificateFilePassword = "Some Password Here";

X509Certificate clientCertificate = new X509Certificate(certificateFilePath, certificateFilePassword);

TcpClient client = new TcpClient(host, port);

SslStream stream = new SslStream(client.GetStream(), false, (sender, certificate, chain, errors) => true);

X509CertificateCollection clientCertificates = new X509CertificateCollection {clientCertificate};

stream.AuthenticateAsClient(host, clientCertificates, SslProtocols.Tls, false);

当我在控制台应用程序中运行代码时，一切正常，stream.IsAuthenticated并stream.IsMutuallyAuthenticated返回true并stream.LocalCertificate包含正确的证书对象。

然而，当在 a 中运行完全相同的代码时Windows Service (as LOCAL SYSTEM user)，虽然stream.IsAuthenticated返回true，stream.IsMutuallyAuthenticated返回false并stream.LocalCertificate返回null。

在这两种情况下都会发生这种情况，在第一行运行后clientCertificate加载正确的认证数据并包含证书Subject和Issuer.

我还尝试使用以下代码强制 SslStream 选择证书：

string certificateFilePath = @"C:\Users\Administrator\Documents\Certificate.pfx";

string certificateFilePassword = "Some Password Here";

X509Certificate clientCertificate = new X509Certificate(certificateFilePath, certificateFilePassword);

TcpClient client = new TcpClient(host, port);

SslStream stream = new SslStream(client.GetStream(), false, (sender, certificate, chain, errors) => true, (sender, host, certificates, certificate, issuers) => clientCertificate);

X509CertificateCollection clientCertificates = new X509CertificateCollection {clientCertificate};

stream.AuthenticateAsClient(host, clientCertificates, SslProtocols.Tls, false);

但是代码仍然不起作用并stream.IsMutuallyAuthenticated返回false并stream.LocalCertificate返回null。

我已经探索了几天了，但我无法弄清楚。任何帮助都受到高度赞赏。

编辑： 在使用WinHttpCertCfg工具尝试证书后，事实证明与类似问题不同，LOCAL SYSTEM 帐户已经可以访问目标证书的私钥，如下图所示： 因此，问题仍然没有解决。

Answer 1

我最终在使用 X509 类时使代码可以工作。

这是对我有用的代码：

string host = "The Host";

int port = 777;

string certificateFilePath = @"C:\Users\Administrator\Documents\Certificate.pfx";

string certificateFilePassword = "Some Password Here";

X509Certificate clientCertificate = new X509Certificate(certificateFilePath, certificateFilePassword);

X509Certificate2 clientCertificate2 = new X509Certificate2(clientCertificate); //<== Create a X509Certificate2 object from the X509Certificate which was loaded from the file. The clientCertificate2 loads the proper data

TcpClient client = new TcpClient(host, port);

SslStream stream = new SslStream(client.GetStream(), false, (sender, certificate, chain, errors) => true);

X509CertificateCollection clientCertificates = new X509CertificateCollection { clientCertificate2 }; //<== Using the clientCertificate2 which has loaded the proper data instead of the clientCertificate object

stream.AuthenticateAsClient(host, clientCertificates, SslProtocols.Tls, false);

这样我的代码就可以从系统中找到正确的 X509Store、证书和私钥。

我已经根据经验弄清楚了这一点。我在 MSDN 上找不到关于为什么会这样的明确解释。