asp.net core 2.0中的WCF-无法使用授权建立SSL / TLS安全通道的信任关系

Question

以前，我有一个面向应用程序的框架4.5.1，并使用Web Reference添加了WCF服务。这可以完美运行，并且能够通过服务器成功进行身份验证。

旧代码：

ServicePointManager.Expect100Continue = false;
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;

IService orderService = new Service();

// private method to load certificate
var cert = LoadCertificate(@"....\00050._.1.p12", "pwd");

oIPGApiOrderService.ClientCertificates.Add(cert);

oIPGApiOrderService.Url = @"service_url";

NetworkCredential nc = new NetworkCredential("username", "pwd");
oIPGApiOrderService.Credentials = nc;

现在，我要升级到.net core 2.0，并以.net standard 2.0为目标。我已经添加了该服务正在使用服务引用（连接的服务）。生成的代码已更改，其中使用了通道工厂等。

新代码：

ServicePointManager.Expect100Continue = false;
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;

System.ServiceModel.BasicHttpBinding result = new System.ServiceModel.BasicHttpBinding();
result.MaxBufferSize = int.MaxValue;
result.ReaderQuotas = System.Xml.XmlDictionaryReaderQuotas.Max;
result.MaxReceivedMessageSize = int.MaxValue;
result.AllowCookies = true;
result.Security.Mode = System.ServiceModel.BasicHttpSecurityMode.Transport;

IService client = new Service(result, new EndpointAddress("service_url"));

client.ClientCredentials.ClientCertificate.Certificate = new X509Certificate2(@"....\00050._.1.p12", "pwd");

client.ClientCredentials.UserName.UserName = "username";
client.ClientCredentials.UserName.Password = "pwd";

但是，尽管证书已成功加载，但是新代码无法正常工作。我有一个例外：

{System.ServiceModel.Security.SecurityNegotiationException: Could not establish trust relationship for the SSL/TLS secure channel with authority 'xxxxxxx-online.com'. ---> System.Net.Http.HttpRequestException: An error occurred while sending the request. ---> System.Net.Http.WinHttpException: A security error occurred

大家的帮助将不胜感激。我想念什么吗？

Answer 1

如果您使用不信任服务器证书（例如，自签名），则应使用此证书：

client.ClientCredentials.ServiceCertificate.SslCertificateAuthentication =
        new X509ServiceCertificateAuthentication()
        {
            CertificateValidationMode = X509CertificateValidationMode.None,
            RevocationMode = System.Security.Cryptography.X509Certificates.X509RevocationMode.NoCheck
        };