1

我有一个使用 .NET SslStream 类以及客户端和服务器证书的应用程序。此应用程序在 Windows XP 上运行良好。但是在 Windows 7（也可能是 Vista）上，调用 SslStream.AuthenticateAsClient 时会出现以下异常：

System.ComponentModel.Win32Exception: The credentials supplied to the package were not recognized   
  at System.Net.SSPIWrapper.AcquireCredentialsHandle(SSPIInterface SecModule, String package, CredentialUse intent, SecureCredential scc)   
  at System.Net.Security.SecureChannel.AcquireCredentialsHandle(CredentialUse credUsage, SecureCredential& secureCredential)   
  at System.Net.Security.SecureChannel.AcquireClientCredentials(Byte[]& thumbPrint)   
  at System.Net.Security.SecureChannel.GenerateToken(Byte[] input, Int32 offset, Int32 count, Byte[]& output)   
  at System.Net.Security.SecureChannel.NextMessage(Byte[] incoming, Int32 offset, Int32 count)   
  at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)   
  at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)   
  at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)   
  at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)   
  at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)   
  at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)   
  at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest)   
  at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)   
  at System.Net.Security.SslStream.AuthenticateAsClient(String targetHost, X509CertificateCollection clientCertificates, SslProtocols enabledSslProtocols, Boolean checkCertificateRevocation)

如果应用程序在 Windows 7 上以管理员身份“运行”，则一切正常。我猜这里的根本原因是 AuthenticateAsClient 需要客户端证书的私钥（安装在本地计算机个人证书存储中）并且该操作需要管理员访问权限。

我的问题是有什么办法可以解决这个问题吗？或者，将 AuthenticateAsClient 与客户端证书一起使用需要管理员权限，这仅仅是生活中的事实吗？

4

2 回答 2

2

您是否尝试过使用 WinHttpCertCfg 授予当前用户对证书的访问权限？

就像是：

winhttpcertcfg -g -c LOCAL_MACHINE\My -s MyCertificate -a TESTUSER

有关详细信息，请参阅本文。

于 2010-11-16T12:31:56.993 回答
1

Microsoft 管理控制台 (MMC) 使管理员能够将客户端证书导入本地计算机。但是，导入证书不会自动授予其他帐户对私钥的访问权限。客户端证书身份验证需要此私钥。Microsoft Windows HTTP 服务 (WinHTTP) 证书配置工具提供了在需要时授予对其他帐户（例如 IWAM 帐户）的访问权限的能力。

https://msdn.microsoft.com/en-us/library/aa384088(VS.85).aspx#_using

于 2015-02-17T06:42:02.727 回答