即使在修补程序后，SHA256 也无法工作
好的，我们有一台带有 SP2 的 Windows Server 2003 计算机，并且安装了 HOTFIX KB 938397 和 KB 968730。当我们尝试使用 SHA2 证书 (SHA256) 时，仍然会发生以下情况：
• 可以将此类证书导入到证书存储中，但随后会发现签名算法无法识别，并且被标记为已损坏，具有无效的数字签名；在 Windows Server 2008 下导入的相同证书会显示“此证书正常”。
• 如果访问需要带有客户端身份验证证书（如 IIS 中设置）的 SSL 的 Web 服务，则如果传递此类型的客户端身份验证证书，则对 Web 方法的调用将失败，并出现错误“403 Forbidden”。如果通过调用传递 sha1RSA 证书，则 Web 服务确实会返回实质性结果。该调用是通过在同一服务器上运行的 .NET 代码、框架 1.1 进行的。
有人有这方面的经验吗？ Microsoft 支持速度很慢，我们需要在 2011 年 1 月 1 日之前完成
Ok, so we have a Windows Server 2003 machine with SP2 and both HOTFIX KB 938397 and KB 968730 installed. When we try to use the SHA2 certificates (SHA256) The following things still happen:
• Such a certificate can be imported in the certificate store, but subsequently it becomes apparent that the signature algorithm is not recognized, and that it is denoted as corrupt, with an invalid digital signature; the same certificate imported under Windows Server 2008 is displayed there with “This certificate is OK”.
• If one approaches a webservice that requires SSL with client authentication certificates (as set in IIS) then a call to a webmethod fails if a client authentication certificate of this type is passed along, with error “403 Forbidden”. If with the call a sha1RSA-certificate is passed along, the webservice does return a substantive result. The call is made from .NET-code, framework 1.1, running on the same server.
Does anyone have any experience with this? Microsoft support is slow, and we need this done by 2011-1-1
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
对于遇到同样问题的每个人：
我们已经让 Microsoft 进行了广泛的搜索来寻找此问题的解决方案，但他们只能得出结论：这些证书只能由操作系统支持用作客户端证书。如果您安装了修补程序，证书确实可以在（例如）IE 中安装和使用。与接受特定证书的服务器的握手将正常工作。将证书用于服务器目的（如 iis 或其他）将不起作用。
祝你好运
To everyone who has the same problem:
We've had Microsoft do an extensive search for a solution to this problem, but they could only conclude that these certificates could ONLY be supported by the OS to be used as client certificates. If you install the hotfixes, the certificate can indeed be installed and used in (e.g.) IE. The handshake with a server accepting the specific certificate will work fine. Using the certificate for server purposes (like iis or whatever) will NOT work.
Good luck
乔恩，
您可能想检查密码套件。
http://msdn.microsoft.com/en-我们/library/aa374757(v=vs.85).aspx
确保您的 2003 服务器上有它们。
Jon,
You might want to check on the cipher suites.
http://msdn.microsoft.com/en-us/library/aa374757(v=vs.85).aspx
Make sure you have them available on your 2003 server.