基于证书进行https相互认证的正确方法
我正在开发一个.net项目，需要基于证书的双向https身份验证，即客户端需要将请求与自己的证书关联起来，并且https服务器可以基于证书对客户端进行身份验证。我弄清楚了粗略的工作流程，但不确定这是否是正确的方法：
在客户端：
HttpWebRequest request = (HttpWebRequest)WebRequest.Create("请求 uri");On the server side:
// cert 是来自 certStore 的 X509Certificate2 实例或证书文件
request.ClientCertificates.Add(cert); ;
// req 是 HttpListenerRequest 实例
如果（req.ClientCertificateError == 0）
{
X509Certificate2 clientCert = req.GetClientCertificate;
//验证客户端证书
}
我的问题是：
1）这是正确的方法吗？
2）在服务器端，一旦获得与请求关联的客户端证书，它会做什么来验证证书？假设我们可以在服务器上安装相同的客户端证书。
我是安全方面的新手。如果有人可以帮助解决问题或向我指出有用的文档，我真的很感激。
I am working on a .net project that needs two-way https authentication based on certificates, i.e., client needs to associate requests with its own certificate and the https server can authenticate the client based on the certificate. I figured out the rough workflow but not sure if it is the right way to do it:
On the client side:
HttpWebRequest request = (HttpWebRequest)WebRequest.Create("a request uri");
// cert is a X509Certificate2 instance from certStore or a cert file
request.ClientCertificates.Add(cert);
;
On the server side:
// req is the HttpListenerRequest instance
if (req.ClientCertificateError == 0)
{
X509Certificate2 clientCert = req.GetClientCertificate;
// Validate client certificate
}
My questions are:
1) Is this the right way to do it?
2) On the server side, once it get the client certificate associated with the request, what does it do to validate the certificate? Assume we can install the same client certificate on the server.
I am new to the security stuff. Really appreciate it if anyone could help with the questions or point me to useful documents.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
答案取决于您如何颁发客户端证书。昨天我在另一个问题中描述了验证过程。该过程相当复杂，但根据客户端证书的颁发方式，您可以简化它。
我认为您不希望访问者购买证书来登录您的服务器。这意味着您需要自己为客户颁发证书。如果您颁发这些证书，您可以简单地将它们放入数据库，当客户端连接时，检查您的 clientCert 是否在数据库中。
请注意，除了证书本身之外，您还希望在数据库中保留吊销信息，以便让用户知道如果证书不再有效，他们的证书会发生什么情况。
证书生成的过程是一个相当复杂的话题。我建议您在继续之前阅读一些有关 PKI 的书籍。以下是我推荐的好书：
The answer depends on how you issue client certificates. Yesterday I described the procedure of validation in another question. The procedure is quite complicated, but depending on how the client certificates are issued, you can simplify it.
I don't think you will want your visitors buy certificates to just login to your server. This means that you need to issue certificates for the clients yourself. And if you issue these certificates, you can simply put them to the database and when the client connects, check if your clientCert is in the database.
Note that besides certificates themselves you would like to to keep revocation info in the DB in order to let the users know, what happened with their certificate if it's no longer valid.
The procedure of certificate generation is quite a complex topic. I suggest that you read some books on PKI before you proceed. Here are the great books I'd recommend: