1、生成证书:
需要密码》
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650
或者
不需要密码
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650
2、导出证书未pfx格式
openssl pkcs12 -export -in cert.pem -inkey key.pem -out ids4.pfx
要求输入证书密码(lanhu)
3、使用证书
keyFilePath=“c:\ids4.pfx”
builder.AddSigningCredential(new X509Certificate2(keyFilePath, keyFilePassword));
1、*****************************https-https
客户端应用:
认证中心:
2、************************************http-http
客户端应用:
认证中心:
3、************************************http-https
客户端应用:
认证中心:
有这个提示:
The information you have entered on this page will be sent over an insecure connection and could be read by a third party.
Are you sure you want to send this information?
***************************************************************************************************************************
问题:
集成身份认证数据库时:
"DBConnString": "Data Source=.;Initial Catalog=IdentityServer4;Integrated Security=SSPI;"
用户 'IIS APPPOOL\admin' 登录失败。 原因: 基于令牌的服务器访问验证失败,出现基础结构错误。请检查以前的错误
在IIS管理器中——》应用程序池——》ASP.NETV4.0————》高级设置——》标识——》改为localSystem
证书路径问题:
2020-08-03 14:17:45.049 +08:00 [FTL] Unhandled exception: No signing credential is configured.
System.InvalidOperationException: No signing credential is configured.
at IdentityServer4.ResponseHandling.AuthorizeResponseGenerator.CreateCodeAsync(ValidatedAuthorizeRequest request)
at IdentityServer4.ResponseHandling.AuthorizeResponseGenerator.CreateHybridFlowResponseAsync(ValidatedAuthorizeRequest request)
at IdentityServer4.ResponseHandling.AuthorizeResponseGenerator.CreateResponseAsync(ValidatedAuthorizeRequest request)
at IdentityServer4.Endpoints.AuthorizeEndpointBase.ProcessAuthorizeRequestAsync(NameValueCollection parameters, ClaimsPrincipal user, ConsentResponse consent)
at IdentityServer4.Endpoints.AuthorizeCallbackEndpoint.ProcessAsync(HttpContext context)
at IdentityServer4.Endpoints.AuthorizeCallbackEndpoint.ProcessAsync(HttpContext context)
at IdentityServer4.Hosting.IdentityServerMiddleware.Invoke(HttpContext context, IEndpointRouter router, IUserSession session, IEventService events, IBackChannelLogoutService backChannelLogoutService)
2020-08-03 14:17:45.049 +08:00 [ERR] An unhandled exception has occurred while executing the request.
System.InvalidOperationException: No signing credential is configured.
at IdentityServer4.ResponseHandling.AuthorizeResponseGenerator.CreateCodeAsync(ValidatedAuthorizeRequest request)
at IdentityServer4.ResponseHandling.AuthorizeResponseGenerator.CreateHybridFlowResponseAsync(ValidatedAuthorizeRequest request)
at IdentityServer4.ResponseHandling.AuthorizeResponseGenerator.CreateResponseAsync(ValidatedAuthorizeRequest request)
at IdentityServer4.Endpoints.AuthorizeEndpointBase.ProcessAuthorizeRequestAsync(NameValueCollection parameters, ClaimsPrincipal user, ConsentResponse consent)
at IdentityServer4.Endpoints.AuthorizeCallbackEndpoint.ProcessAsync(HttpContext context)
at IdentityServer4.Endpoints.AuthorizeCallbackEndpoint.ProcessAsync(HttpContext context)
at IdentityServer4.Hosting.IdentityServerMiddleware.Invoke(HttpContext context, IEndpointRouter router, IUserSession session, IEventService events, IBackChannelLogoutService backChannelLogoutService)
at IdentityServer4.Hosting.IdentityServerMiddleware.Invoke(HttpContext context, IEndpointRouter router, IUserSession session, IEventService events, IBackChannelLogoutService backChannelLogoutService)
at IdentityServer4.Hosting.MutualTlsEndpointMiddleware.Invoke(HttpContext context, IAuthenticationSchemeProvider schemes)
at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
at IdentityServer4.Hosting.BaseUrlMiddleware.Invoke(HttpContext context)
Host terminated unexpectedly.
证书权限问题:
Internal.Cryptography.CryptoThrowHelper+WindowsCryptographicException: 出现了内部错误。
at Internal.Cryptography.Pal.CertificatePal.FilterPFXStore(Byte[] rawData, SafePasswordHandle password, PfxCertStoreFlags pfxCertStoreFlags)
at Internal.Cryptography.Pal.CertificatePal.FromBlobOrFile(Byte[] rawData, String fileName, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags)
at System.Security.Cryptography.X509Certificates.X509Certificate..ctor(String fileName, String password, X509KeyStorageFlags keyStorageFlags)
at System.Security.Cryptography.X509Certificates.X509Certificate2..ctor(String fileName, String password)
解决办法:(不需要应用标识改为LocalSystem,ApplicationPoolIdentity就行)
1、设置IIS用户和IUser有证书pfx所在目录的权限
2、mmc导入pfx证书,自动类型
3、 引入的时候指定参数
builder.AddSigningCredential(new X509Certificate2(keyFilePath, keyFilePassword, X509KeyStorageFlags.PersistKeySet | X509KeyStorageFlags.MachineKeySet));
*******************************************************************************************
初始调用:X509Certificate2 certificate = new X509Certificate2(input.Path, CER_PASSWORD);
相关译文:
即使您正在从磁盘读取证书并将其存储在对象中,私钥仍存储在Microsoft Cryptographic API加密服务提供程序密钥数据库中。在托管服务器上,ASP.NET进程没有访问用户存储的权限。
有两个可能原因(我两个问题都遇到了):
1.权限不足
解决办法:提升程序池权限为LocalSystem,如下图
2.秘钥没有读取到,提示:出现了内部错误
修改了X509Certificate2声明后,提示“权限不足”,X509Certificate2如下声明:
X509Certificate2 certificate = new X509Certificate2(input.Path, CER_PASSWORD, X509KeyStorageFlags.PersistKeySet | X509KeyStorageFlags.MachineKeySet);
然后按照,第一种解决方法即可。
PS:注意没有安装证书的,需要先双击证书文件