无法验证身份服务器SSL握手错误

Question

出身背景我需要让我的网站通过IdentityServer（IDS）进行身份验证。“example.com”

我正在用DotNetCore构建我所有的网站，用apache在代理服务器上托管它们，让我们调用私有ip12.3.4.5。

它们应该如何工作。我去网站的例子。我应该可以和ids通话。例如。com获取身份验证信息，然后重新路由回示例。具有身份验证令牌的com。相反，我得到了一个SSL握手错误。见下文。

我特别请求帮助让网站彼此信任。

不过，如果我尝试通过直接访问IDS站点进行身份验证，则没有问题！！金质的所以正如你所看到的，只有当我尝试在站点之间交流时，我才会遇到这个问题。

An unhandled exception occurred while processing the request.
OpenSslCryptographicException: error:14094410:SSL 
routines:ssl3_read_bytes:sslv3 alert handshake failure
Unknown location

SslException: SSL Handshake failed with OpenSSL error - SSL_ERROR_SSL.
Interop+OpenSsl.DoSslHandshake(SafeSslHandle context, byte[] recvBuf, int 
recvOffset, int recvCount, out byte[] sendBuf, out int sendCount)

AuthenticationException: Authentication failed, see inner exception.
System.Net.Security.SslState.StartSendAuthResetSignal(ProtocolToken 
message, AsyncProtocolRequest asyncRequest, ExceptionDispatchInfo 
exception)

HttpRequestException: The SSL connection could not be established, see 
inner exception.
System.Net.Http.ConnectHelper.EstablishSslConnectionAsyncCore(Stream 
stream, SslClientAuthenticationOptions sslOptions, CancellationToken 
cancellationToken)

IOException: IDX20804: Unable to retrieve document from: 
'https://ids.example.com/.well-known/openid-


 configuration'.Microsoft.IdentityModel.Protocols.HttpDocumentRetriever.GetDocu 
mentAsync(string address, CancellationToken cancel)

InvalidOperationException: IDX20803: Unable to obtain configuration from: 
'https://ids.example.com/.well-known/openid-configuration'.

微软IdentityModel。协议。配置管理器。GetConfigurationAsyn c（取消令牌取消）

httpd.conf::

#ServerRoot"/etc/ttpd"LoadModuelproxy_module模块/mod_proxy.soLoadModuelproxy_http_module模块/mod_proxy_http.soLoadModuelssl_module模块/mod_ssl.so

<VirtualHost *:*>
  RequestHeader set X-Forwarded-Proto "%{REQUEST_SCHEME}s"
</VirtualHost>


<VirtualHost *:443>
 ServerName ids.example.com
 SSLEngine on
 SSLProxyEngine on
 SSLProtocol all -SSLv2
 SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:!RC4+RSA:+HIGH:+MEDIUM:!LOW:!RC4
 SSLProxyVerify none 
 SSLProxyCheckPeerCN off
 SSLProxyCheckPeerName off

 SSLProxyCheckPeerExpire off

 SSLCertificateKeyFile /etc/httpd/ssl/example.key 
 SSLCertificateFile    /etc/httpd/ssl/example.crt
 SSLVerifyClient require
 SSLVerifyDepth 10
 SSLCACertificateFile /etc/httpd/ssl/DoD_CAs.pem
 SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
 ProxyPreserveHost on

 ProxyPass                   /       http://x.x.x.x:5008/
 ProxyPassReverse         /       http://x.x.x.x:5008/

</VirtualHost>



 # Main Site VirtualHost
<VirtualHost *:443>
 ServerName example.com
# SSL settings
 SSLEngine on
 SSLProxyEngine on
 SSLProtocol all -SSLv2
 SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:!RC4+RSA:+HIGH:+MEDIUM:!LOW:!RC4
 SSLProxyVerify none 
 SSLProxyCheckPeerCN off
 SSLProxyCheckPeerName off
 SSLProxyCheckPeerExpire off
 SSLCertificateKeyFile /etc/httpd/ssl/example.key
 SSLCertificateFile    /etc/httpd/ssl/example.crt
# Client Verification
 SSLVerifyClient require
 SSLVerifyDepth 10
 SSLCACertificateFile /etc/httpd/ssl/DoD_CAs.pem
 RequestHeader set X-ARR-ClientCert "%{SSL_CLIENT_S_DN}s"
 SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
# Redirects
 ProxyPreserveHost on
 ProxyPass                /       http://x.x.x.x:5022/
 ProxyPassReverse         /       http://x.x.x.x:5022/
</VirtualHost>

Answer 1

错误在http中。配置文件

当我应该使用SSLCACertificatePath指令时，我正在使用SSLCACertificateFile指令。。。

基本上，我可以用国防部CAC pki进行身份验证，但是一旦dot.net核心应用程序试图从一个服务器发送到另一个服务器，它就会出现握手错误，因为这些网站使用的是自签名证书。我的证书一直在正确的地方，但是它不信任它，因为SSLCACertificateFile指令说只信任这个，而不是信任这个目录中的所有内容。

Also my network guy recomends that in the future, it's a best practice to use the 
SSLCAcertificateFile, but to then combine your certs into one.

我真的希望这能拯救其他人我刚刚经历的。。。我已经花了大约40个小时来解决这个问题。从配置文件来回切换到代码库更改。。。