C# "The remote certificate is invalid according to the validation procedure: RemoteCertificateNameMi

Question

需要使用pfx证书将消息从.net核心发布到aws。连接到客户端id时出错。

我来自工人服务的源代码在下面给出

protected override async Task ExecuteAsync(CancellationToken stoppingToken)
{
while (!stoppingToken.IsCancellationRequested)
{
Logger.LogInformation("Worker running at: {time}", DateTimeOffset.Now);
DateTime registryValue = DateTime.Now;
try
{
string application = Configuration[Constants.Application];
string sourceName = Configuration[Constants.SourceName];
string certificateSubject = Configuration[Constants.CertificateSubject];
string iotEndPoint = Configuration[Constants.IotEndpoint];
int brokerPort = Convert.ToInt32(Configuration[Constants.BrokerPort]);
string topic = Configuration[Constants.Topic];
string ggcRootCaCertificate = Configuration[Constants.GgcRootCaCertificate];
string storeName = Configuration[Constants.X509Store];
string clientId = Configuration[Constants.ClientId];

Logger.LogInformation($"ggcRootCaCertificate: {ggcRootCaCertificate}.");
string machineName = Environment.MachineName;
EventLog eventLog = new EventLog(application, machineName);
EventLogEntryCollection eventLogEntryCollection = eventLog.Entries;
//int logCount = eventLogEntryCollection.Count;
//if (logCount <= 0)
//{
//    Logger.LogInformation("No Event Logs in the Log :");
//}
X509Store store = new X509Store(storeName, StoreLocation.CurrentUser);
store.Open(OpenFlags.ReadOnly | OpenFlags.OpenExistingOnly);
var clientCert = store.Certificates.OfType<X509Certificate2>().FirstOrDefault(x =>
x.SubjectName.Name.Contains(certificateSubject));
if (clientCert == null)
{
Logger.LogInformation("Certificate not installed in the system");
}
X509Certificate x509Certificate = X509Certificate.CreateFromCertFile(Path.Join(ggcRootCaCertificate));
MqttClient mqttClient = new MqttClient(iotEndPoint, brokerPort, true, x509Certificate, clientCert, MqttSslProtocols.TLSv1_2);
if (clientId == null)
{
clientId = machineName;
}
mqttClient.ProtocolVersion = MqttProtocolVersion.Version_3_1_1;
mqttClient.Connect(clientId);
Logger.LogInformation($"Connected to AWS IoT with client id: {clientId}.");
RegistryKey registryKey = Registry.LocalMachine.CreateSubKey(Constants.RegistryPath);
DateTime calculatedLogTime = DateTime.Now;
EventLog log = new EventLog(application);
var totalEntries = log.Entries.Cast<EventLogEntry>()
.Where(x => x.Source == sourceName)
.Select(x => new
{
x.MachineName,
x.Site,
x.Source,
x.Message,
x.TimeGenerated,
x.TimeWritten
}).ToList();
registryValue = Convert.ToDateTime(registryKey.GetValue(Constants.LastEventLogFetch));
if (totalEntries.Count > 0)
{
int i = 0;
List<dynamic> termsList = new List<dynamic>();
if (registryValue == null || registryValue == DateTime.MinValue)
{
var Entries = totalEntries.OrderByDescending(x => x.TimeGenerated).FirstOrDefault();
mqttClient.Publish(topic, Encoding.UTF8.GetBytes($" {JsonConvert.SerializeObject(Entries.Message)}"));
Logger.LogInformation("Message published", Encoding.UTF8.GetBytes($" {JsonConvert.SerializeObject(Entries.Message)}"));
registryKey.SetValue(Constants.LastEventLogFetch, calculatedLogTime.AddMinutes(-1));
}
else
{
calculatedLogTime = registryValue.AddMinutes(1);
var Entries = totalEntries.Where(x => (x.TimeGenerated <= calculatedLogTime && x.TimeGenerated >= registryValue)).ToList();
if (Entries.Count > 0)
{
foreach (var item in Entries.GetRange(0, Entries.Count))
{
termsList.Add(item.Message + "Message from vm 30.31");
}
mqttClient.Publish(topic, Encoding.UTF8.GetBytes($" {JsonConvert.SerializeObject(termsList)}"));
Logger.LogInformation("Message published", Encoding.UTF8.GetBytes($" {JsonConvert.SerializeObject(termsList)}"));
registryKey.SetValue(Constants.LastEventLogFetch, calculatedLogTime);
}
else
{
Logger.LogInformation("Event log count is zero. Can't send message");
}
}
}
else
{
Logger.LogInformation("Event log count is zero");
}
}
catch (Exception ex)
{
Logger.LogInformation(ex.Message, DateTimeOffset.Now);
Console.WriteLine(ex.Message);
}
Logger.LogInformation("Worker running at: {time}", DateTimeOffset.Now);
if (registryValue > DateTime.Now)
{
await Task.Delay(60000, stoppingToken);
Logger.LogInformation("Registry value is greater than current time. So task delay will be one minue");
}
else
{
await Task.Delay(1000, stoppingToken);
Logger.LogInformation("Registry value is less than current time. So task delay will be one second");
}
}
}

Json设置如下，

{
"Logging": {
"LogLevel": {
"Default": "Information",
"Microsoft": "Warning",
"Microsoft.Hosting.Lifetime": "Information"
}
},
"AccuTabSettings": {
"Application": "name",
"SourceName": "Source",
"CertificateSubject": "CN=AWS IoT Certificate",
"IotEndpoint": "1.1.1.1",
"BrokerPort": 800,
"Topic": "device/client_id",
"GgcRootCaCertificate": "F:\Certificates\ggc-root.ca.crt",
"X509Store": "MY",
"ClientId": "pqr"
}
}

连接客户端时出现问题=>quot；根据验证过程，远程证书无效：RemoteCertificateNameMismatch，RemoteCertificateChainErrors">

Answer 1

RemoteCertificateNameMismatch错误的主要问题是因为远程证书中指定的使用者和您要连接的地址之间的使用者不匹配。我怀疑远程证书是根据某个DNS名称颁发的，但您正在连接到的IP地址显然不是证书使用者/SAN扩展中指定的。您需要确保远程证书的SAN扩展包含您要连接的地址。

信息不足，无法调试RemoteCertificateChainErrors错误。您需要附加一个调试器并检索准确的错误。