I developed a server application with C# .NET 4 , and I am meeting a problem when i try to connect to this server with a mutual authenticated SSL communication. It works well with a 1 way authentication but when i try to move to mutual authentication, the application rise the following exception:
System.Security.Authentication.AuthenticationException: A call to SSPI failed, see inner exception. ---> System.ComponentModel.Win32Exception: The message or signature supplied for verification has been altered
at the beginning i thought it was a certificate problem on client side, but when i try to connect the client to openssl binary server(openssl.exe s_server --accept ...) it works well !! i also tried to use openssl binary in client mode to connect to my server (openssl.exe s_client --connect...) and i met the same problem. The function that rise the exception is sslStream.AuthenticateAsServer Here is the code:
using System.Security.Cryptography.X509Certificates;
using System.Net.Security;
using System.Windows.Forms;
using System.Security.Authentication;
using System.Net;
using System.Net.Sockets;
...
TcpClient clientSocket = listener.AcceptTcpClient();
if (clientSocket != null)
{
HandleClient(clientSocket);
}
}
static void HandleClient(TcpClient client)
{
using (SslStream sslStream = new SslStream(client.GetStream(), false,
new RemoteCertificateValidationCallback(ValidateClientCertificate), null))
{
X509Certificate2 serverCertificate = new X509Certificate2 ("ssl_server.p12","toto");
try {
sslStream.AuthenticateAsServer (certificate, true, System.Security.Authentication.SslProtocols.Ssl3, false);
}
catch (Exception e)
{
}
}
}
i tried to use other constructors, but it's always the same result.
SslStream sslStream = new SslStream (client.GetStream (), false);
try {
sslStream.AuthenticateAsServer (serverCertificate, true,SslProtocols.Default, false);
...
}
I added the C.A root to the store and i verified that it has been added. with X509store class. I really don't know what to do, i change certificate's format (i tried .cer, pkcs12)
I also tried to find a similar situation with Google, but nothing interesting. Any help or suggestion is welcome.