在.NET Core中指定web服务X509证书终结点标识

对于任何对此感兴趣的人,我只是用.NET Core 2.1测试了它,并成功地使其工作如下。

定义客户端 X509CertificateValidator

public class MyCertificateValidator : X509CertificateValidator
{
    private readonly string _allowedCertificateEncodedValue;

    public MyCertificateValidator(string allowedCertificateEncodedValue)
    {
        _allowedCertificateEncodedValue = allowedCertificateEncodedValue ?? throw new ArgumentNullException("allowedCertificateEncodedValue");
    }
    public override void Validate(X509Certificate2 certificate)
    {
        if (certificate == null)
        {
            throw new ArgumentNullException("certificate");
        }

        var allowedCertificateEncodedValue = Convert.ToBase64String(certificate.RawData);
        if (_allowedCertificateEncodedValue != allowedCertificateEncodedValue)
        {
            throw new SecurityTokenValidationException("Certificate does not match the provided encoded value.");
        }
    }
}

创建客户机时使用验证器。

var remoteAddress = new EndpointAddress("https://localhost:44300/MyService.svc");
_myServiceClient = new MyServiceClient(MyServiceClient.EndpointConfiguration.WSHttpBinding_IMyService, remoteAddress);
_myServiceClient.ClientCredentials.ServiceCertificate.SslCertificateAuthentication =
    new X509ServiceCertificateAuthentication()
    {
        CertificateValidationMode = X509CertificateValidationMode.Custom,
        CustomCertificateValidator = new MyCertificateValidator(CertificateEncodedValue)
    };

await _myServiceClient.OpenAsync();

与您提供的链接中提到的类似的东西显然将在.NET Core3.1中得到支持,如GitHub所示 issue