.NET 6自定义证书链验证：ChainStatus及ChainElementStatus为空问题

我们需要实现自定义证书链验证功能，从论坛获取了相关代码，但在回调方法中，certChain的ChainStatus和ChainElementStatus为空或null，导致验证逻辑被跳过，无法正常执行证书链验证。请问是否遗漏了必要的配置或步骤？

用户原代码：

var root = new X509Certificate2(@"c:\root.cer");
var inter = new X509Certificate2(@"c:\inter.cer");
var validCertificates = new[] { root, inter };

var handler = new HttpClientHandler();
handler.ClientCertificateOptions = ClientCertificateOption.Manual;
handler.ServerCertificateCustomValidationCallback = (httpRequestMessage, cert, certChain, policyErrors) =>
{
    return ValidateCertificate(httpRequestMessage, cert, certChain, policyErrors, validCertificates);
};

var httpClient = new HttpClient(handler);

private bool ValidateCertificate(HttpRequestMessage httpRequestMessage, X509Certificate2 cert,
       X509Chain certChain, SslPolicyErrors policyErrors, X509Certificate2[] validCertificates)
{
    if (certChain.ChainStatus.Any(status => status.Status != X509ChainStatusFlags.UntrustedRoot))
        return false;

    foreach (var element in certChain.ChainElements)
    {
        foreach (var status in element.ChainElementStatus)    // 跳过此步骤，无法进入循环
        {
            if (status.Status == X509ChainStatusFlags.UntrustedRoot)
            {
                if (validCertificates.Any(cert => cert.RawData.SequenceEqual(element.Certificate.RawData)))
                    continue; 
            }

            return false;
        }
    }
    return true;
}

问题原因 #

回调传入的X509Chain对象默认未执行完整的链构建与验证流程，所以ChainStatus和ChainElementStatus为空。.NET调用ServerCertificateCustomValidationCallback时，不会自动完成证书链的验证操作，需要手动触发链的构建流程。

解决方案 #

手动创建X509Chain实例，配置自定义信任根并执行链验证，确保能获取到完整的状态信息。修改后的代码如下：

var root = new X509Certificate2(@"c:\root.cer");
var inter = new X509Certificate2(@"c:\inter.cer");
var validCertificates = new[] { root, inter };

var handler = new HttpClientHandler();
handler.ClientCertificateOptions = ClientCertificateOption.Manual;
handler.ServerCertificateCustomValidationCallback = (httpRequestMessage, cert, _, __) =>
{
    return ValidateCertificate(httpRequestMessage, cert as X509Certificate2, validCertificates);
};

var httpClient = new HttpClient(handler);

private bool ValidateCertificate(HttpRequestMessage httpRequestMessage, X509Certificate2 serverCert, X509Certificate2[] validCertificates)
{
    if (serverCert == null)
        return false;

    // 手动构建证书链
    using var chain = new X509Chain();
    // 禁用吊销检查（根据实际需求调整）
    chain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
    // 允许未知证书颁发机构，触发UntrustedRoot状态
    chain.ChainPolicy.VerificationFlags = X509VerificationFlags.AllowUnknownCertificateAuthority;
    // 添加自定义信任根到链的额外存储
    foreach (var cert in validCertificates)
    {
        chain.ChainPolicy.ExtraStore.Add(cert);
    }

    // 执行链构建与验证
    bool isChainValid = chain.Build(serverCert);

    // 检查全局链状态，只允许UntrustedRoot错误
    foreach (var status in chain.ChainStatus)
    {
        if (status.Status != X509ChainStatusFlags.UntrustedRoot)
            return false;
    }

    // 验证链中每个证书是否在信任列表内
    foreach (var element in chain.ChainElements)
    {
        bool isCertTrusted = validCertificates.Any(trustedCert => trustedCert.RawData.SequenceEqual(element.Certificate.RawData));
        if (!isCertTrusted)
            return false;
    }

    return true;
}

关键修改说明 #

• 不再依赖回调传入的certChain，手动创建X509Chain实例确保完整执行链构建。
• 通过ChainPolicy.ExtraStore添加自定义信任证书，替代系统默认信任根。
• 配置VerificationFlags允许未知颁发机构，确保触发UntrustedRoot状态以便自定义验证。
• 先检查全局链状态过滤非法错误，再逐个验证链元素是否属于信任列表。

内容的提问来源于stack exchange，提问作者ezycoder