.NET 8 C# SOAP客户端升级服务端至TLS 1.2后无法运行

Exception in REDACTED The message could not be processed.

This is most likely because the action 'REDACTED' is incorrect or because the message contains an invalid or expired security context token or because there is a mismatch between bindings.

The security context token would be invalid if the service aborted the channel due to inactivity.

To prevent the service from aborting idle sessions prematurely increase the Receive timeout on the service endpoint's binding.

初始代码 #

public Service1Client GetSoapClient()
{
    string address = _configuration["soapurl"]; //"https://soapserver/Service.svc";

    Uri uri;
    bool isValidURI = Uri.TryCreate(address, UriKind.RelativeOrAbsolute, out uri);

    if (!isValidURI)
    {
        throw new Exception("URL is not valid");
    }

    EndpointAddressBuilder endpointAddressBuilder = new EndpointAddressBuilder();
    endpointAddressBuilder.Uri = uri;

    BasicHttpsBinding binding = new BasicHttpsBinding();
    binding.Security.Mode = BasicHttpsSecurityMode.Transport;
    binding.MaxReceivedMessageSize = 9000000;
    binding.MaxBufferPoolSize = 9000000;

    Service1Client SC = new Service1Client(binding, endpointAddressBuilder.ToEndpointAddress());

    // Suppress cert error for now
    SC.ClientCredentials.ServiceCertificate.SslCertificateAuthentication =
            new X509ServiceCertificateAuthentication()
            {
                CertificateValidationMode = X509CertificateValidationMode.None,
                RevocationMode = X509RevocationMode.NoCheck
            };
    return SC;
}

修改后的代码（尝试强制TLS 1.2） #

public Service1Client GetSoapClient()
{
    string address = _configuration["soapurl"]; //"https://soapserver/Service.svc";
    Uri uri;
    bool isValidURI = Uri.TryCreate(address, UriKind.RelativeOrAbsolute, out uri);

    if (!isValidURI)
    {
        throw new Exception("URL is not valid");
    }

    System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
    EndpointAddressBuilder endpointAddressBuilder = new EndpointAddressBuilder();
    endpointAddressBuilder.Uri = uri;

    // SC.Endpoint.Address = endpointAddressBuilder.ToEndpointAddress();
    BasicHttpsBinding binding = new BasicHttpsBinding();
    binding.Security.Mode = BasicHttpsSecurityMode.Transport;
    binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.None;

    binding.MaxReceivedMessageSize = 900000;
    binding.MaxBufferPoolSize = 900000;
 
    Service1Client SC = new Service1Client(binding, endpointAddressBuilder.ToEndpointAddress()) ;
    SC.Endpoint.EndpointBehaviors.Add(new SslProtocolCertificateEndpointBehavior()
       {
           SslProtocols = SslProtocols.Tls12
       });
    SC.ClientCredentials.ServiceCertificate.SslCertificateAuthentication =
            new X509ServiceCertificateAuthentication()
            {
                CertificateValidationMode = X509CertificateValidationMode.None,
                RevocationMode = X509RevocationMode.NoCheck
            };
    return SC;
}

排查建议 #

• 核对绑定配置一致性：
  错误提示明确指向绑定不匹配，需确认服务端的绑定参数（安全模式、超时时间、消息大小限制等），确保客户端BasicHttpsBinding的所有配置与服务端完全对齐。比如同步调整binding.ReceiveTimeout、binding.SendTimeout等超时参数。
• 验证SOAP Action正确性：
  检查调用服务方法时的SOAP Action是否与服务端WSDL定义的完全一致，必要时在客户端调用时显式指定正确的Action值。
• 调整安全上下文超时：
  若服务端因会话闲置过早关闭连接，在客户端绑定中延长超时时间，例如binding.ReceiveTimeout = TimeSpan.FromMinutes(10);，同时确认服务端对应参数也做了调整。
• 确认TLS 1.2生效状态：
  通过抓包工具（如Wireshark）验证客户端与服务端的握手协议是否为TLS 1.2，同时确保ServicePointManager.SecurityProtocol的设置在创建客户端实例之前执行，避免设置时机过晚失效。
• 查看服务端详细日志：
  联系服务端运维人员获取更具体的错误日志，日志通常会明确指出绑定不匹配的具体参数或安全上下文失效的触发原因。
• 检查客户端凭据配置：
  确认ClientCredentialType设置与服务端要求一致，若服务端需要客户端凭据，需调整对应配置而非设置为None。

内容的提问来源于stack exchange，提问作者Shahriar chandon