ssl - SChannel，SEC_E_ALGORITHM_MISMATCH(0x80090331)

数天的故障排除，谷歌搜索解决方案和重新阅读有关所需功能的Microsoft文档。更改变量，一次又一次重试。非常感谢您的帮助，我敢肯定这不仅是我遇到的问题。

我正在努力实现联网的客户端和服务器应用程序，这些应用程序使用SChannel与SSL / TLS层进行通信（以后还将与OpenSSL一起使用以实现交叉兼容性）。我有一个工作正常的客户端，因此我们可以专注于服务器端。

目前，目标是使其工作而无需在任一侧提供证书（它们应根据需要即时生成）。我执行AcquireCredentialsHandle，从客户端（在同一主机上运行）加载初始令牌，然后调用AcceptSecurityContext。

看来，无论我更改了什么变量，在第一次调用AcceptSecurityContext时，我总是遇到相同的0x80090331错误。在Windows 7和Windows Server 2012上测试。

在我看来，我的代码之外肯定有某些东西，我需要修复的OS设置。我在网上发现矛盾的信息。 TLS 1.1和TLS 1.2已添加到SecurityProviders \ SCHANNEL \ Protocols *下的注册表中，并设置了数据DisabledByDefault = 0。还向“ SecurityProviders”添加了“，schannel.dll”。

代码如下：

... snip ...（调用AcquireCredentialsHandle的代码）

PCCERT_CONTEXT serverCerts[1] = {0};

SCHANNEL_CRED sc = {0};
sc.dwVersion = SCHANNEL_CRED_VERSION;
//sc.grbitEnabledProtocols = SP_PROT_SSL3_SERVER | SP_PROT_TLS1_SERVER | SP_PROT_TLS1_1_SERVER | SP_PROT_TLS1_2_SERVER;
sc.grbitEnabledProtocols = SP_PROT_TLS1_1_SERVER | SP_PROT_TLS1_2_SERVER;
sc.dwFlags = 0;
sc.cCreds = 0; // Let Crypto API find the appropriate certificate for us
sc.paCred = serverCerts;

TimeStamp tsExpiry;
SECURITY_STATUS status = AcquireCredentialsHandle(
    NULL,
    UNISP_NAME,
    SECPKG_CRED_INBOUND,
    NULL,
    &sc,
    NULL,
    NULL,
    &hCredential,
    &tsExpiry);
std::cout << "AcquireCredentialsHandle result = 0x" << std::hex << status << std::endl;

... snip ...（调用AcceptSecurityContext的代码）

    // TOKEN is received from client into m_receivedData
    //std::vector<char> m_receivedData;

    m_ctxtFlags = ASC_REQ_ALLOCATE_MEMORY | ASC_REQ_STREAM;
    SecBuffer inBuffers[2];

    // Provide Schannel with the remote host's handshake data
    inBuffers[0].pvBuffer    = (char*)(&m_receivedData[0]);
    inBuffers[0].cbBuffer    = (unsigned long)m_receivedData.size();
    inBuffers[0].BufferType  = SECBUFFER_TOKEN;

    inBuffers[1].pvBuffer   = NULL;
    inBuffers[1].cbBuffer   = 0;
    inBuffers[1].BufferType = SECBUFFER_EMPTY;

    SecBufferDesc inBufferDesc = {0};
    inBufferDesc.cBuffers   = 2;
    inBufferDesc.pBuffers   = inBuffers;
    inBufferDesc.ulVersion  = SECBUFFER_VERSION;

    SecBuffer outBuffers[2];

    // We let Schannel allocate the output buffer for us
    outBuffers[0].pvBuffer   = NULL;
    outBuffers[0].cbBuffer   = 0;
    outBuffers[0].BufferType = SECBUFFER_TOKEN;

    // Contains alert data if an alert is generated
    outBuffers[1].pvBuffer   = NULL;
    outBuffers[1].cbBuffer   = 0;
    outBuffers[1].BufferType = SECBUFFER_ALERT;

    SecBufferDesc outBufferDesc = {0};
    outBufferDesc.cBuffers   = 2;
    outBufferDesc.pBuffers   = outBuffers;
    outBufferDesc.ulVersion  = SECBUFFER_VERSION;

    unsigned long fContextAttr;
    TimeStamp tsTimeStamp;

    SECURITY_STATUS status = NULL;
    if (isFirstCall) {
        status = AcceptSecurityContext(
            &hCredential,
            NULL,
            &inBufferDesc,
            m_ctxtFlags,
            0,
            &hNewContext,
            &outBufferDesc,
            &fContextAttr,
            NULL);
        std::cout << "AcceptSecurityContext (isFirstCall) result = 0x" << std::hex << status << std::endl;
    }

最佳答案

SSL / TLS需要服务器端证书。缺少服务器端证书会生成0x80090331错误。下一步是根据需要创建一个自签名证书。请参见CertCreateSelfSignCertificate。可以在here中找到使用CryptoAPI的C示例。