SslStream AuthenticateAsClient 方法获取“由于意外的数据包格式导致握手失败”错误

Question

我们的代码在C#中使用TcpClient and SslStream在调用AuthenticateAsClient方法时遇到错误The handshake failed due to an unexpected packet format.，SMTP服务器是smtp.office365.com，我们尝试了很多方法，但都不起作用。

1. 试过了：System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;

2. 试过了：ssl.AuthenticateAsClient(Server, null, System.Security.Authentication.SslProtocols.Tls12, true);

3. 试过其他 AuthenticateAsClient 重载方法都不起作用。

4. 同样使用Microsoft Network Monitor 3.4工具，我们可以确认Client Hello握手使用的是TSL1.2协议。

有人遇到过类似的问题吗？

以下是 .NET Framework 8 控制台中的完整代码

    class Program
    {
        static void Main(string[] args)
        {
            try
            {
                string Server = "smtp-legacy.office365.com";
                //This server raise error too
                Server = "smtp.office365.com";
                int port = 587;
                //tried this, not working
                //System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
                //
                using (var tcp = new System.Net.Sockets.TcpClient())
                {
                    tcp.Connect(Server, port);

                    System.Net.Security.RemoteCertificateValidationCallback remoteCertCallback =
                        new System.Net.Security.RemoteCertificateValidationCallback((Object sender,
                               System.Security.Cryptography.X509Certificates.X509Certificate cert,
                               System.Security.Cryptography.X509Certificates.X509Chain chain,
                               System.Net.Security.SslPolicyErrors Errors) => true);

                    //System.Net.Security.SslStream ssl = 
                    //    new System.Net.Security.SslStream(tcp.GetStream(), false, remoteCertCallback, null);

                    //Try set LocalCertificateSelectionCallback
                    System.Net.Security.SslStream ssl =
                        new System.Net.Security.SslStream(tcp.GetStream(), false, remoteCertCallback, SelectLocalCertificate);

                    //Raise error: The handshake failed due to an unexpected packet format.
                    #region Try to specify the protocol, not working
                    ssl.AuthenticateAsClient(Server, null, System.Security.Authentication.SslProtocols.Tls12, true);
                    #endregion

                    #region Try to set local certificate, not working
                    //tried to set local certificate, not working
                    //X509CertificateCollection clientCertificates = GetLocalCertificates();
                    //ssl.AuthenticateAsClient(Server, clientCertificates, System.Security.Authentication.SslProtocols.Tls12, true);
                    #endregion

                    #region Default way, not working
                    //Raise error: The handshake failed due to an unexpected packet format.
                    //ssl.AuthenticateAsClient(Server);
                    #endregion


                }

            }
            //Raise error: The handshake failed due to an unexpected packet format.
            catch (Exception ex)
            {
                Console.WriteLine(ex.ToString());
            }

            Console.Read();

        }


        public static X509Certificate2Collection GetLocalCertificates()
        {
            X509Certificate2Collection Certificates = null;
            // Read the certificate from the store
            X509Store store = new X509Store(StoreName.My, StoreLocation.LocalMachine);
            try
            {
                store.Open(OpenFlags.ReadOnly);
                //Certificates = store.Certificates.Find(X509FindType.FindBySubjectDistinguishedName,
                //"CN=[YOUR DOMAIN]", false);
                Certificates = store.Certificates;
            }
            finally
            {
                store.Close();
            }

            return Certificates;
        }

        public static X509Certificate SelectLocalCertificate(
            object sender,
            string targetHost,
            X509CertificateCollection localCertificates,
            X509Certificate remoteCertificate,
            string[] acceptableIssuers)
        {
            if (acceptableIssuers != null &&
                acceptableIssuers.Length > 0 &&
                localCertificates != null &&
                localCertificates.Count > 0)
            {
                // Use the first certificate that is from an acceptable issuer.
                foreach (X509Certificate certificate in localCertificates)
                {
                    string issuer = certificate.Issuer;
                    if (Array.IndexOf(acceptableIssuers, issuer) != -1)
                        return certificate;
                }
            }
            if (localCertificates != null &&
                localCertificates.Count > 0)
                return localCertificates[0];

            return null;
        }

    }

Answer 1

最后，我们找到了解决方案，在这里发布以防万一有人遇到同样的问题：

所以有两种情况：
情况1：对于TLS，需要在第5步之后调用AuthenticateAsClient。
情况2：对于SSL ，需要在第 1 步后拨打AuthenticateAsClient。

我们的问题是我们在第 1 步之后调用了AuthenticateAsClient TLS，正确的位置是我们应该在发送Step 5 之后调用AuthenticateAsClient，在发送StartTLS 之后确保服务器返回支持 StartTSL 的信息。

步骤 1. 客户端：TCP 握手/连接
(For SSL only) call AuthenticateAsClient before EHLO
第 2 步。服务器：200 就绪
步骤 3. 客户：EHLO
步骤 4. 服务器：250 StartTLS（表示支持 TLS）
步骤 5. 客户端：StartTLS（发送 StartTLS 推荐）
(For TLS only) call AuthenticateAsClient after StartTLS
第 6 步。服务器：220 Go Head
第 7 步：客户端：发送加密数据/电子邮件（已编辑）