沙箱苹果支付测试握手失败

我在验证苹果付费沙箱环境中的商家时遇到问题。采取从https://developer.apple.com/reference/applepayjs/applepaysession#2166532，一旦我的server then calls the Start Session endpoint at the provided URL，我得到一个500错误。沙箱苹果支付测试握手失败

我已经挖到了这500错误发生在网络层的某个地方。如苹果页面上列出（https://developer.apple.com/reference/applepayjs/），我需要符合以下要求：

所有包含Apple Pay的页面都必须通过HTTPS提供。 完成后，服务器在站点上有ssl/https
要启用商家验证，您的服务器必须允许通过HTTPS（通过端口443的TCP）访问以下清单1中提供的Apple Pay IP地址。 DONE，服务器开放端口的所有IPS 443
您的服务器必须支持传输层安全（TLS）1.2协议，并在表1 服务器列出不支持TLS 1.2的密码套件的一个，因为我送在TLS 1.2请求对苹果付出的开发服务器（下同）

我一直在使用Wireshark来查看发生了什么事情，我似乎有一次未能服务器在的ChangeCipherSpec阶段，后服务器将密码规范发送回客户端。（参考ssl程序：https://support.f5.com/csp/article/K15292）。正如你从我的图像中看到的，我正在与苹果付费沙盒服务器通信，传入相同的受支持的tls协议和密码套件，以至于错误会提示 - >Handshake Failure (40)，所以其他事情正在发生，我不知道到哪里寻找

如果你看一下服务器问候消息，您可以看到服务器发现并接受客户端，这也符合苹果付费支持所需的密码中的一个相匹配的密码套件

我可以根据需要添加其他详细信息

来源

2017-04-20 Zac

问题是我们的服务器默认情况下未启用TLS 1.2。启用TLS 1.2和禁用TLS 1.0解决了该问题 - 赢得2008年

编辑

有迹象表明，需要发生的几件事情。我们的服务器在.net 4.5上，默认情况下不使用tls 1.2（苹果要求使用tls 1.2）。所以，我们将我们的解决方案升级到.net 4.6，并且我们的请求也强制tls 1.2。此外，我们必须在我们对苹果的请求中包含商户ID证书（这在文档中未提及）。

你可以在这里找到我在这里使用的源代码（https://github.com/justeat/ApplePayJSSample）的github仓库，但这里是我的代码，我需要在我的解决方案中放入工作（我还必须从我的Mac的钥匙串中导出商家证书我把这个.p12文件导入到我的服务器的电脑证书存储区）

[System.Web.Http.HttpPost] 
    public async Task<ContentResult> GetApplePaySession([FromBody] string url) 
    { 
     // http://stackoverflow.com/a/36912392/1837080 
     System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12; 

     // Load the merchant certificate for two-way TLS authentication with the Apple Pay server. 
     var certificate = LoadMerchantCertificate(); 

     // Get the merchant identifier from the certificate to send in the validation payload. 
     var merchantIdentifier = GetMerchantIdentifier(certificate); 

     // Create the JSON payload to POST to the Apple Pay merchant validation URL. 
     var payload = new ApplePayRequest() 
     { 
      merchantIdentifier = merchantIdentifier, 
      domainName = System.Web.HttpContext.Current.Request.Url.Host, 
      displayName = "[display name from apple developer portal]" 
     }; 

     JObject merchantSession; 

     // Create an HTTP client with the merchant certificate 
     // for two-way TLS authentication over HTTPS. 
     using (var httpClient = CreateHttpClient(certificate)) 
     { 
      var jsonPayload = JsonConvert.SerializeObject(payload); 

      using (var content = new StringContent(jsonPayload, Encoding.UTF8, "application/json")) 
      { 
       // POST the data to create a valid Apple Pay merchant session. 
       using (var response = await httpClient.PostAsync(url, content)) 
       { 
        response.EnsureSuccessStatusCode(); 

        // Read the opaque merchant session JSON from the response body. 
        var merchantSessionJson = await response.Content.ReadAsStringAsync(); 
        merchantSession = JObject.Parse(merchantSessionJson); 
       } 
      } 
     } 

     // Return the merchant session as JSON. 
     return Content(merchantSession.ToString(), "application/json"); 
    } 

    #region Apple Pay helper methods 

    private X509Certificate2 LoadMerchantCertificate() 
    { 
     X509Certificate2 certificate; 

     // Load the certificate from the current user's certificate store. This 
     // is useful if you do not want to publish the merchant certificate with 
     // your application, but it is also required to be able to use an X.509 
     // certificate with a private key if the user profile is not available, 
     // such as when using IIS hosting in an environment such as Microsoft Azure. 
     using (var store = new X509Store(StoreName.My, StoreLocation.LocalMachine)) 
     { 
      store.Open(OpenFlags.ReadOnly); 

      // when using thumbprint from mmc, look at: 
      // http://stackoverflow.com/a/14852713 
      // there is a hidden character that you must delete 
      var certificates = store.Certificates.Find(
       X509FindType.FindByThumbprint, 
       "[thumbprint]",      
       validOnly: false); 

      if (certificates.Count < 1) 
      { 
       throw new InvalidOperationException(
        // ReSharper disable once UseStringInterpolation 
        string.Format(
         "Could not find Apple Pay merchant certificate with thumbprint '{0}' from store '{1}' in location '{2}'.", 
         "‎[thumpprint]", store.Name, store.Location)); 
      } 

      certificate = certificates[0]; 
     } 

     return certificate; 
    } 

    private string GetMerchantIdentifier(X509Certificate2 certificate) 
    { 
     // This OID returns the ASN.1 encoded merchant identifier 
     var extension = certificate.Extensions["1.2.840.113635.100.6.32"]; 

     // Convert the raw ASN.1 data to a string containing the ID 
     return extension == null ? string.Empty : Encoding.ASCII.GetString(extension.RawData).Substring(2);    
    } 

    private HttpClient CreateHttpClient(X509Certificate2 certificate) 
    { 
     var handler = new WebRequestHandler(); 
     handler.ClientCertificates.Add(certificate); 

     return new HttpClient(handler, disposeHandler: true); 
    } 

    #endregion

来源

2017-04-25 20:56:03 Zac

沙箱苹果支付测试握手失败

回答

相关问题