NDES 无法解密客户端的 PKCS7消息 0x80090027

Gundm 21 Reputation points
2021-07-07T03:09:54.457+00:00

我用C语言根据SCEP协议规范封装了一套与CA服务器(使用了WIndows server 12 搭建的)交互的接口功能,首先,测试了GeCACert方法,我可以从NDES 获取到CA服务器的根证书。然后我使用PKCSReq ,封装了CSR的CMS 格式去申请证书,我用的是GET编码方式:
IIS 8日志记录为:
GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation&message=MIIIYgYJKoZIhvcNAQcCoIIIUzCCCE8CAQExDjAMBggqhkiG9w0CBQUAMIIDlwYJ
KoZIhvcNAQcBoIIDiASCA4QwggOABgkqhkiG9w0BBwOgggNxMIIDbQIBADGCAXQw
ggFwAgEAMFgwRDETMBEGCgmSJomT8ixkARkWA2NvbTEZMBcGCgmSJomT8ixkARkW
CWhpa2F1dG9jYTESMBAGA1UEAxMJaGlrYXV0b2NhAhB/8paJGXodqk1F4PgbJabi
MA0GCSqGSIb3DQEBAQUABIIBAEaUAUyzYwP6JB5fPQV2vrA/2gP7FF/h2CzfszEt
bjaEC2QL04aWrQTDOAFjTO0es9ZL7VGCPZ5hXUe6W38UIdrBvmfg6OHx1XiaxU3X
N98I2MXa+PKorlVN+smQctT+2uZ9RxHqBr9MCtLZTFFRfYZ55tHFL7ePV0lvyX+o
abBMV7iG/DRrUDItBwlPjSpPfnXUnBacWc8J/t14lczyxt+dvoK+EvJ/i0fTfA+B
20T7MNigdGkfJZQqnUtfNO1TMb5yM/RSWtpDd9b0KMmOmklxUYu8ZgNydIV3Pz22
lg2fe9AK3oYUZ8K5+AJ3tHVu/DtyTtitwgWejpzjXQv49rEwggHuBgkqhkiG9w0B
BwEwHQYJYIZIAWUDBAEqBBAnSxwdCIVwXXez8FU7Az6ggIIBwHzsoPuf6UMeNpNO
p89K/vX3ZlsC5ZCJccnYE2Zsjs6EXDIYbwSqGylY77q2WK1j25LMPWoarFCZqzHs
OhuWpfnOYkwA2xmNGbUjxHAVeZN0OVD2O2067mX8vJciUYdLW2sJlm1K60RiPkyg
gGwQOhISc26Ckt52rsjB4Zkm18q3ahrl9ml5TYbOZ50/xo5jXHulDATqC0yE3ozk
fb7tFTnVxIt4NogplcRIci/KsqTxRPFnzEVo8HSqUN4R1Seb8MNy+SaMpfMi5N9v
6k9KGluUbs3yuasvKEZc/6xxGjSE+foaLkfn8Eyr2KlhD6i7xniq12LMS5HV7H8s
2DfoBhdaEH/079ZNKYbASCyDap1uYKPt+D+xs2r8b/yDOKRmJfB/4JqZ0P0IYugz
8u/Ee0yqJHAnicPXV4L91hP44G2JO5dry6A1ASu/IZHIfy0SQENjKRShClA0cYHp
LLU6sW1L4jsreH76ZrmOX9eQL30Vndq+LvQkhHRr7DIFZFplAm75z/xfYcQE/0V3
5dJiU5ACc67DaLVCck20uX+4CHwuUqs7RLBxHEYC3/RVf4IAkQOQ4WmZwfdqKvyn
55njMTugggKsMIICqDCCAhGgAwIBAgIJALlVeHa7n1ChMA0GCSqGSIb3DQEBBQUA
MG0xCzAJBgNVBAYTAkNOMQswCQYDVQQIDAJIWjELMAkGA1UEBwwCSFoxEDAOBgNV
BAoMB0hJS0FVVE8xCzAJBgNVBAsMAlJEMQwwCgYDVQQDDANZS1kxFzAVBgkqhkiG
9w0BCQEWCDg4ODg4ODg4MB4XDTIxMDYwNDA4MzM1OFoXDTIyMDYwNDA4MzM1OFow
bTELMAkGA1UEBhMCQ04xCzAJBgNVBAgMAkhaMQswCQYDVQQHDAJIWjEQMA4GA1UE
CgwHSElLQVVUTzELMAkGA1UECwwCUkQxDDAKBgNVBAMMA1lLWTEXMBUGCSqGSIb3
DQEJARYIODg4ODg4ODgwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKvhqPht
EoGyl5pw6P3kRay+N/OHPYrFLTAz+IbaYQDHDEIaOnPKrvGxckxPJBl3zA/+OJkQ
ZHaFt/c/0xu1RQfiWg7eya2YyBndjJp+iaqlShrQVGZCGOlTl+JPSVJ2z7OpdXDw
mao8lhMkrPZy1qfw3rc+L8M3Z516j3YFrzJhAgMBAAGjUDBOMB0GA1UdDgQWBBSt
TOnbXcpTbsvJA2oH29XHqlcidTAfBgNVHSMEGDAWgBStTOnbXcpTbsvJA2oH29XH
qlcidTAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBAKejNvWsrVRM10iV
mvO/4TsptuPNHqZFA2j4pxMYKcRlIaEDEb8qU2N2pvgsAbdQ+4n3wWnmqsfzXSk6
R+LLIdP19dkt+rpHxje0zV2qWkOWHlM02qEKHKNgGUK6uM46BEvFViIR8JxwOSXh
P6qYOFAI9Pppjn0vMtVz3FOkSrnkMYIB7TCCAekCAQEwejBtMQswCQYDVQQGEwJD
TjELMAkGA1UECAwCSFoxCzAJBgNVBAcMAkhaMRAwDgYDVQQKDAdISUtBVVRPMQsw
CQYDVQQLDAJSRDEMMAoGA1UEAwwDWUtZMRcwFQYJKoZIhvcNAQkBFgg4ODg4ODg4
OAIJALlVeHa7n1ChMAwGCCqGSIb3DQIFBQCggccwEgYKYIZIAYb4RQEJAjEEEwIx
OTAcBgkqhkiG9w0BCQUxDxcNMjEwNzA2MTIzMjU5WjAfBgkqhkiG9w0BCQQxEgQQ
SZzqApdGrIrDr94vKQlY1TAgBgpghkgBhvhFAQkFMRIEELI61yXa20vNC/UPQ034
DjgwUAYKYIZIAYb4RQEJBzFCE0BGRkJBM0YwQTVCNzk0NDcwQUE4QzEwRUYzMDIw
MzkzOUQ2MUZGNDU3OTEyREJCODI4REUxNjZBNkFCMUZCNTk1MA0GCSqGSIb3DQEB
AQUABIGAgWzys4s8ByvB9bCzn2DNEHG20PrWIShIY3iY7/d3anaqEhHGIW+u3VVb
gqkuY/1J5urvifSjPr6VsJP6KTtw87NtpyJhPbSvjlggA2wi6AR0VNEazuCqHW5J
5OhNCunhEo8Z6X+zVR2lFS/25JArOgzOi4gxG8BQ3BF7a8DJusI=

问题出现了: NDES 的windows日志 显示错误码:0x80090027 参数错误。我没有找到这个错误码对应的详细信息,不知道这个参数错误是不是服务器没有解码成功BASE64呢?谢谢为我抽出时间解答 的朋友们

Internet Information Services
Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
11,935 questions
{count} votes

Accepted answer
  1. Yuhan Deng 3,761 Reputation points Microsoft Vendor
    2021-07-07T07:28:37.867+00:00

    您好,
    这个问题超出了我们论坛支持的范围,我建议您在github寻求建议:
    https://github.com

    我自己也查了一些资料,但不确定能否帮到您,请参考此文档:
    https://learn.microsoft.com/zh-cn/mem/intune/protect/certificates-scep-configure

    感谢您的理解。
    Best regards,
    Danny

    -----------------------------

    If the Answer is helpful, please click "Accept Answer" and upvote it.

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments No comments

0 additional answers

Sort by: Most helpful