沙箱蘋果支付測試握手失敗

我在驗證蘋果付費沙箱環境中的商家時遇到問題。採取從https://developer.apple.com/reference/applepayjs/applepaysession#2166532，一旦我的server then calls the Start Session endpoint at the provided URL，我得到一個500錯誤。沙箱蘋果支付測試握手失敗

我已經挖到了這500錯誤發生在網絡層的某個地方。如蘋果頁面上列出（https://developer.apple.com/reference/applepayjs/），我需要符合以下要求：

所有包含Apple Pay的頁面都必須通過HTTPS提供。 完成後，服務器在站點上有ssl/https
要啓用商家驗證，您的服務器必須允許通過HTTPS（通過端口443的TCP）訪問以下清單1中提供的Apple Pay IP地址。 DONE，服務器開放端口的所有IPS 443
您的服務器必須支持傳輸層安全（TLS）1.2協議，並在表1 服務器列出不支持TLS 1.2的密碼套件的一個，因爲我送在TLS 1.2請求對蘋果付出的開發服務器（下同）

我一直在使用Wireshark來查看發生了什麼事情，我似乎有一次未能服務器在的ChangeCipherSpec階段，後服務器將密碼規範發送回客戶端。（參考ssl程序：https://support.f5.com/csp/article/K15292）。正如你從我的圖像中看到的，我正在與蘋果付費沙盒服務器通信，傳入相同的受支持的tls協議和密碼套件，以至於錯誤會提示 - >Handshake Failure (40)，所以其他事情正在發生，我不知道到哪裏尋找

如果你看一下服務器問候消息，您可以看到服務器發現並接受客戶端，這也符合蘋果付費支持所需的密碼中的一個相匹配的密碼套件

我可以根據需要添加其他詳細信息

來源

2017-04-20 Zac

問題是我們的服務器默認情況下未啓用TLS 1.2。啓用TLS 1.2和禁用TLS 1.0解決了該問題 - 贏得2008年

編輯

有跡象表明，需要發生的幾件事情。我們的服務器在.net 4.5上，默認情況下不使用tls 1.2（蘋果要求使用tls 1.2）。所以，我們將我們的解決方案升級到.net 4.6，並且我們的請求也強制tls 1.2。此外，我們必須在我們對蘋果的請求中包含商戶ID證書（這在文檔中未提及）。

你可以在這裏找到我在這裏使用的源代碼（https://github.com/justeat/ApplePayJSSample）的github倉庫，但這裏是我的代碼，我需要在我的解決方案中放入工作（我還必須從我的Mac的鑰匙串中導出商家證書我把這個.p12文件導入到我的服務器的電腦證書存儲區）

[System.Web.Http.HttpPost] 
    public async Task<ContentResult> GetApplePaySession([FromBody] string url) 
    { 
     // http://stackoverflow.com/a/36912392/1837080 
     System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12; 

     // Load the merchant certificate for two-way TLS authentication with the Apple Pay server. 
     var certificate = LoadMerchantCertificate(); 

     // Get the merchant identifier from the certificate to send in the validation payload. 
     var merchantIdentifier = GetMerchantIdentifier(certificate); 

     // Create the JSON payload to POST to the Apple Pay merchant validation URL. 
     var payload = new ApplePayRequest() 
     { 
      merchantIdentifier = merchantIdentifier, 
      domainName = System.Web.HttpContext.Current.Request.Url.Host, 
      displayName = "[display name from apple developer portal]" 
     }; 

     JObject merchantSession; 

     // Create an HTTP client with the merchant certificate 
     // for two-way TLS authentication over HTTPS. 
     using (var httpClient = CreateHttpClient(certificate)) 
     { 
      var jsonPayload = JsonConvert.SerializeObject(payload); 

      using (var content = new StringContent(jsonPayload, Encoding.UTF8, "application/json")) 
      { 
       // POST the data to create a valid Apple Pay merchant session. 
       using (var response = await httpClient.PostAsync(url, content)) 
       { 
        response.EnsureSuccessStatusCode(); 

        // Read the opaque merchant session JSON from the response body. 
        var merchantSessionJson = await response.Content.ReadAsStringAsync(); 
        merchantSession = JObject.Parse(merchantSessionJson); 
       } 
      } 
     } 

     // Return the merchant session as JSON. 
     return Content(merchantSession.ToString(), "application/json"); 
    } 

    #region Apple Pay helper methods 

    private X509Certificate2 LoadMerchantCertificate() 
    { 
     X509Certificate2 certificate; 

     // Load the certificate from the current user's certificate store. This 
     // is useful if you do not want to publish the merchant certificate with 
     // your application, but it is also required to be able to use an X.509 
     // certificate with a private key if the user profile is not available, 
     // such as when using IIS hosting in an environment such as Microsoft Azure. 
     using (var store = new X509Store(StoreName.My, StoreLocation.LocalMachine)) 
     { 
      store.Open(OpenFlags.ReadOnly); 

      // when using thumbprint from mmc, look at: 
      // http://stackoverflow.com/a/14852713 
      // there is a hidden character that you must delete 
      var certificates = store.Certificates.Find(
       X509FindType.FindByThumbprint, 
       "[thumbprint]",      
       validOnly: false); 

      if (certificates.Count < 1) 
      { 
       throw new InvalidOperationException(
        // ReSharper disable once UseStringInterpolation 
        string.Format(
         "Could not find Apple Pay merchant certificate with thumbprint '{0}' from store '{1}' in location '{2}'.", 
         "‎[thumpprint]", store.Name, store.Location)); 
      } 

      certificate = certificates[0]; 
     } 

     return certificate; 
    } 

    private string GetMerchantIdentifier(X509Certificate2 certificate) 
    { 
     // This OID returns the ASN.1 encoded merchant identifier 
     var extension = certificate.Extensions["1.2.840.113635.100.6.32"]; 

     // Convert the raw ASN.1 data to a string containing the ID 
     return extension == null ? string.Empty : Encoding.ASCII.GetString(extension.RawData).Substring(2);    
    } 

    private HttpClient CreateHttpClient(X509Certificate2 certificate) 
    { 
     var handler = new WebRequestHandler(); 
     handler.ClientCertificates.Add(certificate); 

     return new HttpClient(handler, disposeHandler: true); 
    } 

    #endregion

來源

2017-04-25 20:56:03 Zac

沙箱蘋果支付測試握手失敗

回答

相關問題