最后申请下来的证书，大致如上图所示，必须是服务器身份认证证书（至少证书目的里由“保证远程计算机身份”），而且必须得有一个该证书对应的私钥，这个私钥应该是在DPAPI（CAPI）存储器里存着呢，按照上面的操作应该会得到这样的一个证书。用makecert -r -pe -n "CN=TestCert" -e 01/01/2036 -sr localMachine c:" TestCert.cer生成的证书不会有对应的私钥，这样的证书是不能用的，到时候客户端验证的时候会抛一个异常，提示你没有私钥（需要一个关联私钥的证书）。

查看本机已安装的证书，在IE的选项－内容－证书选项里（在控制台里添加/删除管理单元里添加“证书管理单元”也可以管理）。

申请服务端证书，姓名字段一定要写成服务器的名称，netbios名或者dns名称。

类库
using System;
using System.Net.Sockets;
using System.Net;
using System.Net.Security;
using System.Security.Cryptography.X509Certificates;
using System.Text;
using System.Security.Authentication;
using System.Threading;

class TCPServer_SSL
{
    private TcpListener _listener = null;
    private IPAddress _address = IPAddress.Parse("127.0.0.1");
    private int _port = 55555;

    CTORs#region CTORs
    public TCPServer_SSL()
    {
    }

    public TCPServer_SSL(string address, string port)
    {
        _port = Convert.ToInt32(port);
        _address = IPAddress.Parse(address);
    }
    #endregion // CTORs

    Properties#region Properties
    public IPAddress Address
    {
        get { return _address; }
        set { _address = value; }
    }

    public int Port
    {
        get { return _port; }
        set { _port = value; }
    }
    #endregion

    public void Listen()
    {
        try
        {
            _listener = new TcpListener(_address, _port);

            // Fire up the server.
            _listener.Start();

            // Enter the listening loop.
            while (true)
            {
                Console.Write("Looking for someone to talk to… ");

                // Wait for connection.
                TcpClient newClient = _listener.AcceptTcpClient();
                Console.WriteLine("Connected to new client");

                // Spin a thread to take care of the client.
                ThreadPool.QueueUserWorkItem(new WaitCallback(ProcessClient),
                                         newClient);
            }


        }
        catch (SocketException e)
        {
            Console.WriteLine("SocketException: {0}", e);
        }
        finally
        {
            // Shut it down.
            _listener.Stop();
        }

        Console.WriteLine("/nHit any key (where is ANYKEY?) to continue…");
        Console.Read();
    }

    private void ProcessClient(object client)
    {
        using (TcpClient newClient = (TcpClient)client)
        {
            // Buffer for reading data.
            byte[] bytes = new byte[1024];
            string clientData = null;

            //第三个参数是验证客户端证书的回调，最后一个参数是用来指定多个证明自己的证书的回调，这里为空
            //前两个参数分别是一个流和是否在关闭sslstrem关闭内部流的选项
            using (SslStream sslStream = new SslStream(newClient.GetStream(), false, ValidateClientCertificate,null))
            {
                try
                {
                    //该方法的第一个参数是用于服务端身份验证的证书,第二个参数指定是否需要验证客户端的身份
                    //第三个参数是指定安全传输的协议，最后一个参数指定是否检查吊销证书
                    sslStream.AuthenticateAsServer(GetServerCert("117f32ff000000000007"), true, SslProtocols.Tls, false);
                }
                catch (Exception ex)
                {
                    Console.WriteLine(ex);
                }

                // Loop to receive all the data sent by the client.
                int bytesRead = 0;

                while ((bytesRead = sslStream.Read(bytes, 0, bytes.Length)) != 0)
                {
                    // Translate data bytes to an ASCII string.
                    clientData = Encoding.ASCII.GetString(bytes, 0, bytesRead);
                    Console.WriteLine("Client says: {0}", clientData);

                    // Thank them for their input.
                    bytes = Encoding.ASCII.GetBytes("Thanks call again!");

                    // Send back a response.

                    sslStream.Write(bytes, 0, bytes.Length);
                }
            }
        }
    }

    public static bool ValidateClientCertificate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
    {
        Console.WriteLine("ValidateClientCertificate-certificate.Subject:/r/n{0}", certificate.Subject);
        if (sslPolicyErrors != SslPolicyErrors.None && sslPolicyErrors != SslPolicyErrors.RemoteCertificateChainErrors)
            return false;
        if (sslPolicyErrors != SslPolicyErrors.RemoteCertificateChainErrors)
        {
            //不判断吊销证书
            foreach (X509ChainStatus s in chain.ChainStatus)
            {
                Console.WriteLine("ValidateClientCertificate-chain.ChainStatus:/r/n{0}-{1}", s.Status, s.StatusInformation);
                if (s.Status != X509ChainStatusFlags.OfflineRevocation && s.Status != X509ChainStatusFlags.RevocationStatusUnknown)
                {
                    return false;
                }
            }
        }
        return true;
    }
    //该方法从本地计算机的个人证书区域按证书序列号查找指定的证书用于服务器身份验证
    //以及打印出证书的详细信息
    private static X509Certificate GetServerCert(string serialNumber)
    {
        X509Store store = new X509Store(StoreName.My, StoreLocation.CurrentUser);
        try
        {
            store.Open(OpenFlags.ReadOnly);
            X509Certificate2Collection certificate =
                    store.Certificates.Find(X509FindType.FindBySerialNumber,
                                            serialNumber, true);
            X509Certificate2 x509 = certificate[0];
            byte[] rawdata = x509.RawData;
            Console.WriteLine("509 count :{0}", store.Certificates.Count);
            Console.WriteLine("Content Type: {0}{1}", X509Certificate2.GetCertContentType(rawdata), Environment.NewLine);
            Console.WriteLine("Friendly Name: {0}{1}", x509.FriendlyName, Environment.NewLine);
            Console.WriteLine("Certificate Verified?: {0}{1}", x509.Verify(), Environment.NewLine);
            Console.WriteLine("Simple Name: {0}{1}", x509.GetNameInfo(X509NameType.SimpleName, true), Environment.NewLine);
            Console.WriteLine("Signature Algorithm: {0}{1}", x509.SignatureAlgorithm.FriendlyName, Environment.NewLine);
            Console.WriteLine("Private Key: {0}{1}", x509.PrivateKey.ToXmlString(false), Environment.NewLine);
            Console.WriteLine("Public Key: {0}{1}", x509.PublicKey.Key.ToXmlString(false), Environment.NewLine);
            Console.WriteLine("Certificate Archived?: {0}{1}", x509.Archived, Environment.NewLine);
            Console.WriteLine("Length of Raw Data: {0}{1}", x509.RawData.Length, Environment.NewLine);
            Console.WriteLine("x509.SerialNumber: {0}{1}", x509.SerialNumber, Environment.NewLine);

            if (certificate.Count > 0)
                return (certificate[0]);
            else
                return (null);
        }
        catch (Exception ex)
        {
            Console.WriteLine(ex);
            return null;
        }
        finally
        {
            store.Close();
        }
    }
}

控制台代码
 static void Main(string[] args)
        {
            try
            {
                TCPServer_SSL server = new TCPServer_SSL("127.0.0.1", "8000");
                server.Listen();
            }
            catch (Exception ex)
            {
                Console.WriteLine(ex);
            }
            Console.Read();
        }

类库
using System;
using System.Net.Sockets;
using System.Net;
using System.Net.Security;
using System.Security.Cryptography.X509Certificates;
using System.Text;
class TCPClient_SSL
{
    private TcpClient _client = null;
    private IPAddress _address = IPAddress.Parse("127.0.0.1");
    private int _port = 5;
    private IPEndPoint _endPoint = null;

    public TCPClient_SSL(string address, string port)
    {
        _address = IPAddress.Parse(address);
        _port = Convert.ToInt32(port);
        _endPoint = new IPEndPoint(_address, _port);
    }

    public void ConnectToServer(string msg)
    {
        try
        {
            using (_client = new TcpClient())
            {
                _client.Connect(_endPoint);

                //SslStream第一个参数是一个流，可以是由用Socket类new的一个NetworkStream
                //第二个参数为false的时候，关闭sslStream就会关闭对应的NetworkStream
                //第三个参数是一个回调，用来控制服务端的验证
                using (SslStream sslStream = new SslStream(_client.GetStream(),
                                false, new RemoteCertificateValidationCallback(
                                    ValidateServerCertificate)))
                {

                    X509CertificateCollection cert = new X509CertificateCollection();
                    //下面是从一个导出证书文件里加载证书
                    X509Certificate cer = X509Certificate2.CreateFromCertFile("c://certs//huhao.cer");
                    cert.Add(cer);
                    //AuthenticateAsClient方法第一个参数要写服务端证书的名字,和服务器的机器名和dns名应一致
                    //第二个参数是一个证书集合，如果是多个证书，可以在一个回调函数里选择指定证书用以验证客户端
                    //第三个参数指定安全传输的协议，可以是ssl,tls的不同版本
                    //最后一个参数表示是否检查吊销证书列表，吊销证书是定时推给服务器的，验证起来比较耗性能
                    sslStream.AuthenticateAsClient("ms-7fa82788ed1e", cert, System.Security.Authentication.SslProtocols.Tls, false);
                    sslStream.ReadTimeout = 5000;
                    sslStream.WriteTimeout = 5000;

                    // Get the bytes to send for the message.
                    byte[] bytes = Encoding.ASCII.GetBytes(msg);

                    // Send message.
                    Console.WriteLine("Sending message to server: " + msg);

                    //这里可以使用BeginWrite
                    sslStream.Write(bytes, 0, bytes.Length);

                    // Get the response.
                    // Buffer to store the response bytes.
                    bytes = new byte[1024];

                    // Display the response.
                    //这里可以使用BeginRead
                    int bytesRead = sslStream.Read(bytes, 0, bytes.Length);
                    string serverResponse = Encoding.ASCII.GetString(bytes, 0,
                          bytesRead);
                    Console.WriteLine("Server said: " + serverResponse);
                }
            }
        }
        catch (SocketException e)
        {
            Console.WriteLine("There was an error talking to the server: {0}",
            e.ToString());
        }
    }


    private bool ValidateServerCertificate(object sender,
                                               X509Certificate certificate,
                                               X509Chain chain,
                                               SslPolicyErrors sslPolicyErrors)
    {
        if (sslPolicyErrors == SslPolicyErrors.None)
        {
            return true;
        }
        else
        {
            if (sslPolicyErrors == SslPolicyErrors.RemoteCertificateChainErrors)
            {
                Console.WriteLine("The X509Chain.ChainStatus returned an array " +
                   "of X509ChainStatus objects containing error information.");
            }
            else if (sslPolicyErrors ==
                     SslPolicyErrors.RemoteCertificateNameMismatch)
            {
                Console.WriteLine("There was a mismatch of the name " +
                  "on a certificate.");
            }
            else if (sslPolicyErrors ==
                     SslPolicyErrors.RemoteCertificateNotAvailable)
            {
                Console.WriteLine("No certificate was available.");
            }
            else
            {
                Console.WriteLine("SSL Certificate Validation Error!");
            }
        }

        Console.WriteLine(Environment.NewLine +
                          "SSL Certificate Validation Error!");
        Console.WriteLine(sslPolicyErrors.ToString());

        return false;
    }
}

static void Main(string[] args)
        {
            try
            {
                TCPClient_SSL client = new TCPClient_SSL("127.0.0.1", "8000");
                client.ConnectToServer("11111");
            }
            catch (Exception ex)
            {
                Console.WriteLine(ex);
            }
            Console.Read();
        }

using System;
using System.Net;
using System.Net.Security;
using System.Security.Cryptography.X509Certificates;
using CallSslWebService.cxz;

namespace CallSslWebService
{
    class Program
    {
        static void Main(string[] args)
        {
            try
            {
                //挂接验证服务端证书的回调
                ServicePointManager.ServerCertificateValidationCallback = RemoteCertificateValidationCallback;

cxz.Service service = new Service(); //实例一个web服务

//如果web服务没有启用匿名访问，要声明credentials
                ICredentials credentials = new NetworkCredential("administrator", "1234%^@");
                service.Credentials = credentials;
                
                //如果服务器要求提供客户端证书，下面代码提供了客户端证书
                X509Certificate cer = X509Certificate.CreateFromCertFile("C://certs//client.cer");
                service.ClientCertificates.Add(cer);

//调用web服务
                Console.WriteLine(service.HelloWorld());
            }
            catch (Exception ex)
            {
                Console.WriteLine(ex);
            }
            Console.Read();
        }

public static bool RemoteCertificateValidationCallback(Object sender,
            X509Certificate certificate,
            X509Chain chain,
            SslPolicyErrors sslPolicyErrors)
        {
            //如果没有错就表示验证成功
            if (sslPolicyErrors == SslPolicyErrors.None)
                return true;
            return false;
        }
    }
}