azure - Azure 应用服务中的 RavenDB Cloud 证书问题

Question

net5.0 ASP.NET Core 应用部署在 Azure 应用服务上。它使用带有证书的 https://a.free.xxxx.ravendb.cloud 。该证书在我的本地环境中正确加载。它给了我以下错误；但是，证书也会添加到 Azure 门户 - TLS/SSL 设置中.

Unhandled exception. System.InvalidOperationException: The supplied CN=free.transfocus certificate contains no private key. Constructing the certificate with the 'X509KeyStorageFlags.MachineKeySet' flag may solve this problem.
   at Raven.Client.Documents.DocumentStore.Initialize() in C:\Builds\RavenDB-Stable-5.1\51016\src\Raven.Client\Documents\DocumentStore.cs:line 222
   at Raven.DependencyInjection.RavenOptionsSetup.GetDocumentStore(Action`1 configureDbStore)
   at Raven.DependencyInjection.ServiceCollectionExtensions.<>c.<AddRavenDbDocStore>b__1_0(IServiceProvider sp)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitFactory(FactoryCallSite factoryCallSite, RuntimeResolverContext context)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor`2.VisitCallSiteMain(ServiceCallSite callSite, TArgument argument)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitCache(ServiceCallSite callSite, RuntimeResolverContext context, ServiceProviderEngineScope serviceProviderEngine, RuntimeResolverLock lockType)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitRootCache(ServiceCallSite singletonCallSite, RuntimeResolverContext context)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor`2.VisitCallSite(ServiceCallSite callSite, TArgument argument)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.Resolve(ServiceCallSite callSite, ServiceProviderEngineScope scope)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.DynamicServiceProviderEngine.<>c__DisplayClass1_0.<RealizeService>b__0(ServiceProviderEngineScope scope)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.ServiceProviderEngine.GetService(Type serviceType, ServiceProviderEngineScope serviceProviderEngineScope)
   at Microsoft.Extensions.DependencyInjection.ServiceLookup.ServiceProviderEngineScope.GetService(Type serviceType)
   at Microsoft.Extensions.DependencyInjection.ServiceProviderServiceExtensions.GetRequiredService(IServiceProvider provider, Type serviceType)
   at Microsoft.Extensions.DependencyInjection.ServiceProviderServiceExtensions.GetRequiredService[T](IServiceProvider provider)
   at Transfocus.Middleware.Program.Main(String[] args) in D:\a\1\s\Transfocus.Middleware\Transfocus.Middleware\Program.cs:line 26

程序.cs

                using (var scope = host.Services.CreateScope())
                {
                    var services = scope.ServiceProvider;
                    var store = services.GetRequiredService<IDocumentStore>();
                    var expiration = TimeSpan.FromDays(90);
                    var errorExpiration = TimeSpan.FromDays(180);

                    Log.Logger = new LoggerConfiguration()
                        .Enrich.FromLogContext()
                        .Enrich.With()
                        .MinimumLevel.Information()
                        .MinimumLevel.Override("Microsoft", LogEventLevel.Warning)
                        .MinimumLevel.Override("System", LogEventLevel.Warning)
                        .Filter.ByExcluding(c => c.Properties.Any(p => p.Value.ToString().ToLower().Contains("hangfire")))
                        .Filter.ByExcluding(c => c.Properties.Any(p => p.Value.ToString().ToLower().Contains(".ico")) || c.Properties.Any(p => p.Value.ToString().ToLower().Contains(".png")) || c.Properties.Any(p => p.Value.ToString().ToLower().Contains(".jpg")) )
                        .WriteTo.RavenDB(store, expiration: expiration, errorExpiration: errorExpiration)
                        .CreateLogger();
                }

我的启动类如下

            var dbConfig = Configuration.GetSection("Database").Get<AppSettings.Database>();

            var store = new DocumentStore
            {
                Urls = dbConfig.Urls,
                Database = dbConfig.DatabaseName
            };

            store.Conventions.UseOptimisticConcurrency = true;

            if (!string.IsNullOrWhiteSpace(dbConfig.CertPath))
                store.Certificate = new X509Certificate2(dbConfig.CertPath, dbConfig.CertPass, X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.PersistKeySet);

            store.Initialize();

            services.AddSingleton<IDocumentStore>(store);
            
            IndexCreation.CreateIndexes(typeof(Startup).Assembly, store);

            services.AddScoped<IAsyncDocumentSession>(sp => sp.GetService<IDocumentStore>()?.OpenAsyncSession());
            services.AddScoped<IDocumentSession>(sp => sp.GetService<IDocumentStore>()?.OpenSession());

Answer 1

感谢bartonjs的回答，可能对你有用。

<强> What is the impact of the PersistKeySet-StorageFlag when importing a Certificate in C#

引用链接:

1. Install a PFX file by using X509Certificate from a standard .NET application

2. Add support for opening a PFX with an ephemeral key #17166