c# - 尝试从 WebAPI 获取 GET 时无法验证 HTTPS 连接

Question

我正在使用 ASP.NET Core。我有两个项目:

1. ASP.NET Core MVC 应用程序
2. ASP.NET Core Web API 应用程序

如果我尝试使用 Postman 访问 Web API 端点之一，我不会遇到任何问题； /api/values 端点按预期返回。 (这是标准测试端点。)

但是，如果我尝试使用 MVC 应用程序执行相同的操作，则会收到一个非常令人沮丧的错误:

HttpsConnectionFilter[1]
Failed to authenticate HTTPS connection

我使用 Kestrel for ASP.NET Core 进行托管。

我有一个使用 PowerShell 创建的自签名 PFX 证书，这是抛出异常的代码:

var handler = new HttpClientHandler();
handler.ClientCertificateOptions = ClientCertificateOption.Manual;
handler.SslProtocols = SslProtocols.Tls12;
handler.ClientCertificates.Add(new X509Certificate2("localcert.pfx", "xxx"));
var client = new HttpClient(handler);

var content = await client.GetStringAsync("https://localhost:44301/api/values");

如果我运行这个，我会得到同样的错误:

var client = new HttpClient();
var content = await client.GetStringAsync("https://localhost:44301/api/values");

我的 Kestrel 设置就像我的 Program.cs 中的那样:

var cert = new X509Certificate2("localcert.pfx", "xxx");

var host = new WebHostBuilder()
  .UseKestrel(cfg => cfg.UseHttps(cert))
  .UseUrls("https://localhost:44300")
  .UseContentRoot(Directory.GetCurrentDirectory())
  .UseIISIntegration()
  .UseStartup<Startup>()
  .Build();

host.Run();

我知道我再次为上面的HttpClient定义了证书，但我很绝望。

任何人都可以提供一些关于为什么会发生这种情况以及我如何修复它甚至调试它的见解吗？我目前正在逐步执行 KestrelHttpServer 代码，看看是否能提供一些见解。

这是我从 Kestrel 控制台窗口得到的完整错误:

info: HttpsConnectionFilter1 Failed to authenticate HTTPS connection. System.IO.IOException: Authentication failed because the remote party has closed the transport stream. at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest) at System.Net.Security.SslState.PartialFrameCallback(AsyncProtocolRequest asyncRequest) --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Net.Security.SslState.InternalEndProcessAuthentication(LazyAsyncResult lazyResult) at System.Net.Security.SslState.EndProcessAuthentication(IAsyncResult result) at System.Net.Security.SslStream.EndAuthenticateAsServer(IAsyncResult asyncResult) at System.Threading.Tasks.TaskFactory1.FromAsyncCoreLogic(IAsyncResult
iar, Func2 endFunction, Action1 endAction, Task1 promise, Boolean requiresSynchronization) --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.AspNetCore.Server.Kestrel.Https.HttpsConnectionFilter.d__6.MoveNext()

Answer 1

针对此问题，我发现的最直接的解决方案是删除证书并添加信任标志。

dotnet dev-certs https --clean
dotnet dev-certs https --trust

PS。我知道这已经很旧了，但我只是将其留在这里，供可能遇到此问题的人使用。