azure - 替换在 .net6 应用程序中添加证书

Question

从 .net 4.8 升级到 .net 6 时，我正在努力替换现有的添加证书代码

这是升级后的设置:

程序.cs

private static async Task Main(string[] args)
    {
        WebApplicationBuilder builder = WebApplication.CreateBuilder(args);

        LoadConfiguration(builder);

        var startup = new MyWebApp.Startup(builder.Configuration);
        startup.ConfigureServices(builder.Services);

        WebApplication app = builder.Build();        
        await app.RunAsync().ConfigureAwait(false);
    }

启动.cs

public void ConfigureServices(IServiceCollection services)
        {
            //register
            RegisterServices(services);
            //register
        }

void RegisterServices(IServiceCollection services)
    {
        // DbContext       

        // Other project registrations
        //Repo etc
        services.RegisterClients(Configuration);
    }

客户CS项目

//Extension
public static class DIExtension
    {        
        // Registers the clients to the given builder        
        public static void RegisterClients(this IServiceCollection services, IConfiguration configuration)
        {
            //services.AddHttpClient

            services.AddHttpClient<IMyClient, MyClient>("MPC", c =>
            {
                c.DefaultRequestHeaders.ExpectContinue = true;
                c.BaseAddress = new Uri(configuration.GetConnectionString("Url"));
            }).ConfigurePrimaryHttpMessageHandler(() =>
                new HttpClientHandler().AddClientCertificate(configuration.GetValue<string>("MyCertificates:MyThumbprint")));
        }
    }

HttpHandlerExt

public static HttpClientHandler AddClientCertificate(this HttpClientHandler handler, string thumbPrint)
    {
        handler = handler ?? new HttpClientHandler();

        var cert = GetMyCertificate(thumbPrint);

        if (cert == null)
        {
            return handler;
        }

        handler.ClientCertificateOptions = ClientCertificateOption.Manual;
        handler.ClientCertificates.Add(cert);
        return handler;
    }

    private static X509Certificate2 GetMyCertificate(string thumbPrint)
    {
        var store = new X509Store(StoreName.My, StoreLocation.LocalMachine);
        try
        {
            store.Open(OpenFlags.ReadOnly);
            var col = store.Certificates.Find(X509FindType.FindByThumbprint, thumbPrint, false);
            if (col == null || col.Count == 0)
            {
                throw new CertificateException($"Certificate was not found for thumbprint {thumbPrint}");
            }
            return col[0];
        }
        finally
        {
            store.Close();
        }
    }

//appsettings

"MyCertificates": {
    "MyThumbprint": "thumprintvalue"
  },

指纹可在 KV 证书中找到。我不希望指纹值直接在应用程序设置中可用。如果需要任何其他信息，请告诉我，我已尽力提供尽可能多的信息和代码。

Answer 1

我们可以使用 Azure Key Vault SDK 从 Azure Key Vault 证书获取指纹。

• 我们只需传递 Key Vault URI。

安装 Azure.Identity 和 Azure.Security.KeyVault.Secrets NuGet 包

我的.csproj文件:

 <ItemGroup>
    <PackageReference Include="Azure.Identity" Version="1.9.0" />
    <PackageReference Include="Azure.Security.KeyVault.Secrets" Version="4.5.0" />
 </ItemGroup>

• 首先，我们将以字节格式检索指纹，然后使用 X509Certificate2 进行转换

我的 Startup.cs 文件:

using Azure.Identity;
using Azure.Security.KeyVault.Secrets;
using Microsoft.Extensions.Configuration;
using System.Security.Cryptography.X509Certificates;

internal class Startup
{
    private ConfigurationManager configuration;

    public Startup(ConfigurationManager configuration)
    {
        this.configuration = configuration;
    }
    public void ConfigureServices(IServiceCollection services)
    {
        RegisterServices(services);
    }

    void RegisterServices(IServiceCollection services)
    {       
        string Thumbprint = GetCertificateThumbprint();
    }

    static string GetCertificateThumbprint()
    {
        var KVCred = new DefaultAzureCredential();
        var KVURI = "https://harshukv4july.vault.azure.net/";

        var client = new SecretClient(new Uri(KVURI), KVCred);

        var CertName = "Certificare4July";
        var secret = client.GetSecret(CertName);

        byte[] ThumbPrintinBytes = Convert.FromBase64String(secret.Value.Value);

        var KVCertificate = new X509Certificate2(ThumbPrintinBytes);
        var CertThumbPrint = KVCertificate.Thumbprint;
        Console.WriteLine($"Thumbprint from Azure Certificate  : { CertThumbPrint }");

        return CertThumbPrint;
    }
}

输出:

验证Key Vault 证书中的值: