c# - 带有 azure keyvault 证书的 Asp.net 核心 docker 中的 Https 不起作用

Question

我在 docker 和 Azure Service Fabric 中有一个 Asp.net Core 3.1 Web 应用程序。
asp.net 核心 Web 应用程序启用了 https 并从 AzureKeyVault 获取其证书。部署后，似乎 https 没有响应，但 http 有效。
控制台主机看起来如此

public static void ConfigureKestrelServer(this IWebHostBuilder host)
    {
        try
        { 
            host.ConfigureKestrel(options =>
            {
               
                options.ConfigureHttpsDefaults(listenOptions =>
                {
                    listenOptions.ServerCertificate = GetCertificateFromStore();
                });

            });
        }
        catch (System.Exception e)
        {
            throw;
        }
    }

    public static X509Certificate2 GetCertificateFromStore()
    {
        return  AzureKeyVaultExtensions.GetCertificateSecretAsync().GetAwaiter().GetResult();
    }

上面的代码可以在部署时下载证书。 docker 文件看起来像这样

FROM  mcr.microsoft.com/dotnet/core/aspnet:3.1    
ARG source
WORKDIR /app
ADD ${source} . 
ENV APP_UTILS=C:\\app 
VOLUME ${APP_UTILS}    
EXPOSE 80
EXPOSE 443 
ENTRYPOINT ["dotnet", "MyWebApp.dll"]

Answer 1

您可能应该在容器前面的某处执行 SSL 终止。但是如果你想在容器中做，我相信你也需要通过 Service Fabric 映射端口。
https://docs.microsoft.com/en-us/azure/service-fabric/service-fabric-tutorial-package-containers#configure-communication-and-container-port-to-host-port-mapping
https://docs.microsoft.com/en-us/azure/service-fabric/service-fabric-service-manifest-resources#example-specifying-an-https-endpoint-for-your-service
您可能需要在此处输入第二个条目:

<Resources>
  <Endpoints>
      <!-- This endpoint is used by the communication listener to obtain the port number on which to
           listen. Note that if your service is partitioned, this port is shared with
           replicas of different partitions that are placed in your code. -->
      <Endpoint Name="ServiceEndpoint1" Protocol="http"/>
      <Endpoint Name="ServiceEndpoint2" Protocol="http" Port="80"/>
      <Endpoint Name="ServiceEndpoint3" Protocol="https"/>
      <Endpoint Name="ServiceEndpoint4" Protocol="https" Port="14023"/>
  </Endpoints>
</Resources>

还有一个bin 更多信息 specifically on HTTPs ，但您需要检查哪个部分适用于您的设置。