Azure App Service中无法构建可信根证书颁发机构证书链问题

我通过Visual Studio将ASP.NET应用部署至Azure App Service，代码中包含的.pfx文件也同步部署到了服务器。但调用需使用该证书签名请求的外部API时，出现如下错误，而应用在本地Windows机器上运行正常：

Server Error in '/' Application. 

A certificate chain could not be built to a trusted root authority.

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.Security.Cryptography.CryptographicException: A certificate chain could not be built to a trusted root authority.

Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace:

[CryptographicException: A certificate chain could not be built to a trusted root authority.]
   System.Security.Cryptography.Pkcs.PkcsUtils.CreateBagOfCertificates(CmsSigner signer) +316270
   System.Security.Cryptography.Pkcs.SignedCms.Sign(CmsSigner signer, Boolean silent) +259
   System.Security.Cryptography.Pkcs.SignedCms.ComputeSignature(CmsSigner signer, Boolean silent) +425
   Digi_Sign.PFX.PFX_signing_Json_Multiple_Pan.Sign(Byte[] data, X509Certificate2 certificate) in C:\Users\BhushanBhalerao\Downloads\DotNet_sample\DotNet_Codes\Digi_Sign\Digi_Sign\PFX_signing_Json_Multiple_Pan.aspx.cs:387
   Digi_Sign.PFX.PFX_signing_Json_Multiple_Pan.btnvalidate_Click(Object sender, EventArgs e) in C:\Users\BhushanBhalerao\Downloads\DotNet_sample\DotNet_Codes\Digi_Sign\Digi_Sign\PFX_signing_Json_Multiple_Pan.aspx.cs:96
   System.Web.UI.WebControls.Button.OnClick(EventArgs e) +11628060
   System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument) +274
   System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +1959

已执行的排查步骤 #

• 通过Kudu控制台和FTP确认服务器上存在.pfx文件；
• 已在Azure App Service的证书管理区域添加该.pfx证书。

解决方案 #

• 补全证书信任链
  本地Windows系统会自动补充证书的中间/根CA，但Azure App Service的信任存储可能缺失对应条目。请将用户证书、中间CA证书、根CA证书打包到同一个PFX文件中，或单独将缺失的中间/根CA导入Azure App Service的信任存储。
• 优化证书加载参数
  若直接从文件加载PFX，加载时需指定正确的密钥存储标志，避免权限问题：

  var cert = new X509Certificate2("path/to/cert.pfx", "password", 
      X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.PersistKeySet | X509KeyStorageFlags.Exportable);
  

• 改用Azure证书存储加载证书
  不要直接读取部署的PFX文件，通过Azure App Service证书管理添加后，从系统存储中加载，Azure会自动处理信任链和权限：

  using (var store = new X509Store(StoreName.My, StoreLocation.CurrentUser))
  {
      store.Open(OpenFlags.ReadOnly);
      var certCollection = store.Certificates.Find(X509FindType.FindByThumbprint, "你的证书指纹", false);
      if (certCollection.Count > 0)
      {
          var signingCert = certCollection[0];
          // 执行签名操作
      }
  }
  

• 验证根CA的信任状态
  检查证书的根CA是否在Azure App Service信任的根证书列表内，私有CA或自定义CA的根证书需手动导入，可通过Azure CLI或PowerShell完成。
• 检查证书有效性
  确认证书未过期，具备数字签名的增强型密钥用法，且PFX密码正确、私钥可正常访问。

内容的提问来源于stack exchange，提问作者Bhushan Bhalerao