ASP.NET Core Web API无法读取POST请求中客户端X509证书求助

核心问题定位 #

你当前的关键问题是服务器未主动要求客户端提供证书——即便WPF端在请求中附加了证书，Kestrel（Visual Studio 2022中ASP.NET Core项目默认使用的服务器）默认不会主动获取并验证它。

解决方案步骤 #

1. 配置Kestrel强制要求客户端证书

在Program.cs中添加Kestrel的HTTPS配置，明确要求客户端提交证书：

var builder = WebApplication.CreateBuilder(args);

// 配置Kestrel监听HTTPS并要求客户端证书
builder.WebHost.ConfigureKestrel(options =>
{
    options.ListenAnyIP(7266, listenOptions =>
    {
        listenOptions.UseHttps(httpsOptions =>
        {
            // 指定你的localhost自签名证书（可通过证书指纹或文件路径指定）
            httpsOptions.ServerCertificate = new X509Certificate2("localhost-cert.pfx", "cert-password");
            // 设置为强制要求客户端证书
            httpsOptions.ClientCertificateMode = ClientCertificateMode.RequireCertificate;
        });
    });
});

// 原有认证配置保留
builder.Services.AddControllers();
builder.Services.AddEndpointsApiExplorer();

builder.Services.AddAuthentication(CertificateAuthenticationDefaults.AuthenticationScheme)
    .AddCertificate(options =>
    {
        options.AllowedCertificateTypes = CertificateTypes.All;
        options.RevocationMode = X509RevocationMode.NoCheck;
        options.Events = new CertificateAuthenticationEvents
        {
            OnCertificateValidated = context =>
            {
                // 添加日志确认证书是否进入验证流程
                Console.WriteLine($"客户端证书主题: {context.ClientCertificate.Subject}");
                
                var claims = new[]
                {
                    new Claim(ClaimTypes.NameIdentifier, context.ClientCertificate.Subject, ClaimValueTypes.String, context.Options.ClaimsIssuer),
                    new Claim(ClaimTypes.Name, context.ClientCertificate.Subject, ClaimValueTypes.String, context.Options.ClaimsIssuer)
                };

                context.Principal = new ClaimsPrincipal(new ClaimsIdentity(claims, context.Scheme.Name));
                context.Success();

                return Task.CompletedTask;
            }
        };
    });

var app = builder.Build();

if (app.Environment.IsDevelopment())
{
}

app.UseHttpsRedirection();

app.UseAuthentication();
app.UseAuthorization();

app.MapControllers();

app.Run();

2. 给控制器方法添加认证授权

修改Submit控制器，给目标方法加上[Authorize]属性，确保只有通过证书认证的请求才能访问，同时可靠获取证书：

using Microsoft.AspNetCore.Mvc;
using System.Security.Cryptography.X509Certificates;

namespace MySampleNet.Controllers
{
    [ApiController]
    [Route("[controller]")]
    public class Submit : Controller
    {
        [Authorize]
        public string Index()
        {
            var clientCert = HttpContext.Connection.ClientCertificate;
            if (clientCert != null && !clientCert.Equals(X509Certificate2.Empty))
            {
                return $"收到客户端证书: {clientCert.Subject}";
            }
            return "未获取到客户端证书";
        }
    }
}

3. 验证WPF端请求有效性

确保PickCACCertificate()方法返回有效证书，在WPF端添加日志确认：

public void MyTesting()
{
    var postURL = "https://localhost:7266/submit";
    var cert = PickCACCertificate();
    
    if (cert == null || cert.Equals(X509Certificate2.Empty))
    {
        Console.WriteLine("未选中有效客户端证书");
        return;
    }
    Console.WriteLine($"选中证书主题: {cert.Subject}");

    var request = WebRequest.Create(postURL) as HttpWebRequest;
    request.Method = "POST";
    request.Accept = "*/*";
    request.ClientCertificates.Add(cert);
    request.UseDefaultCredentials = false;
    request.PreAuthenticate = true;
    request.AllowAutoRedirect = true;

    try
    {
        var webResponse = request.GetResponse() as HttpWebResponse;
        var responseReader = new StreamReader(webResponse.GetResponseStream());
        var fullResponse = responseReader.ReadToEnd();
        Console.WriteLine($"API响应: {fullResponse}");
        webResponse.Close();
    }
    catch (WebException ex)
    {
        Console.WriteLine($"请求异常: {ex.Message}");
    }
}

4. 调试辅助技巧

• 在OnCertificateValidated事件中添加日志，确认证书是否被服务器接收；
• 使用抓包工具（如Fiddler）检查请求中是否包含客户端证书字段；
• 确保localhost自签名证书已导入本地受信任根证书颁发机构。

内容的提问来源于stack exchange，提问作者DRapp