Docker中ASP.NET Core应用间SSL连接异常排查求助

我在Docker中运行一个ASP.NET Core 8 Web API和一个ASP.NET MVC Web应用。当Web应用尝试向Web API发送请求时，抛出如下异常：

Exception: The SSL connection could not be established, see inner exception.
System.Security.Authentication.AuthenticationException: Cannot determine the frame size or a corrupted frame was received.
at System.Net.Security.SslStream.GetFrameSize(ReadOnlySpan1 buffer) at System.Net.Security.SslStream.EnsureFullTlsFrameAsync[TIOAdapter](CancellationToken cancellationToken, Int32 estimatedSize) at System.Runtime.CompilerServices.PoolingAsyncValueTaskMethodBuilder1.StateMachineBox1.System.Threading.Tasks.Sources.IValueTaskSource<TResult>.GetResult(Int16 token) at System.Net.Security.SslStream.ReceiveHandshakeFrameAsync[TIOAdapter](CancellationToken cancellationToken) at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken) at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken) --- End of inner exception stack trace --- at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken) at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken) at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken) at System.Net.Http.HttpConnectionPool.AddHttp11ConnectionAsync(QueueItem queueItem) at System.Threading.Tasks.TaskCompletionSourceWithCancellation1.WaitWithCancellationAsync(CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
at System.Net.Http.DiagnosticsHandler.SendAsyncCore(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)

docker-compose配置 #

version: '3.4'

networks:
  la-network:
    driver: bridge 

services:
  la-web:
    image: la-web:latest
    depends_on:
      - "la-database"
    build:
      context: .
      dockerfile: LA.WebPortal/Dockerfile
    ports:
      - "8081:8080"
    restart: always
    networks:
      - la-network
      
  la-api:
    image: la-api:latest
    depends_on:
      - "la-database"
    build:
      context: .
      dockerfile: LA.API/Dockerfile
    ports:
      - "8080:8080"
      - "443:443"
    restart: always      
    environment:
      ConnectionStrings__LADb: "host=la-database;port=5432;database=db;username=user;password=pass"
    networks:
      - la-network 
  
  la-database:
    image: postgres:latest
    ports:
      - "5432:5432"
    restart: always
    volumes:
      - db_volume:/var/lib/postgresql/data
    environment:
      POSTGRES_USER: "user"
      POSTGRES_PASSWORD: "pass"
      POSTGRES_DB: "db"
    networks:
      - la-network
volumes:
  db_volume:

HttpClient配置 #

Web API和Web应用中使用的HttpClient配置如下：

_ = services.AddHttpClient("lahttp")
            .ConfigurePrimaryHttpMessageHandler(() => new HttpClientHandler {
                ServerCertificateCustomValidationCallback = HttpClientHandler.DangerousAcceptAnyServerCertificateValidator
});

创建客户端的代码：

var client = _httpClientFactory.CreateClient("lahttp");

需要帮忙解决这个SSL连接异常问题。

1. 检查API服务的HTTPS配置完整性 #

异常核心是客户端建立SSL连接时无法获取有效TLS帧，大概率是API容器内未正确配置HTTPS：

• ASP.NET Core 8容器不会自动配置HTTPS，除非Dockerfile中添加了证书构建步骤，或挂载了SSL证书到容器内。
• 如果API容器内没有配置有效证书和HTTPS监听，443端口实际未提供HTTPS服务，客户端发起HTTPS请求时就会出现帧错误。

2. 调整客户端请求地址（开发/内部通信场景） #

如果不需要容器内HTTPS通信，可让Web应用通过容器内部HTTP端口访问API：

• Docker网络中服务名可直接作为域名使用，Web应用应请求 http://la-api:8080 而非 https://la-api:443，绕开SSL握手问题。

3. 正确配置API的HTTPS（需HTTPS通信时） #

若必须使用HTTPS，需给API容器配置SSL证书：

• 生成自签名证书（开发环境），在API的Dockerfile中复制证书到容器，或通过挂载卷提供证书。
• 在API的Program.cs中配置HTTPS监听：

  builder.WebHost.ConfigureKestrel(options =>
  {
      options.ListenAnyIP(8080);
      options.ListenAnyIP(443, listenOptions =>
      {
          listenOptions.UseHttps("certificate.pfx", "certPassword");
      });
  });
  

• 确保容器内证书路径和密码正确，同时客户端已配置接受自签名证书（当前DangerousAcceptAnyServerCertificateValidator已满足）。

4. 验证容器网络连通性 #

进入Web应用容器执行 curl http://la-api:8080 或 curl https://la-api:443，检查是否能正常响应，排除网络连通问题。

内容的提问来源于stack exchange，提问作者halilenver