.NET 8 Web API在Linux Docker容器中SSL连接失败排查求助

• 环境：.NET 8.0.8 Web API，运行于Docker容器
• 故障现象：RestSharp调用外部GET API时抛出错误：The SSL connection could not be established, see inner exception
• 矛盾点：同一容器内用curl调用相同URL可正常响应；尝试通过ServerCertificateCustomValidationCallback = (sender, cert, chain, sslPolicyErrors) => true绕过SSL验证无效；本地IDE环境运行正常，仅容器内出现问题

1. 定位.NET容器内的证书加载情况 #

Linux下.NET默认使用独立的证书存储体系，与OpenSSL不共享，可通过以下方式排查：

• 容器内执行命令查看.NET证书加载详情：

  dotnet dev-certs https --check --verbose
  

• 代码中添加日志输出根证书存储内容：

  using System.Security.Cryptography.X509Certificates;
  
  var rootStore = new X509Store(StoreName.Root, StoreLocation.CurrentUser);
  rootStore.Open(OpenFlags.ReadOnly);
  Console.WriteLine($"根证书总数：{rootStore.Certificates.Count}");
  foreach (var cert in rootStore.Certificates)
  {
      Console.WriteLine($"证书主题：{cert.Subject}，过期时间：{cert.NotAfter}");
  }
  rootStore.Close();
  

2. 确保容器内证书存储同步更新 #

部分基础.NET镜像未默认包含完整系统根证书，可在Dockerfile中添加证书更新步骤：

# 安装证书工具并同步系统证书
RUN apt-get update && apt-get install -y ca-certificates && update-ca-certificates

重新构建镜像后，.NET会自动加载更新后的系统证书。

3. 验证RestSharp的SSL配置是否生效 #

需确保绕过验证的代码正确绑定到当前使用的RestClient实例：

// 方式1：通过RestClientOptions配置
var clientOptions = new RestClientOptions("https://your-external-api-domain")
{
    RemoteCertificateValidationCallback = (sender, cert, chain, errors) => true
};
var restClient = new RestClient(clientOptions);

// 方式2：通过HttpClientHandler配置
var httpHandler = new HttpClientHandler
{
    ServerCertificateCustomValidationCallback = (sender, cert, chain, errors) => true
};
var restClient = new RestClient(new HttpClient(httpHandler));

4. 捕获并分析内部异常 #

原错误仅展示外层信息，需打印内部异常获取具体故障原因：

try
{
    var response = await restClient.GetAsync("/target-endpoint");
    response.EnsureSuccessStatusCode();
}
catch (HttpRequestException ex)
{
    Console.WriteLine($"请求失败：{ex.Message}");
    var innerEx = ex.InnerException;
    while (innerEx != null)
    {
        Console.WriteLine($"内部异常：{innerEx.Message}");
        innerEx = innerEx.InnerException;
    }
}

内部异常通常会给出具体问题，比如证书链不完整、主机名不匹配、证书过期等。

5. 手动导入外部API证书 #

若curl可识别但.NET无法加载，可手动将外部API证书导入.NET证书存储：

1. 容器内获取目标API证书：

   curl -sSL https://your-external-api-domain | openssl x509 -outform PEM -out external-api-cert.pem
   

2. 导入到系统证书目录并更新：

   cp external-api-cert.pem /usr/share/ca-certificates/external-api.crt
   update-ca-certificates
   

3. 或在代码中手动加载证书并验证：

   var targetCert = new X509Certificate2("external-api-cert.pem");
   var handler = new HttpClientHandler
   {
       ServerCertificateCustomValidationCallback = (sender, cert, chain, errors) =>
       {
           return errors == SslPolicyErrors.None || cert.Thumbprint == targetCert.Thumbprint;
       }
   };
   var restClient = new RestClient(new HttpClient(handler));
   

内容的提问来源于stack exchange，提问作者reverterez