基于.NET 8 Alpine镜像启动Docker容器时HTTPS配置失败求助

基于mcr.microsoft.com/dotnet/aspnet:8.0.2-alpine3.18-amd64构建Docker镜像后，执行命令docker run -p 5000:80 personalfinance-api:1.0.0启动容器时出现以下错误：

2024-02-27 16:14:22 fail: Microsoft.Extensions.Hosting.Internal.Host[11]
2024-02-27 16:14:22       Hosting failed to start
2024-02-27 16:14:22       System.InvalidOperationException: Unable to configure HTTPS endpoint. No server certificate was specified, and the default developer certificate could not be found or is out of date.
2024-02-27 16:14:22       To generate a developer certificate run 'dotnet dev-certs https'. To trust the certificate (Windows and macOS only) run 'dotnet dev-certs https --trust'.
2024-02-27 16:14:22       For more information on configuring HTTPS see https://go.microsoft.com/fwlink/?linkid=848054.

尝试相关解决方案无效，以下是配置文件：

launchsettings.json #

{
  "profiles": {
    "http": {
      "commandName": "Project",
      "launchBrowser": true,
      "launchUrl": "swagger",
      "environmentVariables": {
        "ASPNETCORE_ENVIRONMENT": "Development"
      },
      "dotnetRunMessages": true,
      "applicationUrl": "http://localhost:5214"
    },
    "https": {
      "commandName": "Project",
      "launchBrowser": true,
      "launchUrl": "swagger",
      "environmentVariables": {
        "ASPNETCORE_ENVIRONMENT": "Development"
      },
      "dotnetRunMessages": true,
      "applicationUrl": "https://localhost:7145"
    },
    "IIS Express": {
      "commandName": "IISExpress",
      "launchBrowser": true,
      "launchUrl": "swagger",
      "environmentVariables": {
        "ASPNETCORE_ENVIRONMENT": "Development"
      }
    },
    "Docker": {
      "commandName": "Docker",
      "launchBrowser": true,
      "launchUrl": "{Scheme}://{ServiceHost}:{ServicePort}/swagger",
      "environmentVariables": {
        "ASPNETCORE_URLS": "https://+:443;http://+:80"
      },
      "publishAllPorts": true,
      "useSSL": true
    }
  },
  "$schema": "https://json.schemastore.org/launchsettings.json",
  "iisSettings": {
    "windowsAuthentication": false,
    "anonymousAuthentication": true,
    "iisExpress": {
      "applicationUrl": "http://localhost:26413",
      "sslPort": 44363
    }
  }
}

Program.cs #

using PersonalFinance.Api;
using PersonalFinance.Services;
using System.Text.Json.Serialization;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddControllers().AddJsonOptions(
    x=>
    {
        x.JsonSerializerOptions.Converters.Add(new JsonStringEnumConverter());
    }
    );
 //Learn more about configuring Swagger/OpenAPI at https://aka.ms/aspnetcore/swashbuckle
builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen();

var conf = new ConfigurationBuilder()
    .SetBasePath(Directory.GetCurrentDirectory())
    .AddJsonFile("appsettings.json", optional: false, reloadOnChange: true)
    .AddUserSecrets<Program>() 
    .Build();

var fxRatesProviderSettings = conf.GetSection("fxRatesProviderSettings");
var fxRatesConnectionStrings = fxRatesProviderSettings.GetSection("FxRatesConnectionStrings");

var fxRatesProviderResolver = new FxRatesProviderResolver();
fxRatesProviderResolver.Add("CSV", new CsvRateProvider(fxRatesConnectionStrings["CsvFilePath"], ';', 30000));
fxRatesProviderResolver.Add("MySql", new MySqlRateProvider(fxRatesConnectionStrings["MySqlConnectionString"]));
fxRatesProviderResolver.Add("MSSQL", new SqlServerRateProvider(fxRatesConnectionStrings["SqlServerConnectionString"]));

builder.Services.AddSingleton(fxRatesProviderResolver);

builder.Services.AddTransient<CurrencyValidator>();


var app = builder.Build();

// Configure the HTTP request pipeline.
if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI();
}

//app.MapGet("api/server/ping", ()=> "pong");

app.UseHttpsRedirection();

app.UseAuthorization();

app.MapControllers();

app.Run();

appsettings.json #

{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "AllowedHosts": "*",
  "Kestrel": {
    "Endpoints": {
      "Https": {
        "Url": "https://localhost:7145"
      }
    }
  },
  "FxRatesProviderSettings": {
    "FxRateProvider": "MySql",
    "FxRatesConnectionStrings": {
      "MySqlConnectionString": "ToBeReplaced",
      "SqlServerConnectionString": "ToBeReplaced"
    }
  }
}

请问哪里配置出错了？

核心问题 #

你的应用在容器启动时试图配置HTTPS端点，但容器内既没有默认开发者证书，也未指定自定义SSL证书，同时配置里强制启用了HTTPS相关设置，导致启动失败。具体问题点如下：

1. appsettings.json的Kestrel配置：
   你在Kestrel.Endpoints里仅配置了Https端点，指定了https://localhost:7145。这个配置会让Kestrel尝试启动HTTPS服务，但容器内没有对应的SSL证书，且localhost在容器环境中不适用。

2. launchsettings.json的Docker配置：
   该配置设置了环境变量ASPNETCORE_URLS=https://+:443;http://+:80，虽然launchsettings.json主要用于本地开发，但如果Docker构建过程中带入了这个环境变量，会让应用同时尝试启动HTTP和HTTPS端口，而HTTPS端口因缺少证书无法启动。

3. Program.cs的HTTPS重定向：
   代码中调用了app.UseHttpsRedirection();，这个中间件会把所有HTTP请求强制跳转到HTTPS。如果容器只映射了HTTP端口（5000:80），但HTTPS服务启动失败，会导致请求无法正常处理，同时加重启动时的HTTPS配置错误。

4. 容器启动命令的端口映射：
   你用-p 5000:80只映射了容器的80端口（HTTP），但应用被配置成必须启动HTTPS服务，两者冲突。

解决方案 #

方案一：临时禁用HTTPS（适合开发测试） #

如果只是需要在容器中快速运行应用进行测试，可直接禁用HTTPS相关配置：

1. 修改appsettings.json：
   移除Kestrel的Https端点配置，改为只配置HTTP端点：

   "Kestrel": {
     "Endpoints": {
       "Http": {
         "Url": "http://+:80"
       }
     }
   }
   

2. 启动容器时覆盖环境变量：
   无需修改代码，直接在启动命令中设置ASPNETCORE_URLS强制使用HTTP：

   docker run -p 5000:80 -e ASPNETCORE_URLS=http://+:80 personalfinance-api:1.0.0
   

3. 可选：注释HTTPS重定向：
   在Program.cs中注释掉app.UseHttpsRedirection();，避免不必要的跳转逻辑：

   // app.UseHttpsRedirection();
   

方案二：容器内启用HTTPS（适合生产环境） #

如果需要在容器中正式启用HTTPS，需准备SSL证书并配置应用使用该证书：

1. 准备SSL证书：
   生成或获取PFX格式的SSL证书，比如使用dotnet dev-certs https -ep ./aspnetapp.pfx -p yourpassword生成开发证书（生产环境请使用正规CA颁发的证书）。

2. 启动容器时挂载证书并配置环境变量：

   docker run -p 5000:80 -p 5001:443 \
     -e ASPNETCORE_URLS="https://+:443;http://+:80" \
     -e ASPNETCORE_Kestrel__Certificates__Default__Path=/https/aspnetapp.pfx \
     -e ASPNETCORE_Kestrel__Certificates__Default__Password="yourpassword" \
     -v /本地证书路径:/https/ \
     personalfinance-api:1.0.0
   

   其中：

   • -p 5001:443映射容器的HTTPS端口443到本地5001
   • -v参数把本地证书目录挂载到容器内的/https/路径
   • 环境变量指定证书路径和密码

3. 可选：在appsettings.json中配置证书：
   也可以把证书配置写在appsettings.json中（适合容器内证书路径固定的场景）：

   "Kestrel": {
     "Endpoints": {
       "Https": {
         "Url": "https://+:443"
       },
       "Http": {
         "Url": "http://+:80"
       }
     },
     "Certificates": {
       "Default": {
         "Path": "/https/aspnetapp.pfx",
         "Password": "yourpassword"
       }
     }
   }
   

内容的提问来源于stack exchange，提问作者Dinislam