使用RestSharp实现mTLS认证遇SSL/TLS通道创建失败求助

我正在编写一段使用RestSharp实现mTLS认证的C#示例代码，代码如下：

using System;
using System.Net;
using RestSharp;
using System.Security.Cryptography.X509Certificates;

class Program
{
    static void Main(string[] args)
    {
            X509Certificate2 clientCertificate = new X509Certificate2(@"..\Certificate.crt"); 

            var client = new RestClient("https://apiurl:port"); 
            client.ClientCertificates = new X509CertificateCollection { clientCertificate };

            var request = new RestRequest("/testresource", Method.POST); 

            ServicePointManager.ServerCertificateValidationCallback = ValidateServerCertificate;

            IRestResponse response = client.Execute(request);

            if (response.StatusCode == HttpStatusCode.OK)
            {
                Console.WriteLine("Request successful");
                Console.WriteLine("Response content: " + response.Content);
            }
            else
            {
                Console.WriteLine("Request failed with status code: " + response.StatusCode);
                Console.WriteLine("Error message: " + response.ErrorMessage);
            }
    }

private static bool ValidateServerCertificate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
    if (sslPolicyErrors == SslPolicyErrors.None)
    {
        // No SSL policy errors, the certificate is considered valid
        return true;
    }

    // Check if any errors in the certificate chain
    if (chain == null || chain.ChainStatus == null)
    {
        // Certificate chain is not available or invalid
        return false;
    }

    // Check each chain status
    foreach (X509ChainStatus status in chain.ChainStatus)
    {
        if (status.Status != X509ChainStatusFlags.NoError)
        {
            // There is an error in the certificate chain, so it's considered invalid
            return false;
        }
    }


    // If we've reached here, the certificate chain is valid, but SSL policy errors are present
    // If you want to accept certificates with SSL policy errors, uncomment the line below
    //return true;

    // Otherwise, we consider the certificate invalid if SSL policy errors are present
    return false;
}

}

执行该客户端代码时，出现错误：The request was aborted: Could not create SSL/TLS secure channel。但相同的请求在Postman中可正常运行，请问我哪里操作出错了？

• 证书加载不完整：你加载的.crt文件只有公钥，mTLS认证需要包含私钥的完整证书（比如.pfx/.p12格式）。Postman中你大概率导入的是带私钥的证书，所以能正常运行。
  解决：替换为带私钥的证书文件，用以下方式加载（需传入证书密码）：

  X509Certificate2 clientCertificate = new X509Certificate2(@"..\Certificate.pfx", "你的证书密码");
  

• TLS版本不匹配：服务器可能要求TLS 1.2或1.3，而代码未指定时可能使用了较低的默认版本，Postman会自动适配主流版本。
  解决：在初始化RestClient前添加版本指定：

  ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12 | SecurityProtocolType.Tls13;
  

• 服务器证书验证逻辑过严：你的ValidateServerCertificate方法可能错误拒绝了服务器证书（比如服务器用自签名证书、链中缺少中间证书），Postman可能已手动信任该证书。
  解决：调试阶段可临时将验证逻辑改为直接返回true（生产环境禁用），确认是否能正常请求：

  private static bool ValidateServerCertificate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
  {
      return true; // 仅调试用
  }
  

  若成功，再针对性调整验证逻辑，比如添加对特定根证书的信任。

• 证书存储或权限问题：服务器可能需要验证证书链信任，而本地直接加载文件时缺少中间证书，Postman会自动使用系统存储的证书链。
  解决：将证书导入本地计算机的个人或受信任的根证书颁发机构存储，再通过指纹加载：

  X509Certificate2 clientCertificate = null;
  using (var store = new X509Store(StoreName.My, StoreLocation.CurrentUser))
  {
      store.Open(OpenFlags.ReadOnly);
      var certs = store.Certificates.Find(X509FindType.FindByThumbprint, "你的证书指纹", false);
      if (certs.Count > 0) clientCertificate = certs[0];
  }
  

• RestSharp版本或配置方式问题：旧版本RestSharp处理客户端证书的逻辑可能有差异，或者配置方式不正确。
  解决：升级RestSharp到最新稳定版，改用RestClientOptions配置证书：

  var options = new RestClientOptions("https://apiurl:port")
  {
      ClientCertificates = new X509CertificateCollection { clientCertificate }
  };
  var client = new RestClient(options);
  

内容的提问来源于stack exchange，提问作者RBS