C# HttpClient调用API时SSL/TLS安全通道创建失败，本地调试正常

问题说明 #

使用C#的HttpClient调用API接口时抛出异常：The request was aborted: Could not create SSL/TLS secure channel，但相同代码在本地调试环境下可正常运行。

相关代码 #

public async Task<string> FetchUser(FetchUser postdata)
{
    try
    {
        ServicePointManager.Expect100Continue = true;
        ServicePointManager.DefaultConnectionLimit = 9999;
        System.Net.ServicePointManager.SecurityProtocol |= SecurityProtocolType.Tls12;

        HttpClient client = new HttpClient();

        var Message = "";

        string apiUrl = ApiSecrets.ApiEndPoint;
        var payload = new
        {
            api_key = ApiSecrets.ApiKey,
            datasetKey = ApiSecrets.DataSetKey
        };
        string payloadJson = Newtonsoft.Json.JsonConvert.SerializeObject(payload);
        var content = new StringContent(payloadJson, Encoding.UTF8, "application/json");

        string username = ApiSecrets.AuthUserName;
        string password = ApiSecrets.AuthPassword;
        string credentials = Convert.ToBase64String(Encoding.ASCII.GetBytes($"{username}:{password}"));
        client.DefaultRequestHeaders.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Basic", credentials);
        HttpResponseMessage response = await client.PostAsync(apiUrl, content);
        // HttpResponseMessage response = client.PostAsync(apiUrl, content).Result;
        if (response.IsSuccessStatusCode)
        {
            // Read and print the response content
            string responseBody = await response.Content.ReadAsStringAsync();
            // string responseBody = response.Content.ReadAsStringAsync().Result;
            JsonResponse Empresponse = JsonConvert.DeserializeObject<JsonResponse>(responseBody);
            List<Employee> employees = Empresponse.employee_data;
        }
        else
        {
            // Handle unsuccessful response
            //  Console.WriteLine("Error: " + response.StatusCode);
            Message = "Invalid Response";
        }
        return Message;
    }
    //Genearl ex
    catch (Exception ex)
    {
        if (ex.InnerException != null)
        {
            // Log or inspect the InnerException details
            // Console.WriteLine($"InnerException: {ex.InnerException.Message}");
            // Throw the InnerException to propagate it
            throw ex.InnerException;
        }
        // If there is no InnerException, rethrow the original exception
        throw ex;
    }
    //General Ex end
}

错误响应日志 #

{
    "status_code": 500,
    "request_name": "FetchUser",
    "message": "The request was aborted: Could not create SSL/TLS secure channel.",
    "request_time": ,
    "response_time":,
    "response_time_Utc": 0,
    "data": "Failure"
}

排查及解决方案 #

• 确认部署环境的TLS版本支持：代码中仅启用了TLS1.2，但部署服务器可能禁用了该版本，或目标API要求更高版本（如TLS1.3）。建议在应用启动时统一设置支持的TLS版本：

  ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12 | SecurityProtocolType.Tls13;
  

  同时检查服务器操作系统的SSL/TLS设置，确保对应版本已启用。

• 调整ServicePointManager设置时机：当前代码在每次调用方法时才设置ServicePointManager，可能无法生效。建议将这些配置放在应用启动逻辑中（如Program.cs或Global.asax），确保在任何HttpClient实例化前执行。

• 检查服务器证书信任：部署环境的服务器可能未信任目标API的SSL证书（比如自签名证书）。可尝试在服务器的受信任根证书存储中安装目标API的根证书；测试环境下可临时添加证书验证回调（生产环境不推荐）：

  ServicePointManager.ServerCertificateValidationCallback += (sender, cert, chain, sslPolicyErrors) => true;
  

• 优化HttpClient实例化方式：每次调用都新建HttpClient会导致连接池耗尽，影响SSL连接建立。建议使用IHttpClientFactory创建单例HttpClient实例，避免资源泄漏。

• 验证Basic认证格式：检查用户名、密码是否包含特殊字符，Base64编码是否正确，确保Authorization头的格式符合规范。

内容的提问来源于stack exchange，提问作者sajal