.NET Core WebAPI调用第三方URL时SSL/TLS信任关系建立失败求助

问题根源 #

你之前使用的ServicePointManager.ServerCertificateValidationCallback仅适用于传统HttpWebRequest或基于它的客户端，而代码中使用的是WCF的ServiceClient，在.NET Core环境下，WCF客户端有独立的证书验证机制，所以该回调不会生效。

解决方案 #

1. 测试环境临时跳过证书验证（不推荐生产使用） #

直接通过WCF客户端的ClientCredentials配置关闭证书验证：

using (ServiceClient client = new ServiceClient())
{
    // 配置跳过SSL证书验证（仅测试环境用）
    client.ClientCredentials.ServiceCertificate.SslCertificateAuthentication = 
        new X509ServiceCertificateAuthentication()
        {
            CertificateValidationMode = X509CertificateValidationMode.None,
            RevocationMode = X509RevocationMode.NoCheck
        };

    client.ClientCredentials.UserName.UserName = ACCOUNT;
    client.ClientCredentials.UserName.Password = PASSWORD;
    
    using (OperationContextScope scope = new OperationContextScope(client.InnerChannel))
    {
        HttpRequestMessageProperty httpRequestProperty = new HttpRequestMessageProperty();
        httpRequestProperty.Headers[System.Net.HttpRequestHeader.Authorization] = 
            "Basic " + Convert.ToBase64String(Encoding.ASCII.GetBytes(ACCOUNT + ":" + PASSWORD));
        OperationContext.Current.OutgoingMessageProperties[HttpRequestMessageProperty.Name] = httpRequestProperty;
        
        try
        {
            ret = func(client);
        }
        catch (Exception ex)
        {
            ret = new ApiErrorResponse(ex);
        }
    }
}

2. 生产环境安全解决方案 #

生产环境绝对不能跳过证书验证，正确做法是将第三方证书加入信任列表：

• 方式一：导入证书到服务器信任存储
  导出第三方API的SSL证书，导入到服务器的「受信任根证书颁发机构」或「受信任人」存储中，系统会自动信任该证书。
• 方式二：代码中指定信任特定证书
  加载第三方证书文件，通过自定义验证器仅信任该证书：

using (ServiceClient client = new ServiceClient())
{
    // 加载预先获取的第三方证书
    var trustedCertificate = new X509Certificate2("third-party-cert.cer");
    
    // 配置自定义证书验证
    client.ClientCredentials.ServiceCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.Custom;
    client.ClientCredentials.ServiceCertificate.Authentication.CustomCertificateValidator = 
        new TrustSpecificCertificateValidator(trustedCertificate);

    client.ClientCredentials.UserName.UserName = ACCOUNT;
    client.ClientCredentials.UserName.Password = PASSWORD;
    
    // 后续请求逻辑保持不变...
}

// 自定义证书验证器类
public class TrustSpecificCertificateValidator : X509CertificateValidator
{
    private readonly X509Certificate2 _trustedCert;

    public TrustSpecificCertificateValidator(X509Certificate2 trustedCert)
    {
        _trustedCert = trustedCert;
    }

    public override void Validate(X509Certificate2 certificate)
    {
        // 对比证书指纹，确保是信任的证书
        if (!certificate.Thumbprint.Equals(_trustedCert.Thumbprint, StringComparison.OrdinalIgnoreCase))
        {
            throw new SecurityTokenValidationException("请求的SSL证书不被信任");
        }
    }
}

内容的提问来源于stack exchange，提问作者vikas saini