.NET 8升级后SAML2证书链无法构建至可信根机构问题求助

我的应用部署在Azure平台，.NET 6环境下以下SAML2配置代码运行正常：

public static void ConfigureSaml2(this IServiceCollection services, IConfiguration configuration)
{
    services.Configure<Saml2Configuration>(configuration.GetSection(Saml2Section));
    services.Configure<Saml2Configuration>(saml2Configuration =>
    {
        var signingCertificateName = configuration.GetValue<string>($"{Saml2Section}:{SigningCertificateName}");
        var signatureCertificateName = configuration.GetValue<string>($"{Saml2Section}:{SignatureCertificateName}");

        Configure(saml2Configuration, signingCertificateName, signatureCertificateName);
    });

    services.AddSaml2(slidingExpiration: true);
}

private static void Configure(Saml2Configuration saml2Configuration, string signingCertificateName, string signatureCertificateName)
{
    saml2Configuration.SignAuthnRequest = true;
    saml2Configuration.AllowedIssuer = saml2Configuration.SingleSignOnDestination.ToString();

    saml2Configuration.SigningCertificate = CertificateUtil.Load(
        StoreName.My, StoreLocation.CurrentUser, X509FindType.FindBySubjectDistinguishedName, signingCertificateName);

    saml2Configuration.SignatureValidationCertificates.Add(
        CertificateUtil.Load(StoreName.My, StoreLocation.CurrentUser, X509FindType.FindBySubjectDistinguishedName, signatureCertificateName));

    saml2Configuration.AllowedAudienceUris.Add(saml2Configuration.Issuer);

    saml2Configuration.CustomCertificateValidator = new Saml2CertificateValidator
    {
        CertificateValidationMode = saml2Configuration.CertificateValidationMode,
        RevocationMode = saml2Configuration.RevocationMode,
        TrustedStoreLocation = StoreLocation.CurrentUser
    };
    saml2Configuration.CertificateValidationMode = X509CertificateValidationMode.Custom;
}

升级到.NET 8后出现以下错误：

SecurityTokenValidationException: Invalid X509 certificate chain. Certificate name:'CN=xxx, O=xxx' and thumbprint:'xxx'. Chain Status:'A certificate chain could not be built to a trusted root authority.'..
ITfoxtec.Identity.Saml2.Util.Saml2CertificateValidator.ValidateChainTrust(X509Certificate2 certificate)
ITfoxtec.Identity.Saml2.Util.Saml2CertificateValidator.Validate(X509Certificate2 certificate)
ITfoxtec.Identity.Saml2.Saml2Request.ValidateXmlSignature(XmlElement xmlElement)
ITfoxtec.Identity.Saml2.Saml2Request.ValidateXmlSignature(SignatureValidation documentValidationResult)
ITfoxtec.Identity.Saml2.Saml2Request.Read(string xml, bool validate, bool detectReplayedTokens)
ITfoxtec.Identity.Saml2.Saml2Response.Read(string xml, bool validate, bool detectReplayedTokens)
ITfoxtec.Identity.Saml2.Saml2AuthnResponse.Read(string xml, bool validate, bool detectReplayedTokens)
ITfoxtec.Identity.Saml2.Saml2PostBinding.Read(HttpRequest request, Saml2Request saml2RequestResponse, string messageName, bool validate, bool detectReplayedTokens)
ITfoxtec.Identity.Saml2.Saml2PostBinding.UnbindInternal(HttpRequest request, Saml2Request saml2RequestResponse, string messageName)
ITfoxtec.Identity.Saml2.Saml2Binding.Unbind(HttpRequest request, Saml2Response saml2Response)

我尝试添加自定义验证器指定StoreLocation.CurrentUser，但问题仍未解决。请问为何同样的代码在.NET 6环境下正常，升级到.NET 8后报错？

核心原因 #

• .NET 8证书验证规则更严格：.NET 8收紧了X509证书链的默认验证逻辑，强制要求证书链必须追溯到受信任的根CA；而.NET 6的验证逻辑相对宽松，可能忽略了部分链验证失败的场景。
• ITfoxtec库版本适配问题：如果升级.NET 8时未同步升级ITfoxtec.Identity.Saml2库到兼容.NET 8的版本，旧版本的Saml2CertificateValidator可能存在逻辑缺陷，导致自定义验证器的配置未被正确生效。
• Azure环境证书存储权限变化：在Azure App Service中，.NET 8环境下CurrentUser证书存储的访问权限可能发生了调整，应用无法读取到受信任的根证书，进而导致链验证失败。

解决步骤 #

1. 同步升级ITfoxtec库：确保使用的ITfoxtec.Identity.Saml2库是支持.NET 8的最新版本（至少v4.0及以上），旧版本可能存在与.NET 8不兼容的证书验证逻辑。
2. 调整自定义验证器逻辑：如果签名证书是自签名或内部CA颁发的，可在安全可控的内部环境下，跳过链信任检查：

   saml2Configuration.CustomCertificateValidator = new Saml2CertificateValidator
   {
       CertificateValidationMode = X509CertificateValidationMode.None,
       RevocationMode = X509RevocationMode.NoCheck,
   };
   saml2Configuration.CertificateValidationMode = X509CertificateValidationMode.Custom;
   

3. 确保根证书存在于正确存储：在Azure环境中，将根CA证书安装到LocalMachine的受信任根证书存储，或者直接在代码中加载根证书并添加到验证列表：

   // 加载根证书并添加到验证证书集合
   var rootCert = CertificateUtil.Load(StoreName.Root, StoreLocation.CurrentUser, X509FindType.FindBySubjectDistinguishedName, "根证书主体名称");
   saml2Configuration.SignatureValidationCertificates.Add(rootCert);
   

4. 检查Azure应用服务证书配置：在Azure Portal的应用服务"证书"选项卡中，确认所需证书已正确加载，且应用拥有访问证书存储的权限。

内容的提问来源于stack exchange，提问作者noIdea