C#部署到Dev/QA服务器后Redis数据库连接失败求助

我使用以下代码通过TLS证书连接Redis数据库，本地及同事机器上运行正常，但部署到Dev/QA服务器后无法连接数据库。对比本地与服务器日志发现，本地SSL配置成功，而服务器端未成功完成SSL配置，附上相关代码，恳请协助排查问题及提供解决方法：

logging.Info("Redis Connection started");
var appPath = HttpContext.Current.Server.MapPath("~/");
var reportsPath = Path.Combine(appPath, "Reports");
RedisSettings redisSettings = JsonConvert.DeserializeObject<RedisSettings>(CoreConfigurationManager.RedisConfiguration);

var configurationOptions = new ConfigurationOptions
{
    EndPoints = { redisSettings.EndPoints },
    Ssl = true,
    SslProtocols = SslProtocols.Default,
    Password = redisSettings.Password,
    AbortOnConnectFail = false
};
logging.Info($"Redis EndPoint : {redisSettings.EndPoints}");
dynamic storage = new FileStorage();
try
{
    configurationOptions.CertificateSelection += delegate (object sender, string host,
    X509CertificateCollection certificates, X509Certificate certificate, string[] issuers)
    {
        var cert = new X509Certificate2(redisSettings.CertFilePath, redisSettings.CertFilePassword);
        return cert;
    };
    logging.Info($"Redis pfx file path : {redisSettings.CertFilePath}");

    configurationOptions.CertificateValidation += delegate (object sender, X509Certificate certificate, X509Chain chain,
        SslPolicyErrors errors)
    {
        //validation logic
        return true;
    };

    var redisEnabled = redisSettings.IsEnabled;
    logging.Info($"Redis configuration enabled status : {redisEnabled}");

    if (redisEnabled)
    {
        var log = new StringWriter();
        var redis = ConnectionMultiplexer.Connect(configurationOptions, log);
        if (redis.IsConnected)
        {
            storage = new RedisStorage(redis, reportsPath);
            logging.Debug($"Redis DB Connected success");
        }
        var logOutput = log.ToString();
        logging.Debug($"Redis DB Connection log : {logOutput}");
    }
}
catch (Exception ex)
{
    NewRelic.Api.Agent.NewRelic.NoticeError(ex);
    logging.Error("Exception on Redis DB connection: " + ex.Message, ex);
}

排查方向与解决建议 #

• 证书文件路径与权限：检查服务器上redisSettings.CertFilePath对应的PFX文件是否存在，确认IIS应用程序池的运行账户拥有该文件的读取权限。可以在代码中添加日志验证文件存在性：logging.Info($"Certificate file exists: {File.Exists(redisSettings.CertFilePath)}");
• TLS协议版本适配：服务器操作系统可能禁用了SslProtocols.Default包含的旧版本协议（如TLS 1.0/1.1），而Redis服务要求更高版本。尝试明确指定协议：SslProtocols = SslProtocols.Tls12 | SslProtocols.Tls13
• 证书加载方式优化：将PFX证书导入服务器的本地计算机证书存储（LocalMachine\My），通过证书指纹加载，避免文件权限问题：

  configurationOptions.CertificateSelection += delegate (object sender, string host,
  X509CertificateCollection certificates, X509Certificate certificate, string[] issuers)
  {
      using var store = new X509Store(StoreName.My, StoreLocation.LocalMachine);
      store.Open(OpenFlags.ReadOnly);
      var certCollection = store.Certificates.Find(X509FindType.FindByThumbprint, redisSettings.CertThumbprint, false);
      return certCollection.Count > 0 ? certCollection[0] : null;
  };
  

• SSL验证错误排查：在证书验证回调中添加详细日志，输出具体错误信息：

  configurationOptions.CertificateValidation += delegate (object sender, X509Certificate certificate, X509Chain chain,
      SslPolicyErrors errors)
  {
      logging.Debug($"SSL Validation Errors: {errors}");
      if (chain.ChainStatus.Length > 0)
      {
          foreach (var status in chain.ChainStatus)
          {
              logging.Debug($"Chain Status: {status.StatusInformation}");
          }
      }
      return true;
  };
  

• Redis服务器配置与网络：确认Dev/QA环境的Redis服务器已启用TLS，端口与本地一致，且服务器防火墙允许访问Redis的TLS端口（通常为6380）
• 连接日志分析：仔细解析logOutput中的内容，查找SSL握手失败、协议协商错误等具体信息，定位问题根源

内容的提问来源于stack exchange，提问作者Venoth01