.NET升级后YARP反向代理无法连接旧4.8应用问题排查

我使用.NET Upgrade Assistant将站点项目从.NET Framework 4.8升级至.NET 7，生成并行应用并参照ASP.NET迁移系列视频操作。.NET 7项目的测试控制器可正常返回“hello world”，但代理旧应用时返回502错误。旧4.8应用采用IIS本地URL（如local.foo.com而非localhost:7000），使用IIS Express开发证书配置。我已成功为另一同类IIS Express应用配置迁移代理，但无法找出当前新旧应用中缺失的配置。

调试控制台报错信息 #

info: Microsoft.Hosting.Lifetime[14]
      Now listening on: https://localhost:7055
info: Microsoft.Hosting.Lifetime[14]
      Now listening on: http://localhost:5055
info: Microsoft.Hosting.Lifetime[0]
      Application started. Press Ctrl+C to shut down.
info: Microsoft.Hosting.Lifetime[0]
      Hosting environment: Development
info: Microsoft.Hosting.Lifetime[0]
      Content root path: C:\PUE.Development\lms\Web.SiteCore
info: Yarp.ReverseProxy.Forwarder.HttpForwarder[9]
      Proxying to https://local.foo.com/ HTTP/2 RequestVersionOrLower no-streaming
info: Yarp.ReverseProxy.Forwarder.HttpForwarder[48]
      Request: An error was encountered before receiving a response.
      System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
    ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure: RemoteCertificateNameMismatch
         at System.Net.Security.SslStream.CompleteHandshake(SslAuthenticationOptions sslAuthenticationOptions)
         at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken)
         at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken)
         --- End of inner exception stack trace ---
         at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken)
         at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
         at System.Net.Http.HttpConnectionPool.AddHttp2ConnectionAsync(QueueItem queueItem)
         at System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellationAsync(CancellationToken cancellationToken)
         at System.Net.Http.HttpConnectionPool.HttpConnectionWaiter`1.WaitForConnectionAsync(Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
         at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
         at System.Net.Http.DiagnosticsHandler.SendAsyncCore(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
         at Yarp.ReverseProxy.Forwarder.HttpForwarder.SendAsync(HttpContext context, String destinationPrefix, HttpMessageInvoker httpClient, ForwarderRequestConfig requestConfig, HttpTransformer transformer, CancellationToken cancellationToken)

升级助手生成的新应用Program.cs代码 #

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddSystemWebAdapters();
builder.Services.AddHttpForwarder();

// Add services to the container.
builder.Services.AddControllersWithViews();

var app = builder.Build();

if (!app.Environment.IsDevelopment())
{
    app.UseHsts();
}

app.UseHttpsRedirection();
app.UseStaticFiles();

app.UseRouting();
app.UseAuthorization();
app.UseSystemWebAdapters();

app.MapDefaultControllerRoute();
app.MapForwarder("/{**catch-all}", app.Configuration["ProxyTo"])
    .Add(static builder => ((RouteEndpointBuilder)builder).Order = int.MaxValue);

app.Run();

解决方案 #

核心原因 #

报错中的RemoteCertificateNameMismatch明确指向SSL证书验证失败：旧应用的自定义域名local.foo.com不在IIS Express默认开发证书的域名列表中（默认证书仅包含localhost），导致YARP代理建立SSL连接时验证不通过。

解决步骤 #

1. 为自定义域名生成并信任IIS Express证书（推荐生产/开发通用方案）

• 以管理员身份打开命令提示符，运行以下命令（替换端口号为旧应用实际使用的HTTPS端口）：

  "%ProgramFiles(x86)%\IIS Express\IisExpressAdminCmd.exe" setupsslUrl -url:https://local.foo.com:44300/ -UseSelfSigned
  

• 打开MMC证书管理单元：按下Win+R输入mmc，依次点击「文件」→「添加/删除管理单元」→「证书」→「计算机账户」→「本地计算机」，找到「受信任的根证书颁发机构」→「证书」，将刚才生成的local.foo.com证书导入（若已存在则替换）。

2. 开发环境临时禁用证书验证（仅调试用，禁止生产环境使用）

如果不想重新配置证书，可临时修改Program.cs，让YARP忽略证书验证：

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddSystemWebAdapters();

// 配置忽略证书验证的HttpClient供YARP使用
builder.Services.AddHttpForwarder();
builder.Services.AddSingleton<HttpMessageInvoker>(sp =>
{
    var handler = new HttpClientHandler();
    // 仅开发环境使用，生产环境必须删除此配置
    handler.ServerCertificateCustomValidationCallback = HttpClientHandler.DangerousAcceptAnyServerCertificateValidator;
    return new HttpMessageInvoker(handler);
});

builder.Services.AddControllersWithViews();

var app = builder.Build();

if (!app.Environment.IsDevelopment())
{
    app.UseHsts();
}

app.UseHttpsRedirection();
app.UseStaticFiles();

app.UseRouting();
app.UseAuthorization();
app.UseSystemWebAdapters();

app.MapDefaultControllerRoute();
app.MapForwarder("/{**catch-all}", app.Configuration["ProxyTo"])
    .Add(static builder => ((RouteEndpointBuilder)builder).Order = int.MaxValue);

app.Run();

3. 验证配置一致性

• 确认旧应用的.vs/config/applicationhost.config文件中，local.foo.com的绑定配置使用了正确的证书哈希值；
• 检查新应用的appsettings.json中，ProxyTo的值与旧应用的完整HTTPS URL完全一致（包含端口号）。

内容的提问来源于stack exchange，提问作者JoxWar