.NET SDK连接RabbitMQ证书认证失败：证书链不受信任求助

我用.NET SDK通过证书认证连接RabbitMQ时遇到问题：证书由Go Daddy颁发，Windows证书存储里已经有对应的中间证书和根证书，证书路径和密码都正确，但还是抛出「证书链由不受信任的机构颁发」错误。我已经在SslOption里设置AcceptablePolicyErrors包含SslPolicyErrors.RemoteCertificateChainErrors来忽略这类错误，但SDK仍然报错。相关代码和错误信息如下，求解决办法。

相关代码 #

ConnectionFactory connectionFactory = new ConnectionFactory
{
    HostName = _rabbitConnectionConfiguration.HostName,
    Port = _rabbitConnectionConfiguration.Port,
    VirtualHost = _rabbitConnectionConfiguration.VirtualHost,
};
connectionFactory.UserName = null;
connectionFactory.Password = null;
connectionFactory.AuthMechanisms = new IAuthMechanismFactory[] { new ExternalMechanismFactory() };

var sslOption = new SslOption
{
    Enabled = true,
    ServerName = _rabbitConnectionConfiguration.HostName,
    CertPath = _rabbitConnectionConfiguration.CertPath,
    AcceptablePolicyErrors = SslPolicyErrors.RemoteCertificateNameMismatch | SslPolicyErrors.RemoteCertificateChainErrors,
    CertPassphrase = string.IsNullOrWhiteSpace(_rabbitConnectionConfiguration.CertPassword) ? string.Empty : _rabbitConnectionConfiguration.CertPassword,
    Version = _rabbitConnectionConfiguration.Version
};

connectionFactory.Ssl = sslOption;

错误信息 #

None of the specified endpoints were reachable
System.AggregateException: One or more errors occurred. ---> System.Security.Authentication.AuthenticationException: A call to SSPI failed, see inner exception. ---> System.ComponentModel.Win32Exception: 
The certificate chain was issued by an authority that is not trusted

   --- End of inner exception stack trace ---
   at System.Net.Security.SslState.InternalEndProcessAuthentication(LazyAsyncResult lazyResult)
   at System.Net.Security.SslState.EndProcessAuthentication(IAsyncResult result)
   at System.Threading.Tasks.TaskFactory`1.FromAsyncCoreLogic(IAsyncResult iar, Func`2 endFunction, Action`1 endAction, Task`1 promise, Boolean requiresSynchronization)
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at RabbitMQ.Client.Impl.SslHelper.<>c__DisplayClass2_0.<TcpUpgrade>b__0(SslOption opts)
   at RabbitMQ.Client.Impl.SslHelper.TcpUpgrade(Stream tcpStream, SslOption options)
   at RabbitMQ.Client.Impl.SocketFrameHandler..ctor(AmqpTcpEndpoint endpoint, Func`2 socketFactory, TimeSpan connectionTimeout, TimeSpan readTimeout, TimeSpan writeTimeout)
   at RabbitMQ.Client.ConnectionFactory.CreateFrameHandler(AmqpTcpEndpoint endpoint)
   at RabbitMQ.Client.EndpointResolverExtensions.SelectOne[T](IEndpointResolver resolver, Func`2 selector)
   --- End of inner exception stack trace ---
   at RabbitMQ.Client.EndpointResolverExtensions.SelectOne[T](IEndpointResolver resolver, Func`2 selector)
   at RabbitMQ.Client.Framing.Impl.AutorecoveringConnection.Init(IEndpointResolver endpoints)
   at RabbitMQ.Client.ConnectionFactory.CreateConnection(IEndpointResolver endpointResolver, String clientProvidedName)
---> (Inner Exception #0) System.Security.Authentication.AuthenticationException: A call to SSPI failed, see inner exception. ---> System.ComponentModel.Win32Exception: The certificate chain was issued by an authority that is not trusted
   --- End of inner exception stack trace ---
   at System.Net.Security.SslState.InternalEndProcessAuthentication(LazyAsyncResult lazyResult)
   at System.Net.Security.SslState.EndProcessAuthentication(IAsyncResult result)
   at System.Threading.Tasks.TaskFactory`1.FromAsyncCoreLogic(IAsyncResult iar, Func`2 endFunction, Action`1 endAction, Task`1 promise, Boolean requiresSynchronization)
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at RabbitMQ.Client.Impl.SslHelper.<>c__DisplayClass2_0.<TcpUpgrade>b__0(SslOption opts)
   at RabbitMQ.Client.Impl.SslHelper.TcpUpgrade(Stream tcpStream, SslOption options)
   at RabbitMQ.Client.Impl.SocketFrameHandler..ctor(AmqpTcpEndpoint endpoint, Func`2 socketFactory, TimeSpan connectionTimeout, TimeSpan readTimeout, TimeSpan writeTimeout)
   at RabbitMQ.Client.ConnectionFactory.CreateFrameHandler(AmqpTcpEndpoint endpoint)
   at RabbitMQ.Client.EndpointResolverExtensions.SelectOne[T](IEndpointResolver resolver, Func`2 selector)<---

1. 修正证书存储位置 #

使用ExternalMechanismFactory做证书认证时，.NET底层SSPI调用会优先读取Local Machine存储的证书，而非Current User。即使你在Current User里安装了Go Daddy的根证书，SSPI可能找不到。

• 用管理员权限打开证书管理器，将Go Daddy的根证书导入到Local Machine\Trusted Root Certification Authorities
• 将中间证书导入到Local Machine\Intermediate Certification Authorities

2. 自定义证书验证回调 #

RabbitMQ的AcceptablePolicyErrors可能被SSPI底层调用绕过，直接添加自定义验证回调更可靠：

修改代码，给SslOption添加验证回调：

var sslOption = new SslOption
{
    // 原有配置...
};

// 添加自定义验证逻辑
connectionFactory.Ssl.RemoteCertificateValidationCallback = (sender, cert, chain, errors) =>
{
    // 仅允许指定的错误类型，生产环境建议补充更严格的校验
    return errors == SslPolicyErrors.None || 
           (errors & (SslPolicyErrors.RemoteCertificateChainErrors | SslPolicyErrors.RemoteCertificateNameMismatch)) == errors;
};

3. 检查证书链完整性 #

• 用certutil -verify <你的证书路径>命令验证证书链是否能正常构建，确认中间和根证书都在正确存储位置
• 检查RabbitMQ服务器是否返回完整的证书链，部分服务器可能未发送中间证书，导致客户端无法验证

4. 确认ServerName与证书SAN匹配 #

即使设置了忽略名称不匹配，SSPI可能仍严格校验ServerName与证书的Subject Alternative Name（SAN）字段是否完全一致。确保sslOption.ServerName的值和证书中的SAN域名完全匹配（注意大小写，部分环境会严格校验）

内容的提问来源于stack exchange，提问作者Arun Prakash Nagendran