.NET6请求HTTP接口触发SSL连接失败问题求助

问题场景 #

以下测试代码在.NET 3.1环境运行正常，但升级到.NET 6.0后执行时抛出SSL连接异常：

HttpWebRequest request = (HttpWebRequest)WebRequest.Create("http://localhost:5000/convert?inputURL=https://storage.googleapis.com/...");

HttpWebResponse response = (HttpWebResponse)request.GetResponse();
if (response.StatusCode != HttpStatusCode.OK)
{
    return false;
}
return true;

抛出的异常信息：

System.Net.WebException: The SSL connection could not be established, see inner exception. ---> System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: UntrustedRoot
Stack Trace:
at System.Net.Security.SslStream.SendAuthResetSignal(ProtocolToken message, ExceptionDispatchInfo exception)
at System.Net.Security.SslStream.CompleteHandshake(SslAuthenticationOptions sslAuthenticationOptions)
at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](TIOAdapter adapter, Boolean receiveFirst, Byte[] reAuthenticationData, Boolean isApm)
at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken)
--- End of inner exception stack trace ---
at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.AddHttp11ConnectionAsync(HttpRequestMessage request)
at System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellation(CancellationToken cancellationToken)    at System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellationAsync(Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.GetHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
at System.Net.Http.HttpMessageHandlerStage.Send(HttpRequestMessage request, CancellationToken cancellationToken)
at System.Net.Http.DiagnosticsHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpMessageHandlerStage.Send(HttpRequestMessage request, CancellationToken cancellationToken)
at System.Net.Http.SocketsHttpHandler.Send(HttpRequestMessage request, CancellationToken cancellationToken)
at System.Net.Http.HttpMessageInvoker.Send(HttpRequestMessage request, CancellationToken cancellationToken)
at System.Net.Http.HttpClient.Send(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationToken cancellationToken)
at System.Net.HttpWebRequest.SendRequest(Boolean async)
at System.Net.HttpWebRequest.GetResponse()
--- End of inner exception stack trace ---

明明请求的是HTTP接口，却触发SSL连接异常，原因和解决方法如下：

原因分析 #

1. 重定向触发SSL连接：请求目标http://localhost:5000/convert大概率返回了302重定向，跳转到了HTTPS地址。.NET 6中HttpWebRequest默认自动跟随重定向，跳转后触发SSL证书验证；而.NET 3.1的重定向处理逻辑或证书验证策略不同，因此未出现异常。
2. 证书链不被信任：重定向后的HTTPS地址使用的证书存在问题（比如自签名证书、根证书未安装到系统信任存储），导致.NET 6的SSL验证失败，抛出UntrustedRoot异常。

解决方法 #

1. 确认是否存在重定向 #

用curl、Postman等工具直接访问请求URL：

curl -v http://localhost:5000/convert?inputURL=https://storage.googleapis.com/...

查看响应中是否包含Location头部指向HTTPS地址，以此确认重定向是否存在。

2. 处理证书验证问题 #

方案一：临时禁用证书验证（仅测试环境使用）

在创建HttpWebRequest前添加证书验证回调，跳过证书检查：

// 全局设置，影响所有HttpWebRequest请求
ServicePointManager.ServerCertificateValidationCallback += (sender, cert, chain, sslPolicyErrors) => true;

HttpWebRequest request = (HttpWebRequest)WebRequest.Create("http://localhost:5000/convert?inputURL=https://storage.googleapis.com/...");
// 后续代码不变

注意：此方法会绕过所有SSL证书验证，绝对不能在生产环境使用，存在严重安全风险。

方案二：安装信任根证书（生产环境推荐）

如果重定向后的HTTPS证书合法但根证书未被系统信任，将对应的根证书安装到操作系统信任存储：

• Windows：通过证书管理器导入证书到「受信任的根证书颁发机构」
• Linux：将证书复制到/usr/local/share/ca-certificates/目录，执行update-ca-certificates命令
• macOS：通过钥匙串访问将证书添加到「系统」信任域

3. 禁用自动重定向 #

如果不需要跟随重定向，可关闭HttpWebRequest的自动重定向功能：

HttpWebRequest request = (HttpWebRequest)WebRequest.Create("http://localhost:5000/convert?inputURL=https://storage.googleapis.com/...");
request.AllowAutoRedirect = false; // 禁用自动重定向

HttpWebResponse response = (HttpWebResponse)request.GetResponse();
// 后续代码不变

这种情况下需要自行处理重定向逻辑，或确认目标接口是否必须重定向到HTTPS。

内容的提问来源于stack exchange，提问作者Joseph Smith