.NET 4.6.2调用VaultSharp创建SSL/TLS安全通道失败求助

环境信息 #

• .NET版本：4.6.2
• VaultSharp包版本：1.4.0.1

代码 #

ServicePointManager.Expect100Continue = true;
ServicePointManager.SecurityProtocol = SecurityProtocolType.Ssl3 | 
                                       SecurityProtocolType.Tls12 |
                                       SecurityProtocolType.Tls11 |
                                       SecurityProtocolType.Tls | (SecurityProtocolType)3072 | 
                                       (SecurityProtocolType)768 | 
                                       (SecurityProtocolType)192;  

string certificatePath = "cert.pfx";
string secretServerAddress = "https://vaultHotName:443";
var certificate = new X509Certificate2(certificatePath, "Password", X509KeyStorageFlags.Exportable | X509KeyStorageFlags.PersistKeySet);

HttpClient httpClient = null;
IVaultClient vaultClient = null;
bool enableProxy = true;
if (enableProxy)
{
    HttpClientHandler handler = new HttpClientHandler
    {
        Proxy = new WebProxy("proxyHostName", 443),
        UseProxy = true
    };
    httpClient = new HttpClient(handler);
}

IAuthMethodInfo authMethod = new CertAuthMethodInfo(clientCertificate: certificate, roleName: vaultRole);
var vaultClientSettings = new VaultClientSettings(secretServerAddress, authMethod);
if (httpClient == null){
    vaultClient = new VaultClient(vaultClientSettings);
}
else
{
    vaultClient = new VaultClient(vaultClientSettings, httpClient);
}
var vaultClientRequired = vaultClient;
string secretFullPath = "RandomPath";
Task<Secret<Dictionary<string, object>>> fetchSecretTask = vaultClientRequired.V1.Secrets.KeyValue.V1
                    .ReadSecretAsync(path: secretFullPath);

报错信息 #

System.Net.Http.HttpRequestException: An error occurred while sending the request. ---> System.Net.WebException: The request was aborted: Could not create SSL/TLS secure channel.

堆栈跟踪 #

-> (Inner Exception #0) System.Net.Http.HttpRequestException: An error occurred while sending the request. ---> System.Net.WebException: The request was aborted: Could not create SSL/TLS secure channel.
   at System.Net.HttpWebRequest.EndGetRequestStream(IAsyncResult asyncResult, TransportContext& context)
   at System.Net.Http.HttpClientHandler.GetRequestStreamCallback(IAsyncResult ar)
   --- End of inner exception stack trace ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Net.Http.HttpClient.<FinishSendAsyncBuffered>d__58.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at VaultSharp.Core.Polymath.<MakeRequestAsync>d__16`1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at VaultSharp.Core.Polymath.<MakeVaultApiRequest>d__14`1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at VaultSharp.V1.AuthMethods.Cert.CertAuthMethodLoginProvider.<GetVaultTokenAsync>d__3.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at VaultSharp.Core.Polymath.<MakeVaultApiRequest>d__14`1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at VaultSharp.V1.SecretsEngines.KeyValue.V1.KeyValueSecretsEngineV1Provider.<ReadSecretAsync>d__3`1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at VaultSharp.V1.SecretsEngines.KeyValue.V1.KeyValueSecretsEngineV1Provider.<ReadSecretAsync>d__2.MoveNext()<---

调试详情 #

• 尝试通过C#代码调用Vault读取密钥，出现SSL/TLS安全通道创建失败的错误，已尝试网上通用方案未解决。
• 预期结果：成功读取Vault中的密钥。
• 代码在本地运行正常，QA/生产环境运行失败。
• 相同操作使用curl命令可成功执行，但C#代码报错。

排查与解决方案 #

1. 修正安全协议配置 #

.NET 4.6.2默认支持TLS 1.2，但代码中混合了不安全的SSL3、旧版TLS以及自定义数值，易导致协议协商失败。建议只启用安全协议：

ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12 | SecurityProtocolType.Tls13;
// 若环境不支持TLS1.3，仅保留Tls12即可

自定义数值(SecurityProtocolType)3072等对应TLS1.2扩展，但直接使用枚举值更可靠，避免系统差异引发问题。

2. 调整证书存储权限 #

生产环境中X509KeyStorageFlags.PersistKeySet可能引发私钥存储权限问题，修改证书加载参数：

var certificate = new X509Certificate2(certificatePath, "Password", 
    X509KeyStorageFlags.Exportable | X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.PersistKeySet);

或把PFX证书导入生产服务器的本地计算机-个人证书存储，通过证书Thumbprint加载，规避文件权限问题：

using (var store = new X509Store(StoreName.My, StoreLocation.LocalMachine))
{
    store.Open(OpenFlags.ReadOnly);
    var certCollection = store.Certificates.Find(X509FindType.FindByThumbprint, "证书Thumbprint", false);
    if (certCollection.Count > 0)
    {
        certificate = certCollection[0];
    }
}

同时确保代码运行的服务账户拥有证书私钥访问权限。

3. 修复代理配置 #

原代码中WebProxy端口使用字符串"443"，需改为整数类型。若代理需身份认证，补充凭证配置：

HttpClientHandler handler = new HttpClientHandler
{
    Proxy = new WebProxy("proxyHostName", 443)
    {
        Credentials = new NetworkCredential("proxyUser", "proxyPassword")
    },
    UseProxy = true
};

4. 验证服务器证书信任 #

curl可能已信任Vault的CA证书，但生产服务器未将其加入信任根。可：

• 将Vault的CA证书导入生产服务器的受信任根证书颁发机构存储。
• 临时测试时，添加证书验证回调（生产环境不建议长期使用）：

handler.ServerCertificateCustomValidationCallback = (sender, cert, chain, sslPolicyErrors) => true;

5. 升级VaultSharp版本 #

当前使用的1.4.0.1版本较旧，可能与新版本Vault服务器存在兼容性问题，尝试升级到最新稳定版，新版本通常修复了更多SSL/TLS适配问题。

6. 启用SSL日志排查 #

若以上方案无效，在生产服务器启用SSL日志获取协商细节：

1. 打开注册表编辑器，定位到HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL。
2. 创建EventLogging键值，设置为0x00000003（记录错误和警告）。
3. 重启服务器后，查看事件查看器系统日志中来源为Schannel的事件，获取SSL失败具体原因。

内容的提问来源于stack exchange，提问作者hacksdump