MAUI模拟器调用WCF服务报错：Trust anchor for certification path not found

1. 确认证书类型 #

先明确WCF服务使用的是自签名证书还是内部CA签发的证书，两种场景处理逻辑不同：

• 自签名证书：直接将证书打包进APP并配置信任
• 内部CA证书：需将CA根证书导入APP信任存储

2. 打包证书到MAUI项目 #

• 将证书文件（如mycert.cer或mycert.pem）放入项目的Platforms/Android/Resources/raw目录（无raw文件夹则手动创建）
• 在项目.csproj文件中添加配置，确保证书被正确打包：

<ItemGroup>
  <AndroidResource Include="Platforms\Android\Resources\raw\mycert.cer" />
</ItemGroup>

3. 自定义Android SSL信任管理器 #

创建自定义信任类，让APP信任指定证书：

using System.IO;
using System.Linq;
using Java.Security;
using Java.Security.Cert;
using Javax.Net.Ssl;

namespace YourAppNamespace.Platforms.Android;

public class CustomTrustManager : X509ExtendedTrustManager
{
    private readonly X509Certificate[] _trustedCertificates;

    public CustomTrustManager()
    {
        // 读取raw目录下的证书文件
        using var stream = Android.App.Application.Context.Resources.OpenRawResource(Resource.Raw.mycert);
        var certificateFactory = CertificateFactory.GetInstance("X.509");
        _trustedCertificates = new[] { (X509Certificate)certificateFactory.GenerateCertificate(stream) };
    }

    public override void CheckClientTrusted(X509Certificate[] chain, string authType) { }

    public override void CheckServerTrusted(X509Certificate[] chain, string authType)
    {
        // 验证服务端证书是否在信任列表中
        if (!chain.Any(c => _trustedCertificates.Any(t => t.Equals(c))))
            throw new CertificateException("Server certificate not trusted");
    }

    public override X509Certificate[] GetAcceptedIssuers() => _trustedCertificates;

    // 重写适配Android版本的必要方法
    public override void CheckClientTrusted(X509Certificate[] chain, string authType, Socket socket)
        => CheckClientTrusted(chain, authType);

    public override void CheckServerTrusted(X509Certificate[] chain, string authType, Socket socket)
        => CheckServerTrusted(chain, authType);

    public override void CheckClientTrusted(X509Certificate[] chain, string authType, SSLEngine engine)
        => CheckClientTrusted(chain, authType);

    public override void CheckServerTrusted(X509Certificate[] chain, string authType, SSLEngine engine)
        => CheckServerTrusted(chain, authType);
}

4. 配置WCF客户端使用自定义信任管理器 #

初始化WCF客户端前替换默认SSL上下文：

using System.ServiceModel;
using Javax.Net.Ssl;

// 创建自定义SSL上下文
var sslContext = SSLContext.GetInstance("TLS");
sslContext.Init(null, new ITrustManager[] { new CustomTrustManager() }, new SecureRandom());
SSLContext.Default = sslContext;

// 初始化WCF客户端
var binding = new BasicHttpBinding(BasicHttpSecurityMode.Transport);
binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.None;
var endpoint = new EndpointAddress("https://your-wcf-service-url");
var client = new YourWcfServiceClient(binding, endpoint);

// 调用服务方法
var result = await client.YourServiceMethodAsync();

5. MAUI额外兼容配置 #

若WCF服务使用旧版TLS（如1.0/1.1），需在Platforms/Android/AndroidManifest.xml中添加：

<application android:networkSecurityConfig="@xml/network_security_config">
</application>

然后在Platforms/Android/Resources/xml目录创建network_security_config.xml：

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <base-config>
        <trust-anchors>
            <certificates src="@raw/mycert" />
            <certificates src="system" />
        </trust-anchors>
        <ssl-config>
            <min-tls-version>TLSv1.0</min-tls-version>
        </ssl-config>
    </base-config>
</network-security-config>

6. 调试验证 #

• 先通过模拟器浏览器访问WCF服务URL，确认网络连通性
• 检查证书格式是否正确（DER格式.cer或PEM格式.pem，PFX需先提取公钥证书）

内容的提问来源于stack exchange，提问作者Panjanatham