.NET 6 Web API证书身份认证无法正常工作求助

你的核心问题是缺少证书认证的核心配置逻辑，ConfigureAuthetication()扩展方法未实现，导致客户端提交的证书无法被ASP.NET Core认证体系验证并生成合法身份凭证，最终触发403禁止访问。以下是完整修复步骤：

一、实现认证配置扩展方法 #

添加认证配置扩展类，将证书验证逻辑接入ASP.NET Core认证管道：

using Microsoft.AspNetCore.Authentication.Certificate;
using System.Security.Claims;

public static class AuthenticationExtensions
{
    public static IServiceCollection ConfigureAuthetication(this IServiceCollection services)
    {
        services.AddAuthentication(CertificateAuthenticationDefaults.AuthenticationScheme)
            .AddCertificate(options =>
            {
                options.AllowedCertificateTypes = CertificateTypes.All;
                options.Events = new CertificateAuthenticationEvents
                {
                    OnCertificateValidated = context =>
                    {
                        var validationService = context.HttpContext.RequestServices.GetRequiredService<CertificateValidationService>();
                        
                        if (validationService.ValidateCertificate(context.ClientCertificate))
                        {
                            // 验证通过，生成用户身份凭证
                            var claims = new[]
                            {
                                new Claim(ClaimTypes.NameIdentifier, context.ClientCertificate.Subject),
                                new Claim(ClaimTypes.Name, context.ClientCertificate.Subject)
                            };
                            context.Principal = new ClaimsPrincipal(new ClaimsIdentity(claims, context.Scheme.Name));
                            context.Success();
                        }
                        else
                        {
                            context.Fail("证书验证不通过");
                        }
                        
                        return Task.CompletedTask;
                    },
                    OnAuthenticationFailed = context =>
                    {
                        context.Fail("证书认证流程出错");
                        return Task.CompletedTask;
                    }
                };
            });

        return services;
    }
}

二、优化证书验证服务 #

当前CertificateValidationService每次验证都重复加载证书，存在效率问题且易导致文件锁定，改为依赖注入一次性加载：

using System.Security.Cryptography.X509Certificates;
using Microsoft.AspNetCore.Hosting;

public class CertificateValidationService
{
    private readonly X509Certificate2 _trustedCert;

    public CertificateValidationService(IWebHostEnvironment env)
    {
        // 从项目根目录加载信任证书
        var certPath = Path.Combine(env.ContentRootPath, "dev_cert.pfx");
        _trustedCert = new X509Certificate2(certPath, "1234");
    }

    public bool ValidateCertificate(X509Certificate2 clientCertificate)
    {
        // 指纹大小写敏感，统一用忽略大小写对比
        return string.Equals(clientCertificate.Thumbprint, _trustedCert.Thumbprint, StringComparison.OrdinalIgnoreCase);
    }
}

三、修复客户端证书加载逻辑 #

客户端加载证书时添加存储标志，解决Windows环境下可能的权限问题：

using System.Security.Cryptography.X509Certificates;

// 添加存储标志避免权限异常
var cert = new X509Certificate2(@"dev_cert.pfx", "1234", 
    X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.PersistKeySet | X509KeyStorageFlags.Exportable);

var handler = new HttpClientHandler();
handler.ClientCertificates.Add(cert);
var client = new HttpClient(handler);

var request = new HttpRequestMessage()
{
    RequestUri = new Uri("https://localhost:7251/weatherforecast"),
    Method = HttpMethod.Get,
};
var response = await client.SendAsync(request);
if (response.IsSuccessStatusCode)
{
    var responseContent = await response.Content.ReadAsStringAsync();
    Console.WriteLine(responseContent);
}
else
{
    // 输出错误详情便于排查
    Console.WriteLine($"请求失败：{response.StatusCode} - {await response.Content.ReadAsStringAsync()}");
}

四、额外排查要点 #

• 确保dev_cert.pfx文件已设置为复制到输出目录（右键文件→属性→复制到输出目录：如果较新则复制）
• 调试时可临时关闭Kestrel证书链验证（仅用于开发）：在ConfigureHttpsDefaults中添加o.ClientCertificateValidation = (cert, chain, errors) => true;，生产环境必须移除
• 检查服务器证书是否有效，避免HTTPS连接本身失败

内容的提问来源于stack exchange，提问作者Ashok Ananthan