开发环境Mock类及生产/开发环境API调用证书逻辑分离实现方案咨询

阿华AIGC实验室

2026-4-30

Great question! Managing environment-specific configurations like client certificates without manual code changes is crucial for avoiding deployment mistakes. Here's a robust, maintainable approach using .NET's built-in configuration system and dependency injection:

解决方案步骤

1. 环境分离的配置文件

利用 .NET 自动加载环境特定配置文件的特性，分别定义生产和开发环境的配置：

appsettings.json（生产环境）

{
  "ApiSettings": {
    "Url": "https://production-api.example.com",
    "EnableClientCertificate": true,
    "CertPath": "/certs",
    "CertName": "prod-cert.pfx",
    "CertPassword": "your-secure-prod-password"
  }
}

appsettings.Development.json（开发环境）

{
  "ApiSettings": {
    "Url": "https://dev-api.example.com",
    "EnableClientCertificate": false
  }
}

.NET 会根据 ASPNETCORE_ENVIRONMENT 环境变量自动加载对应配置，无需手动修改代码。

2. 强类型配置类

创建强类型类绑定配置，避免硬编码配置键，同时获得编译时检查：

public class ApiSettings
{
    public string Url { get; set; }
    public bool EnableClientCertificate { get; set; }
    public string CertPath { get; set; }
    public string CertName { get; set; }
    public string CertPassword { get; set; }
}

3. 注册带条件证书的 HttpClient

推荐使用 IHttpClientFactory 管理 HttpClient（避免手动 new 导致的 Socket 耗尽问题），并在注册时根据配置决定是否添加证书：

// 在 Program.cs 中注册配置和 HttpClient
builder.Services.Configure<ApiSettings>(builder.Configuration.GetSection("ApiSettings"));

builder.Services.AddHttpClient("PersonApiClient", (serviceProvider, client) =>
{
    var apiSettings = serviceProvider.GetRequiredService<IOptions<ApiSettings>>().Value;
    client.BaseAddress = new Uri(apiSettings.Url);
})
.ConfigurePrimaryHttpMessageHandler(serviceProvider =>
{
    var apiSettings = serviceProvider.GetRequiredService<IOptions<ApiSettings>>().Value;
    var handler = new HttpClientHandler();

    // 仅在生产环境（配置启用时）加载证书
    if (apiSettings.EnableClientCertificate)
    {
        var fullCertPath = Path.Join(apiSettings.CertPath, apiSettings.CertName);
        var certificate = new X509Certificate2(
            fullCertPath,
            apiSettings.CertPassword,
            X509KeyStorageFlags.MachineKeySet);
        handler.ClientCertificates.Add(certificate);
    }

    return handler;
});

4. 在业务服务中使用 HttpClient

注入 IHttpClientFactory 和配置，简化业务代码：

private readonly IHttpClientFactory _httpClientFactory;
private readonly ApiSettings _apiSettings;

// 通过构造函数注入依赖
public PersonService(IHttpClientFactory httpClientFactory, IOptions<ApiSettings> apiSettings)
{
    _httpClientFactory = httpClientFactory;
    _apiSettings = apiSettings.Value;
}

public async Task<GetPersonResponse> PostPerson(PersonDto dto)
{
    try
    {
        var client = _httpClientFactory.CreateClient("PersonApiClient");
        var soapRequest = GenerateRequest(dto);

        var request = new HttpRequestMessage(HttpMethod.Post, string.Empty)
        {
            Content = new StringContent(soapRequest.ToString(), Encoding.UTF8, "text/xml")
        };

        var response = await client.SendAsync(request);
        response.EnsureSuccessStatusCode(); // 自动抛出HTTP错误异常

        // 解析响应并返回结果
        var responseContent = await response.Content.ReadAsStringAsync();
        return ParseResponse(responseContent); // 替换为你的响应解析逻辑
    }
    catch (HttpRequestException ex)
    {
        // 自定义异常处理
        throw new InvalidOperationException("调用Person API失败", ex);
    }
}

最佳实践补充

生产环境证书安全：不要明文存储证书密码，建议将证书安装到服务器的本地证书存储（如 Windows 证书管理器、Linux 的 /etc/ssl/certs），通过证书 thumbprint 读取，避免配置中暴露密码：

if (apiSettings.EnableClientCertificate)
{
    using var store = new X509Store(StoreName.My, StoreLocation.LocalMachine);
    store.Open(OpenFlags.ReadOnly);
    var certs = store.Certificates.Find(X509FindType.FindByThumbprint, apiSettings.CertThumbprint, validOnly: true);
    if (certs.Count == 0)
        throw new InvalidOperationException("未找到指定的客户端证书");
    handler.ClientCertificates.Add(certs[0]);
}