Azure APIM客户端证书验证失败：证书非空却返回“证书为空”

一、C#调用代码 #

public async Task ValidateApimAsync()
{
    X509Certificate2 certificate = getX509Certificate2();
    try
    {              
        string baseAddress = // My base URL
        var requestHandler = new HttpClientHandler();   

        //attaching my client certificate, which is NOT NULL, 
        //retrieved from the windows cert store
        requestHandler.ClientCertificates.Add(certificate);  
        
        requestHandler.SslProtocols =  System.Security.Authentication.SslProtocols.None;
        using (var client = new HttpClient(requestHandler))
        {                    
            client.BaseAddress = new Uri(baseAddress);
            client.DefaultRequestHeaders.Accept.Clear();
            ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12 | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls13;
            var responseTask = client.GetAsync(string.Format("/echo/customerMessageIds"));
            responseTask.Wait();
            var result = responseTask.Result;
            if (result.IsSuccessStatusCode)
            {
              
            }                    
        }
    }
    catch (Exception ex)
    {
        _log.LogError(ex.Message);
    }
}

二、APIM配置的验证策略 #

<when condition="@(context.Request.Certificate == null)">
    <return-response>
        <set-status code="403" reason="Certificate is null" />
        <set-body template="none">Certificate is null</set-body>
    </return-response>
</when>

三、问题详情 #

证书本身有效，但APIM始终返回“Certificate is null”响应。已尝试在Windows 10设备上添加注册表项：

• 路径：HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL
• 值名称：SendTrustedIssuerList
• 值类型：REG_DWORD
• 值数据：0（False）
  但该操作没有解决问题。

四、更新信息 #

使用自签名证书时代码可正常运行，但使用以下代码生成的证书会验证失败：

var key = RSA.Create();
var publicParameters = key.ExportParameters(false);

上述代码仅导出RSA密钥对的公钥参数，不包含私钥相关参数（如私钥指数）。

内容的提问来源于stack exchange，提问作者kudlatiger