.NET Framework 4.7.1中HttpClient.GetAsync如何获取API真实错误消息？

需要将一段PowerShell的API调用逻辑转换为C#代码，要求兼容.NET Framework 4.7.1。PowerShell调用API时能收到明确错误消息{"Status":401,"Message":"No client certificate."}，但使用C#的HttpClient.GetAsync调用时，仅返回不含真实错误的HTML错误页，如何获取真实错误消息？

原PowerShell代码 #

$outfile="C:\temp\OutFile.xml"
    
#Force Tls 1.2
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
    
#Clientcert
$Certificate = Get-ChildItem Cert:\LocalMachine\My\xxxxx
#$Certificate
    
$LicenseKey = "xxxxx"
Invoke-RestMethod -OutFile $outfile -Certificate $Certificate -Uri https://My-API-URL
    
LicenseKey=$LicenceKey

PowerShell执行输出 #

Invoke-RestMethod : {"Status":401,"Message":"No client certificate."}
    At C:\temp\Testing_API_call.ps1:14 char:1
    + Invoke-RestMethod -OutFile $outfile -Certificate $Certificate -Uri $U ...
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-RestMethod], WebException
    + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeRestMethodCommand

现有C#代码 #

public string GetDataFromMyApi(string requestUri, X509Certificate2 certificate)
{
    string result = null;
    HttpResponseMessage response;

    HttpClientHandler handler = new HttpClientHandler();
    handler.ClientCertificates.Add(certificate);

    using (HttpClient client = new HttpClient(handler))
    {
        try
        {
            ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
            response = client.GetAsync(requestUri).Result;
        }
        catch (Exception ex)
        {
           throw new Exception($"Exception when getting data from API. requestUri: {requestUri} Exception: {ex.Message}");
        }
    }
        
    string responseContent;
    if (response.IsSuccessStatusCode == false)
    {
        if (response.StatusCode == HttpStatusCode.BadRequest)
        {
            Console.WriteLine(response.ToString());
        }                    
        responseContent = response.Content.ReadAsStringAsync().Result;
        throw new Exception($"API call did not return success code. ReasonPhase: {response.ReasonPhrase}. StatusCode: {response.StatusCode}. Response content: {responseContent}.");
    }
    else //response.IsSuccessStatusCode == true
    {
        try
        {
            result = response.Content.ReadAsStringAsync().Result;
        }
        catch (Exception ex)
        {
            throw new Exception($"API response could not be serialized. requestUri: {requestUri} Exception: {ex.Message}");
        }
    }

    return result;
}

C#调用的响应信息 #

HttpResponseMessage输出 #

StatusCode: 400
ReasonPhrase: 'Bad Request'
Version: 1.1
Content: System.Net.Http.StreamContent
Headers:
{
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: SAMEORIGIN
    Feature-Policy: accelerometer 'none';camera 'none';geolocation 'none';gyroscope 'none';magnetometer 'none';microphone 'none';payment 'none';usb 'none'
    Referrer-Policy: same-origin
    Cache-Control: private
    Date: Wed, 15 Feb 2023 14:03:35 GMT
    P3P: CP=NID DSP NOI COR, policyref=/w3c/p3p.xml
    Server: Microsoft-IIS/10.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    Content-Length: 3525
    Content-Type: text/html; charset=utf-8
}

响应内容（简化后） #

<!DOCTYPE html>
<html>
<head>
    <title>Runtime Error</title>
</head>
<body bgcolor="white">
    <span>
        <H1>Server Error in 'my.api' Application.<hr width=100% size=1 color=silver></H1>
        <h2> <i>Runtime Error</i> </h2>
    </span>
    <b> Description: </b>An application error occurred on the server. The current custom error settings for this application prevent the details of the application error from being viewed remotely (for security reasons). It could, however, be viewed by browsers running on the local server machine.
     <br>
     <br>
     <b>Details:</b> To enable the details of this specific error message to be viewable on remote machines, please create a &lt;customErrors&gt; tag within a &quot;web.config&quot; configuration file located in the root directory of the current web application. This &lt;customErrors&gt; tag should then have its &quot;mode&quot; attribute set to &quot;Off&quot;.<br><br>
     <b>Notes:</b> The current error page you are seeing can be replaced by a custom error page by modifying the &quot;defaultRedirect&quot; attribute of the application&#39;s &lt;customErrors&gt; configuration tag to point to a custom error page URL.<br><br>
     <br>
</body>
</html>

核心差异分析 #

PowerShell的Invoke-RestMethod和.NET的HttpClient默认行为存在两处关键差异：

1. 请求头设置：Invoke-RestMethod默认发送贴合API的Accept头（如application/json, text/javascript, */*; q=0.01），而HttpClient默认Accept头为text/html, application/xhtml+xml, */*，导致API返回HTML错误页而非JSON格式的真实错误信息。
2. 证书传递逻辑：HttpClientHandler加载证书时，可能存在私钥不可访问、证书权限不足等问题，导致API未识别到客户端证书。

具体修复步骤 #

1. 添加JSON格式的Accept请求头 #

明确告知API返回JSON格式响应，在创建HttpClient后添加：

client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));

2. 确保证书正确加载与传递 #

• 验证传入的X509Certificate2是否包含私钥：通过certificate.HasPrivateKey检查，若缺失，需重新加载包含私钥的证书（例如使用X509Certificate2构造函数指定X509KeyStorageFlags.Exportable | X509KeyStorageFlags.MachineKeySet确保私钥可访问）。
• 若场景允许，可设置handler.UseDefaultCredentials = true，或调整证书权限，确保当前进程能访问证书私钥。

3. 提前设置TLS协议版本 #

将ServicePointManager.SecurityProtocol的设置移到创建HttpClientHandler之前，避免初始化时使用默认协议：

ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
HttpClientHandler handler = new HttpClientHandler();

4. 优化异常处理捕获WebException #

在.NET Framework中，HTTP错误可能封装在WebException中，可通过它获取原始错误响应：

catch (AggregateException ex)
{
    var webEx = ex.InnerException as WebException;
    if (webEx != null && webEx.Response != null)
    {
        using (var stream = webEx.Response.GetResponseStream())
        using (var reader = new StreamReader(stream))
        {
            string errorContent = reader.ReadToEnd();
            throw new Exception($"API request failed. Error content: {errorContent}", ex);
        }
    }
    throw new Exception($"Exception when getting data from API. requestUri: {requestUri} Exception: {ex.Message}", ex);
}

修改后的完整C#代码 #

using System;
using System.Net;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Security.Cryptography.X509Certificates;
using System.IO;

public string GetDataFromMyApi(string requestUri, X509Certificate2 certificate)
{
    // 提前设置TLS1.2协议
    ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
    
    string result = null;
    HttpResponseMessage response;

    HttpClientHandler handler = new HttpClientHandler();
    // 验证证书是否包含私钥
    if (!certificate.HasPrivateKey)
    {
        throw new ArgumentException("提供的证书不包含私钥。");
    }
    handler.ClientCertificates.Add(certificate);

    using (HttpClient client = new HttpClient(handler))
    {
        // 指定接收JSON格式响应
        client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
        
        try
        {
            response = client.GetAsync(requestUri).Result;
        }
        catch (AggregateException ex)
        {
            var webEx = ex.InnerException as WebException;
            if (webEx != null && webEx.Response != null)
            {
                using (var stream = webEx.Response.GetResponseStream())
                using (var reader = new StreamReader(stream))
                {
                    string errorContent = reader.ReadToEnd();
                    throw new Exception($"API请求失败。错误内容: {errorContent}", ex);
                }
            }
            throw new Exception($"调用API时发生异常。请求地址: {requestUri} 异常信息: {ex.Message}", ex);
        }
    }
        
    string responseContent;
    if (!response.IsSuccessStatusCode)
    {
        responseContent = response.Content.ReadAsStringAsync().Result;
        throw new Exception($"API调用未返回成功状态码。原因描述: {response.ReasonPhrase}。状态码: {response.StatusCode}。响应内容: {responseContent}。");
    }
    else
    {
        try
        {
            result = response.Content.ReadAsStringAsync().Result;
        }
        catch (Exception ex)
        {
            throw new Exception($"API响应序列化失败。请求地址: {requestUri} 异常信息: {ex.Message}", ex);
        }
    }

    return result;
}

内容的提问来源于stack exchange，提问作者Dudute